<updates>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:17429</id>
    <title>Important: open-vm-tools security update</title>
    <issued date="2025-10-08 17:10:30" />
    <updated date="2025-10-22 08:11:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for open-vm-tools.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Open Virtual Machine Tools are the open source implementation of the VMware Tools. They are a set of guest operating system virtualization components that enhance performance and user experience of virtual machines.

Security Fix(es):

* open-vm-tools: Local privilege escalation in open-vm-tools (CVE-2025-41244)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-41244" id="CVE-2025-41244" type="cve" title="CVE-2025-41244" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2397752" id="2397752" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:17429" id="RLSA-2025:17429" type="self" title="RLSA-2025:17429" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="open-vm-tools" arch="aarch64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-12.5.0-1.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">1721b7639f4fc4bd3828ed3ab036f2dcecfd79be21dd7d991e4c215682767ce6</sum>
        </package>
        <package name="open-vm-tools-desktop" arch="aarch64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-desktop-12.5.0-1.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">455d61d38d85865c5ec20dd04eb18ba3dcad54862429dedfae83c868939a1dd5</sum>
        </package>
        <package name="open-vm-tools-test" arch="aarch64" epoch="0" version="12.5.0" release="1.el10_0.1" src="open-vm-tools-12.5.0-1.el10_0.1.src.rpm">
          <filename>open-vm-tools-test-12.5.0-1.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">7ad884fdf8709b9d1eb5f53b71c71d758f7529f6b06fbfe26114ce19566ab0ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21816</id>
    <title>Moderate: delve and golang security update</title>
    <issued date="2025-11-27 09:11:22" />
    <updated date="2025-12-11 09:10:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang, delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Go Programming Language.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21816" id="RLSA-2025:21816" type="self" title="RLSA-2025:21816" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="delve" arch="aarch64" epoch="0" version="1.25.2" release="1.el10_1" src="delve-1.25.2-1.el10_1.src.rpm">
          <filename>delve-1.25.2-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">474046e009f06b28083d89f6f02929af7cef4ab090d27b937ae60b267632ec20</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-1.25.3-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7c27557c862ad9d8de91beaebdfc5b427fcc57784efc2c5bdb30b91923f811c0</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.3-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a11fac4669c56d767161f8663237283c6086629c75943724792539ccf5e9e633</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">9e7dbd3039937982d0083ea4030a03960311db7aeb1ae99d25a440a2991a2fa8</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e6fb8d50f403ed9b6bc1c92db1313138fe48b005ee3b4e36a7572176e99ced2a</sum>
        </package>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-race-1.25.3-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d1bca98c25fc87a5180394c791f2c6de376698652dcfda1a16533fffcd55dc7f</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-src-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fcab9736bf045d0b8c60b64b37f6a5b541dc262e34b835d0d69e0d519e1c7f3f</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.3-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">ba530d6269e26f0abab9df12cb744896239302378e95e398f111e917ace9c370</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.25.3" release="1.el10_1" src="golang-1.25.3-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.3-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f73fa3ea149da02599a9c0e4eb882e865f3daca3d4c93ef73af8768d1acddf7b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:17085</id>
    <title>Important: ipa security update</title>
    <issued date="2025-10-07 17:25:42" />
    <updated date="2025-10-21 08:10:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7493" id="CVE-2025-7493" type="cve" title="CVE-2025-7493" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389448" id="2389448" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:17085" id="RLSA-2025:17085" type="self" title="RLSA-2025:17085" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipa-client" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-4.12.2-15.el10_0.4.aarch64.rpm</filename>
          <sum type="sha256">e5db4046edb4d57b6e61af2de8a354779be82e79ce6f09f18decb68dee889234</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">bf2ffd4b0910fc72cae5d3600870555b49c6996b5ffe3867900c2b05488185ab</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-15.el10_0.4.aarch64.rpm</filename>
          <sum type="sha256">c11d2eb892721b091086e555ec9967d9ccd7c74d80b313dcddfd2e4cb11beea3</sum>
        </package>
        <package name="ipa-client-epn" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-epn-4.12.2-15.el10_0.4.aarch64.rpm</filename>
          <sum type="sha256">a10d27c23bc2714cf2bb80b6f6a3bc4ead462ad1793c07d714ec24b9e64d8406</sum>
        </package>
        <package name="ipa-client-samba" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-client-samba-4.12.2-15.el10_0.4.aarch64.rpm</filename>
          <sum type="sha256">ce516135d0d220c0afa788ddb41186deb4aeb91cf682204549b7630459364e1f</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">b669a87218c94c65720ded545b0be47d09d53823ffde3e44b2c800a7e960c40f</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">9fcc498fdbeb59c1f3666a1fb65744fd3309ea356e2daa95b5f488134c90fc85</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">027300560ce6195962457cfbd64af0060014a378f1c90bcfe1dac67ec716839e</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">b0ce410d8e96f7ac938714aedf2a6088ffc94cb80fd7d3f6e5dc92863e80eaa1</sum>
        </package>
        <package name="ipa-server" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-4.12.2-15.el10_0.4.aarch64.rpm</filename>
          <sum type="sha256">028db36aac9b7ba3fadec8fcbd79b0114beaed9d440d2e83fd9722e20eccaa73</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-common-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">2d4629a5a13c49f35fa9ca50e3257dfec870ea8d687bf18bd9f9ec7b53fcf2d5</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-dns-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">13cb1b4a2b64c0636a2902942e932bba7691219c1c0b1b6105ad6d4db00c6ba5</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-15.el10_0.4.aarch64.rpm</filename>
          <sum type="sha256">868a8a293fdb1923dba7bf38fcf416e1d8fc05320d3a5dedac6749d380f86660</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-15.el10_0.4.aarch64.rpm</filename>
          <sum type="sha256">b4c3b71131389051d4df91fab9e9be5e24cb2760f15fb1190265fd4853b51f47</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipaclient-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">71d58a186df583d49049166b6469053fdca1b8f222122ce67b52f7da9a81e0ab</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipalib-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">ed44dd38a1d5d1918c30602fbb7e80d254231254f0d053b82b347d34c0246e98</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.4" src="ipa-4.12.2-15.el10_0.4.src.rpm">
          <filename>python3-ipaserver-4.12.2-15.el10_0.4.noarch.rpm</filename>
          <sum type="sha256">24f51609ea8226d2f14c8873ec839e2e8bcaa6c00297792a1f09bc4e1d53b650</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21485</id>
    <title>Moderate: java-25-openjdk security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for java-25-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

* JDK: Enhance Path Factories (CVE-2025-53066)

* JDK: Enhance Certificate Handling (CVE-2025-53057)

* JDK: Enhance String Handling (CVE-2025-61748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Note that the OpenJDK 25 package does not yet include FIPS support. This is expected to be reinstated in a future update.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53057" id="CVE-2025-53057" type="cve" title="CVE-2025-53057" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53066" id="CVE-2025-53066" type="cve" title="CVE-2025-53066" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61748" id="CVE-2025-61748" type="cve" title="CVE-2025-61748" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403063" id="2403063" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403064" id="2403064" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403082" id="2403082" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21485" id="RLSA-2025:21485" type="self" title="RLSA-2025:21485" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="java-25-openjdk" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">0ee5f6447f39a9fdd6bcc2c4e23bb7d0c1745c4e70b2a471659892aedcdc6c3e</sum>
        </package>
        <package name="java-25-openjdk-demo" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-demo-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">6059fa45ac075452fe8c48b2423fbfa30a2ece987e68620d6a99d6f3f47339fd</sum>
        </package>
        <package name="java-25-openjdk-devel" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-devel-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">bf7c0f221ee136629c3623ab80dafb7bdfedcf5be4815237a52416b60bc1ca26</sum>
        </package>
        <package name="java-25-openjdk-headless" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-headless-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">f19fe2ab9a89851a585023ab5d2ba094325b2f5da23f5de7d23440258885a33e</sum>
        </package>
        <package name="java-25-openjdk-javadoc" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">91a31ba88bc50010d948990aefc3752030d43452c04468cb1988c52a939435de</sum>
        </package>
        <package name="java-25-openjdk-javadoc-zip" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">7ad6f0bc211e863aff6979a397a27bb7ced5b3183d4290c7a5416cd46c002252</sum>
        </package>
        <package name="java-25-openjdk-jmods" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">8bf144405a7b93d59890fe1af07214b13e8eadf93ad8bd179bb574844f5a3ddf</sum>
        </package>
        <package name="java-25-openjdk-src" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-src-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">e363bfbda20e71f6182c8ba7366452d5d493e67a18c87be9304217c8fd768e52</sum>
        </package>
        <package name="java-25-openjdk-static-libs" arch="aarch64" epoch="1" version="25.0.1.0.8" release="2.el10" src="java-25-openjdk-25.0.1.0.8-2.el10.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.1.0.8-2.el10.aarch64.rpm</filename>
          <sum type="sha256">e4348d6f78e60434d34a4399163126387480bb9861b77af4393248d70940a9c6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21691</id>
    <title>Important: haproxy security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for haproxy.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The haproxy packages provide a reliable, high-performance network load balancer for TCP and HTTP-based applications.

Security Fix(es):

* haproxy: denial of service vulnerability in HAProxy mjson library (CVE-2025-11230)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11230" id="CVE-2025-11230" type="cve" title="CVE-2025-11230" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2413003" id="2413003" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21691" id="RLSA-2025:21691" type="self" title="RLSA-2025:21691" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="haproxy" arch="aarch64" epoch="0" version="3.0.5" release="4.el10_1.1" src="haproxy-3.0.5-4.el10_1.1.src.rpm">
          <filename>haproxy-3.0.5-4.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">e88222e06a8f6e535c31109692fdaf33b893b30e317a975ab4b4946f74cb963b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21936</id>
    <title>Important: valkey security update</title>
    <issued date="2025-11-25 09:18:33" />
    <updated date="2025-12-09 09:07:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

* Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

* Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

* Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46817" id="CVE-2025-46817" type="cve" title="CVE-2025-46817" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46818" id="CVE-2025-46818" type="cve" title="CVE-2025-46818" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46819" id="CVE-2025-46819" type="cve" title="CVE-2025-46819" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49844" id="CVE-2025-49844" type="cve" title="CVE-2025-49844" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401258" id="2401258" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401292" id="2401292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401322" id="2401322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401324" id="2401324" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21936" id="RLSA-2025:21936" type="self" title="RLSA-2025:21936" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="valkey" arch="aarch64" epoch="0" version="8.0.6" release="2.el10_1" src="valkey-8.0.6-2.el10_1.src.rpm">
          <filename>valkey-8.0.6-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c430f69edf8990a904a926952f23268610e2e5b82bffd25915baac1b822420d5</sum>
        </package>
        <package name="valkey-devel" arch="aarch64" epoch="0" version="8.0.6" release="2.el10_1" src="valkey-8.0.6-2.el10_1.src.rpm">
          <filename>valkey-devel-8.0.6-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3a5ce90dde7ae12fae7378b2693c859dfe2f1ada32efe20d6270ab64b60fcbfa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18320</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-26 08:08:08" />
    <updated date="2025-11-07 09:09:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)

* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)

* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)

* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)

* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)

* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708" id="CVE-2025-11708" type="cve" title="CVE-2025-11708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709" id="CVE-2025-11709" type="cve" title="CVE-2025-11709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710" id="CVE-2025-11710" type="cve" title="CVE-2025-11710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711" id="CVE-2025-11711" type="cve" title="CVE-2025-11711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712" id="CVE-2025-11712" type="cve" title="CVE-2025-11712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714" id="CVE-2025-11714" type="cve" title="CVE-2025-11714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715" id="CVE-2025-11715" type="cve" title="CVE-2025-11715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403763" id="2403763" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403765" id="2403765" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403768" id="2403768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403769" id="2403769" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403770" id="2403770" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403774" id="2403774" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403776" id="2403776" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18320" id="RLSA-2025:18320" type="self" title="RLSA-2025:18320" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.4.0" release="2.el10_0" src="thunderbird-140.4.0-2.el10_0.src.rpm">
          <filename>thunderbird-140.4.0-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7f10ab0c46ee01356925411bcfdf78e49cd4799595870951db8cff2b2ccd6a4b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18154</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* thunderbird: firefox: Memory safety bugs (CVE-2025-11714)

* thunderbird: firefox: Out of bounds read/write in a privileged process triggered by WebGL textures (CVE-2025-11709)

* thunderbird: firefox: Cross-process information leaked due to malicious IPC messages (CVE-2025-11710)

* thunderbird: firefox: Use-after-free in MediaTrackGraphImpl::GetInstance() (CVE-2025-11708)

* thunderbird: firefox: An OBJECT tag type attribute overrode browser behavior on web resources without a content-type (CVE-2025-11712)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144 and Thunderbird 144 (CVE-2025-11715)

* thunderbird: firefox: Some non-writable Object properties could be modified (CVE-2025-11711)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11708" id="CVE-2025-11708" type="cve" title="CVE-2025-11708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11709" id="CVE-2025-11709" type="cve" title="CVE-2025-11709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11710" id="CVE-2025-11710" type="cve" title="CVE-2025-11710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11711" id="CVE-2025-11711" type="cve" title="CVE-2025-11711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11712" id="CVE-2025-11712" type="cve" title="CVE-2025-11712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11714" id="CVE-2025-11714" type="cve" title="CVE-2025-11714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11715" id="CVE-2025-11715" type="cve" title="CVE-2025-11715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403763" id="2403763" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403765" id="2403765" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403768" id="2403768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403769" id="2403769" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403770" id="2403770" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403774" id="2403774" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403776" id="2403776" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18154" id="RLSA-2025:18154" type="self" title="RLSA-2025:18154" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.4.0" release="3.el10_0" src="firefox-140.4.0-3.el10_0.src.rpm">
          <filename>firefox-140.4.0-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">56c17efa72afff182e115cd50017519cd5cfc0b96945c4a1561a670545e9ff84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18152</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.121 and .NET Runtime 8.0.21.Security Fix(es):

* dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

* dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55247" id="CVE-2025-55247" type="cve" title="CVE-2025-55247" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55248" id="CVE-2025-55248" type="cve" title="CVE-2025-55248" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55315" id="CVE-2025-55315" type="cve" title="CVE-2025-55315" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403083" id="2403083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403085" id="2403085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403086" id="2403086" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18152" id="RLSA-2025:18152" type="self" title="RLSA-2025:18152" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e2ec6e1ba1ff35db7484016ccf4b430b518d9242dc168e1bf5ebacb9dfc2844b</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6873622ad6b11275ccde052e248c757d7a7ec826d9d71ff7406af351613a9d42</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">27eb567942cda06e2b68487a3f1a23fbb6511cee258cfc1d8e921757f8b83936</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8297b191ceeae760a86d1ae9b8782cc6c7b8fcea91fa80c7425095bda4764564</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">bc9aee1e2bb6fbed028e4e831cc0e5fdb5d6de5444978f7b11edf179a5245144</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">3f67674d532e4a71604774d249b4dd4c2eb5297069dc661a44c487402b78817a</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f89cec36649bec85ceaf1ae8d487f650e3b42dc7149d7e9b40fd54c56f2a711a</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.121-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7b73c22fa01316a043692b11ecec9dd9a99959db503123f978b6d4eb0ddb5b3c</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.121-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">cd914aeac3c4519baa4ef692ced0a7af539b086d80ba920e35e02a726c144780</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.21" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.21-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c4afc5b2644c992e937b9ab7cbfd59994c9fa91e617a2affb14b05856e2c22dc</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.121" release="1.el10_0" src="dotnet8.0-8.0.121-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.121-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d795f0f14208f60340d07c091df12f6a11cbed028cb661faf75520fa9e1b6dfa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18153</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.111 and .NET Runtime 9.0.10.Security Fix(es):

* dotnet: .NET Information Disclosure Vulnerability (CVE-2025-55248)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2025-55315)

* dotnet: .NET Denial of Service Vulnerability (CVE-2025-55247)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55247" id="CVE-2025-55247" type="cve" title="CVE-2025-55247" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55248" id="CVE-2025-55248" type="cve" title="CVE-2025-55248" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55315" id="CVE-2025-55315" type="cve" title="CVE-2025-55315" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403083" id="2403083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403085" id="2403085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2403086" id="2403086" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18153" id="RLSA-2025:18153" type="self" title="RLSA-2025:18153" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">aae9d669be5b1ad31351daea5fcf9d3daa707b8e3ab910d848eed38be53ec566</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7a527433a45cbeb1985f0739c4efb502c2ee89321dfd36a4446bd4cac3d7ceff</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">03778219168b65ec9dc503df3271a53753d2c1d5e7e4b8e6e7db49bf2ec11731</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">3f97bc81dad00bb3e2dde8370107b9b05cf44fa127db36e4c0664004f626e39e</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">543cd2aa1e6af4611256d2de51e3c4744257b0127f7162e7af212be63ac5923a</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">45d73359826c0a60b98df18e8fa022d83a70f16b70a06077f0dd5d3e93454ea8</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">99e542310aa82f7a3a72d1847f75792aa8de2d08bb3583dd71273536833d80a3</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0aff7b1743219bfebe68e3b191b849dbbd05edcad20fd7dd17c4cf53d6f79c87</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.111-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4eef71ac2f7f386ec1c909d831030126248d293ad0f596d81736fe7544e99b03</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.111-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c32125f7ecc596bd1c79bda5d8c300fe4ed373f1f2c55290ef0f2c6ca82024ff</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.111-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">13ed4158de5f1347d98eecac2d1bffcfc56483e794009f2845914cd8f36793a5</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.10" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9e6e6d96c75fc5d7985c0f11e53e7bec73360ae72aa073f487dc181e7ee096e1</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.111-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">06ab463d0fe5e329151c2fffdc89c6ee6443deac018e1578bc77fb2dcbef9d3b</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.111" release="1.el10_0" src="dotnet9.0-9.0.111-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.111-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5da4ef9a451f69ce545d089ae73a5bb4d893963431bc6e17aebd3f2be694e306</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:18183</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-10-18 08:09:12" />
    <updated date="2025-11-01 08:10:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11021" id="CVE-2025-11021" type="cve" title="CVE-2025-11021" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2399627" id="2399627" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:18183" id="RLSA-2025:18183" type="self" title="RLSA-2025:18183" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_0.7" src="libsoup3-3.6.5-3.el10_0.7.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.7.aarch64.rpm</filename>
          <sum type="sha256">393b7a7f6e7525b90f240c70e593070ce808134dccf366d36915aa6cd1ba1350</sum>
        </package>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_0.7" src="libsoup3-3.6.5-3.el10_0.7.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.7.aarch64.rpm</filename>
          <sum type="sha256">592eb7506bd822c69ce0da9c54d4316e084839d84cce12ef6edf148802d157c8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19156</id>
    <title>Important: libtiff security update</title>
    <issued date="2025-11-02 09:08:07" />
    <updated date="2025-11-16 09:10:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Libtiff Write-What-Where (CVE-2025-9900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9900" id="CVE-2025-9900" type="cve" title="CVE-2025-9900" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2392784" id="2392784" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19156" id="RLSA-2025:19156" type="self" title="RLSA-2025:19156" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libtiff" arch="aarch64" epoch="0" version="4.6.0" release="6.el10_0.1" src="libtiff-4.6.0-6.el10_0.1.src.rpm">
          <filename>libtiff-4.6.0-6.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">6f84ef0aaa354bd034802f3dc1eb402e5fd5478ab7cac2e5d0976531ef81dfca</sum>
        </package>
        <package name="libtiff-devel" arch="aarch64" epoch="0" version="4.6.0" release="6.el10_0.1" src="libtiff-4.6.0-6.el10_0.1.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">95f445d0d99db5a3487731a1836981242ebd6a19e7c320119f10624a67e47194</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19435</id>
    <title>Moderate: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xmayland: Use-after-free in XPresentNotify structure creation (CVE-2025-62229)

* xorg: xwayland: Use-after-free in Xkb client resource removal (CVE-2025-62230)

* xorg: xmayland: Value overflow in XkbSetCompatMap() (CVE-2025-62231)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62229" id="CVE-2025-62229" type="cve" title="CVE-2025-62229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62230" id="CVE-2025-62230" type="cve" title="CVE-2025-62230" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62231" id="CVE-2025-62231" type="cve" title="CVE-2025-62231" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402649" id="2402649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402653" id="2402653" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2402660" id="2402660" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19435" id="RLSA-2025:19435" type="self" title="RLSA-2025:19435" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="aarch64" epoch="0" version="24.1.5" release="5.el10_0" src="xorg-x11-server-Xwayland-24.1.5-5.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-5.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4f69b8fa28df14635738ae52903d1c1d9ddaa54140afec9c48bace989f0f02be</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19675</id>
    <title>Important: valkey security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Lua library commands may lead to integer overflow and potential RCE (CVE-2025-46817)

* Redis: Redis: Authenticated users can execute LUA scripts as a different user (CVE-2025-46818)

* Redis: Redis is vulnerable to DoS via specially crafted LUA scripts (CVE-2025-46819)

* Redis: Redis Lua Use-After-Free may lead to remote code execution (CVE-2025-49844)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46817" id="CVE-2025-46817" type="cve" title="CVE-2025-46817" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46818" id="CVE-2025-46818" type="cve" title="CVE-2025-46818" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46819" id="CVE-2025-46819" type="cve" title="CVE-2025-46819" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49844" id="CVE-2025-49844" type="cve" title="CVE-2025-49844" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401258" id="2401258" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401292" id="2401292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401322" id="2401322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401324" id="2401324" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19675" id="RLSA-2025:19675" type="self" title="RLSA-2025:19675" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="valkey" arch="aarch64" epoch="0" version="8.0.6" release="1.el10_0" src="valkey-8.0.6-1.el10_0.src.rpm">
          <filename>valkey-8.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5b00d3d5b3b21649c29f05e846e6816b0838f6a263c5ea39fff46ac634b14df0</sum>
        </package>
        <package name="valkey-devel" arch="aarch64" epoch="0" version="8.0.6" release="1.el10_0" src="valkey-8.0.6-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">abaf90665823a14928c8da7836c0bc86664aeabc1dfb2caf941ce78bd173eb7f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19720</id>
    <title>Low: libsoup3 security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4945" id="CVE-2025-4945" type="cve" title="CVE-2025-4945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367175" id="2367175" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19720" id="RLSA-2025:19720" type="self" title="RLSA-2025:19720" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_0.9" src="libsoup3-3.6.5-3.el10_0.9.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.9.aarch64.rpm</filename>
          <sum type="sha256">0a6bd6531a3868cf708fc8111c52c793559fefcc1ef04b3f8a906e1ce898ae43</sum>
        </package>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_0.9" src="libsoup3-3.6.5-3.el10_0.9.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.9.aarch64.rpm</filename>
          <sum type="sha256">baf0f9600b540f7690c61343fa1f0c86617085dc99978cf810138c3adad41124</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:19772</id>
    <title>Important: qt6-qtsvg security update</title>
    <issued date="2025-11-06 09:08:39" />
    <updated date="2025-11-20 09:10:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10729" id="CVE-2025-10729" type="cve" title="CVE-2025-10729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401241" id="2401241" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:19772" id="RLSA-2025:19772" type="self" title="RLSA-2025:19772" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="aarch64" epoch="0" version="6.8.1" release="1.el10_0.1" src="qt6-qtsvg-6.8.1-1.el10_0.1.src.rpm">
          <filename>qt6-qtsvg-6.8.1-1.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">cb0ce35e32f233baca9adcab79b62e5e5b58e8fb97692a2ce773e8a8b9866051</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="aarch64" epoch="0" version="6.8.1" release="1.el10_0.1" src="qt6-qtsvg-6.8.1-1.el10_0.1.src.rpm">
          <filename>qt6-qtsvg-devel-6.8.1-1.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">e5d7aa9388ab9fca8a3556af4269cab85d1bf4948250d2f281881f96f659816a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22012</id>
    <title>Important: buildah security update</title>
    <issued date="2025-11-28 09:17:04" />
    <updated date="2025-12-12 09:09:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881" id="CVE-2025-52881" type="cve" title="CVE-2025-52881" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404715" id="2404715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22012" id="RLSA-2025:22012" type="self" title="RLSA-2025:22012" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah" arch="aarch64" epoch="2" version="1.41.6" release="1.el10_1" src="buildah-1.41.6-1.el10_1.src.rpm">
          <filename>buildah-1.41.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5d03e8f04d5afd5dfb23366a7dc42079e3ab50100fbcbbb166bd1ca0274003f0</sum>
        </package>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.41.6" release="1.el10_1" src="buildah-1.41.6-1.el10_1.src.rpm">
          <filename>buildah-tests-1.41.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">20812e0a0ce4026f0ff0385e13683de97e4c67ce6ff50c0461fa3b05e87e2074</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22361</id>
    <title>Moderate: qt6-qtquick3d security update</title>
    <issued date="2025-12-02 09:07:01" />
    <updated date="2025-12-15 09:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtquick3d.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Qt 6 Quick3D library.

Security Fix(es):

* assimp: Open Asset Import Library Assimp Q3DLoader.cpp InternReadFile heap-based overflow (CVE-2025-11277)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11277" id="CVE-2025-11277" type="cve" title="CVE-2025-11277" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401622" id="2401622" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22361" id="RLSA-2025:22361" type="self" title="RLSA-2025:22361" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qt6-qtquick3d" arch="aarch64" epoch="0" version="6.9.1" release="1.el10_1.1" src="qt6-qtquick3d-6.9.1-1.el10_1.1.src.rpm">
          <filename>qt6-qtquick3d-6.9.1-1.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">5cfeed0f695030567299e49be4762dd50144ffea9b255a8cf7710493566cf2ea</sum>
        </package>
        <package name="qt6-qtquick3d-devel" arch="aarch64" epoch="0" version="6.9.1" release="1.el10_1.1" src="qt6-qtquick3d-6.9.1-1.el10_1.1.src.rpm">
          <filename>qt6-qtquick3d-devel-6.9.1-1.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">d92dea864a12be0a4ea168af8598262d7597617bed6bc3a9423dcd2eb2dcfee3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:22394</id>
    <title>Moderate: qt6-qtsvg security update</title>
    <issued date="2025-12-02 09:07:01" />
    <updated date="2025-12-15 09:09:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Uncontrolled recursion in Qt SVG module (CVE-2025-10728)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10728" id="CVE-2025-10728" type="cve" title="CVE-2025-10728" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401244" id="2401244" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:22394" id="RLSA-2025:22394" type="self" title="RLSA-2025:22394" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="aarch64" epoch="0" version="6.9.1" release="2.el10_1.2" src="qt6-qtsvg-6.9.1-2.el10_1.2.src.rpm">
          <filename>qt6-qtsvg-6.9.1-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">640adf43cbb917a75972a006df9b506ea06601fcbf2f75668c64023a6e3a3011</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="aarch64" epoch="0" version="6.9.1" release="2.el10_1.2" src="qt6-qtsvg-6.9.1-2.el10_1.2.src.rpm">
          <filename>qt6-qtsvg-devel-6.9.1-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">83bc81b4b744709945d9447c36a3f607b6b5571a110415b79de8f1e15c7f91f8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23035</id>
    <title>Important: firefox security update</title>
    <issued date="2025-12-11 09:09:11" />
    <updated date="2025-12-25 09:09:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)

* firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

* firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

* firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14321" id="CVE-2025-14321" type="cve" title="CVE-2025-14321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14322" id="CVE-2025-14322" type="cve" title="CVE-2025-14322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14323" id="CVE-2025-14323" type="cve" title="CVE-2025-14323" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14324" id="CVE-2025-14324" type="cve" title="CVE-2025-14324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14325" id="CVE-2025-14325" type="cve" title="CVE-2025-14325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14328" id="CVE-2025-14328" type="cve" title="CVE-2025-14328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14329" id="CVE-2025-14329" type="cve" title="CVE-2025-14329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14330" id="CVE-2025-14330" type="cve" title="CVE-2025-14330" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14331" id="CVE-2025-14331" type="cve" title="CVE-2025-14331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14333" id="CVE-2025-14333" type="cve" title="CVE-2025-14333" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420502" id="2420502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420503" id="2420503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420504" id="2420504" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420506" id="2420506" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420508" id="2420508" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420509" id="2420509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420512" id="2420512" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420513" id="2420513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420516" id="2420516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420517" id="2420517" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23035" id="RLSA-2025:23035" type="self" title="RLSA-2025:23035" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.6.0" release="1.el10_1" src="firefox-140.6.0-1.el10_1.src.rpm">
          <filename>firefox-140.6.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b4ba802905751c6d9b935584335e374a55203439d6ce46a69c5615cc3486a621</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23008</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: DML unspecified vulnerability (CPU Oct 2025) (CVE-2025-53053)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53044)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53062)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53054)

* mysql: InnoDB unspecified vulnerability (CPU Oct 2025) (CVE-2025-53045)

* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53040)

* mysql: Components Services unspecified vulnerability (CPU Oct 2025) (CVE-2025-53069)

* mysql: Optimizer unspecified vulnerability (CPU Oct 2025) (CVE-2025-53042)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53040" id="CVE-2025-53040" type="cve" title="CVE-2025-53040" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53042" id="CVE-2025-53042" type="cve" title="CVE-2025-53042" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53044" id="CVE-2025-53044" type="cve" title="CVE-2025-53044" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53045" id="CVE-2025-53045" type="cve" title="CVE-2025-53045" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53053" id="CVE-2025-53053" type="cve" title="CVE-2025-53053" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53054" id="CVE-2025-53054" type="cve" title="CVE-2025-53054" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53062" id="CVE-2025-53062" type="cve" title="CVE-2025-53062" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53069" id="CVE-2025-53069" type="cve" title="CVE-2025-53069" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405486" id="2405486" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405491" id="2405491" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405511" id="2405511" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405514" id="2405514" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405523" id="2405523" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405534" id="2405534" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405541" id="2405541" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405544" id="2405544" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23008" id="RLSA-2025:23008" type="self" title="RLSA-2025:23008" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mysql8.4" arch="aarch64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-8.4.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8d54ca98f72635094e8c8edbac5952e7d9622b049397e6fc5f1737d7a10e86c3</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-common-8.4.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e8ec68c244bd06db9f32dc93d71f733d7643bcdba0969553fd2968abcde61056</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">c956ef5c3dc121f79a41086b473d6c274856a3d4b5532134099b9fd082f6997b</sum>
        </package>
        <package name="mysql8.4-libs" arch="aarch64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-libs-8.4.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3131f56c5467f301a60c657d75fafe1a650afd86b1c7ff78d93c49a5190b17ce</sum>
        </package>
        <package name="mysql8.4-server" arch="aarch64" epoch="0" version="8.4.7" release="1.el10_1" src="mysql8.4-8.4.7-1.el10_1.src.rpm">
          <filename>mysql8.4-server-8.4.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6405be32440d26bab601d8345611938649611ec6b3602b7bef0a97d2d4f8ff07</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23052</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651" id="CVE-2025-31651" type="cve" title="CVE-2025-31651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752" id="CVE-2025-55752" type="cve" title="CVE-2025-55752" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362782" id="2362782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406591" id="2406591" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23052" id="RLSA-2025:23052" type="self" title="RLSA-2025:23052" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">7cb5590482ebdaddcbbcc94193841985acbc24a97dd733ad433d4aae10f049e3</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">8f02b67c2c971db9acd8c1abcf7755fbcc5d5bbfe13a3c751ac4cca4f1fb8749</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1450c24d9c1bbc753470d72e048496c4a53440d72dfeb83263d072167543b2d3</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">aeb97317e8764d3e5a34e98b3497e42423342cdd3528389f6d16d3d2882ffce2</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">fb073920aa88369e9357f674e08aad249f602afd88abf632b4e247288b7f3b17</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-lib-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">36627b3f5df782484dd4f166526c3a53f9bc85759b4c47e5fa65ec326dc097eb</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">f69f116d2eb2b097c73b3a29fa5ab70b64be7918b5c595083f4fe1a6bcd6baef</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="8.el10_1.1" src="tomcat9-9.0.87-8.el10_1.1.src.rpm">
          <filename>tomcat9-webapps-9.0.87-8.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">e69a9ba31bebb341d955e267012dce698882592c2bf0ea0e8b1681bc64e1e3ea</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23050</id>
    <title>Important: tomcat security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve (CVE-2025-31651)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service (CVE-2025-61795)

* tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE (CVE-2025-55752)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31651" id="CVE-2025-31651" type="cve" title="CVE-2025-31651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55752" id="CVE-2025-55752" type="cve" title="CVE-2025-55752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61795" id="CVE-2025-61795" type="cve" title="CVE-2025-61795" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362782" id="2362782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406588" id="2406588" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406591" id="2406591" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23050" id="RLSA-2025:23050" type="self" title="RLSA-2025:23050" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">f9de65559b1d36fada76879998ed02b85338697dc97a36ee317fc5aaef8c0493</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">ba2127f13424b7ef9c46ee3c1932be1eadc142a4e9f5df6bb0161659490f84e6</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">90e83c4283a81b358bb0d7f9c4330bc05d54607bfe5a892233eb3ce26ed60437</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">8bd07c2f0f6d3cae1d10aa2209a16e867c26eb73aa2c824dad456eb18b164478</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">778970678c930f76cb71d2673800d653f77eeec1c7bcede1d5b6cf20d8e1266e</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-lib-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">adb09daaaca930ba42e0d3bfef2ca2b98550a98cf188b51abd82c8cea6446fee</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">e5a3d01edd1133ac65bd6a72d417223e420eb0139cb886e74336827bb2b2e38b</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="3.el10_1.1" src="tomcat-10.1.36-3.el10_1.1.src.rpm">
          <filename>tomcat-webapps-10.1.36-3.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">91eec5407c25a1837a75508aee6b24c3ed68bc49ed361e4b4d093dcf20104e8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23083</id>
    <title>Important: wireshark security update</title>
    <issued date="2025-12-12 09:08:37" />
    <updated date="2025-12-26 09:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Access of Uninitialized Pointer in Wireshark (CVE-2025-13499)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13499" id="CVE-2025-13499" type="cve" title="CVE-2025-13499" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2416293" id="2416293" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23083" id="RLSA-2025:23083" type="self" title="RLSA-2025:23083" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="wireshark" arch="aarch64" epoch="1" version="4.4.2" release="4.el10_1.1" src="wireshark-4.4.2-4.el10_1.1.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">c818afe73d994aa4edf4157680bd2c4bccff56b042fd0742b82956303a01a757</sum>
        </package>
        <package name="wireshark-cli" arch="aarch64" epoch="1" version="4.4.2" release="4.el10_1.1" src="wireshark-4.4.2-4.el10_1.1.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">dc5016334f2d7987d721808b64278b514f7fc2cdcfa39066898adcec09f5f23a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23088</id>
    <title>Moderate: grafana security update</title>
    <issued date="2025-12-13 09:11:15" />
    <updated date="2025-12-27 09:10:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23088" id="RLSA-2025:23088" type="self" title="RLSA-2025:23088" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="21.el10_1" src="grafana-10.2.6-21.el10_1.src.rpm">
          <filename>grafana-10.2.6-21.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1f8194f0dd1856385d7dbb400d738ed451bbde6fb7b6b2b713a619a9dfb1c882</sum>
        </package>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="21.el10_1" src="grafana-10.2.6-21.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-21.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5f20645c46cd08a2b0901ee9dd5ae458f09c1583cfa86976b7bfd07562d919e3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23139</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2025-12-13 09:11:15" />
    <updated date="2025-12-27 09:10:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Heap Use-After-Free in libsoup message queue handling during HTTP/2 read completion (CVE-2025-12105)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12105" id="CVE-2025-12105" type="cve" title="CVE-2025-12105" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405992" id="2405992" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23139" id="RLSA-2025:23139" type="self" title="RLSA-2025:23139" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.7" src="libsoup3-3.6.5-3.el10_1.7.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.7.aarch64.rpm</filename>
          <sum type="sha256">1c5b58cc42e12b093346325241830f2517ac4b99ab97f8296e089b297ee61ff4</sum>
        </package>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.7" src="libsoup3-3.6.5-3.el10_1.7.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.7.aarch64.rpm</filename>
          <sum type="sha256">3282599046b099a7ea831444a04066fdf078ab10f3667d9e4aead218f28c5013</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23201</id>
    <title>Important: keylime security update</title>
    <issued date="2025-12-18 09:09:42" />
    <updated date="2026-01-01 09:09:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Registrar allows identity takeover via duplicate UUID registration (CVE-2025-13609)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13609" id="CVE-2025-13609" type="cve" title="CVE-2025-13609" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2416761" id="2416761" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23201" id="RLSA-2025:23201" type="self" title="RLSA-2025:23201" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="keylime-tools" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-tools-7.12.1-11.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">c4b6cf21629f6ff81f54f46e11b5e01139ff4d48dcfae1b9ab0e23522382ff6c</sum>
        </package>
        <package name="keylime-verifier" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-verifier-7.12.1-11.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">cfad819993794b822ac7b468b59fc4cecb8974ed328c4d14fe81c744409c8248</sum>
        </package>
        <package name="python3-keylime" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>python3-keylime-7.12.1-11.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">38b51bc0177829e8050202e43154697217ac2a37f5b8a95832c53087e06ae6cd</sum>
        </package>
        <package name="keylime" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-7.12.1-11.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">77637e24df06aa3f239bc14b939740e01110df8e02137063d9ac0948185bc794</sum>
        </package>
        <package name="keylime-base" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-base-7.12.1-11.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">8986a92a8486dc01d7d2f51e118e5dccf48fc7d3a76692e5f1a83cfd6768bf59</sum>
        </package>
        <package name="keylime-registrar" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-registrar-7.12.1-11.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">ce1c6bed869275f6720498a850569f60d6e52dd2d10d79d1488d0856cfcd1017</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-selinux-7.12.1-11.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">b47e065a613fca8753074843dc80b00630a87bea49c40544a70f1d245bf2d914</sum>
        </package>
        <package name="keylime-tenant" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.3" src="keylime-7.12.1-11.el10_1.3.src.rpm">
          <filename>keylime-tenant-7.12.1-11.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">8ec5a15f37fd17141a5474a533c0ad6175687c28442d06c23ff76e4357bca904</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:20478</id>
    <title>Moderate: zziplib security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for zziplib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The zziplib is a lightweight library to easily extract data from zip files.

Security Fix(es):

* zziplib: directory traversal in unzzip_cat in the bins/unzzipcat-mem.c (CVE-2018-17828)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17828" id="CVE-2018-17828" type="cve" title="CVE-2018-17828" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=1635888" id="1635888" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:20478" id="RLSA-2025:20478" type="self" title="RLSA-2025:20478" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="zziplib" arch="aarch64" epoch="0" version="0.13.78" release="2.el10" src="zziplib-0.13.78-2.el10.src.rpm">
          <filename>zziplib-0.13.78-2.el10.aarch64.rpm</filename>
          <sum type="sha256">a5c94c61cf10ae637c65d8100d847d223b104a551e1785dff946626bdf40a39e</sum>
        </package>
        <package name="zziplib-utils" arch="aarch64" epoch="0" version="0.13.78" release="2.el10" src="zziplib-0.13.78-2.el10.src.rpm">
          <filename>zziplib-utils-0.13.78-2.el10.aarch64.rpm</filename>
          <sum type="sha256">9eb2f8f24ed506a762fdc0ade5e4e1f5c9b7ee7df4e48dda54cb88c09d062044</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21002</id>
    <title>Important: squid security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for squid.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

* squid-cache: Squid vulnerable to information disclosure via authentication credential leakage in error handling (CVE-2025-62168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62168" id="CVE-2025-62168" type="cve" title="CVE-2025-62168" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404736" id="2404736" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21002" id="RLSA-2025:21002" type="self" title="RLSA-2025:21002" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="squid" arch="aarch64" epoch="7" version="6.10" release="6.el10_1.1" src="squid-6.10-6.el10_1.1.src.rpm">
          <filename>squid-6.10-6.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">964726875480bf40cbeb44a6a43cbf6fce34acff4940ad1745f394e341db8b05</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:20994</id>
    <title>Important: ipa security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* FreeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-7493)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7493" id="CVE-2025-7493" type="cve" title="CVE-2025-7493" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389448" id="2389448" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:20994" id="RLSA-2025:20994" type="self" title="RLSA-2025:20994" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipa-client" arch="aarch64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-4.12.2-24.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">9411d624dace98b7a1b3289f847b73712220642596ecdd7bcec9484732d27d33</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1ed48f9ea27e3d51c6938f8e04aa918e384c4163a7cfb53d1b4afa22cf261bd1</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="aarch64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-24.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">e4d31880f78037ca3082443c5d072499039137433833a8c36c27f571e07ac1b4</sum>
        </package>
        <package name="ipa-client-epn" arch="aarch64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-epn-4.12.2-24.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">f520b9b640d9adb4b00d8865f54b8e2045dae180969de72f7d1b9223c5e8fae8</sum>
        </package>
        <package name="ipa-client-samba" arch="aarch64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-client-samba-4.12.2-24.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">2bd73688be882bd4bdc835f370172e80847b52127cdce0007f8da90599923a3e</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">c1b9d1f2220bf3eb358abd8e95f7790745255ec3f3b399abaf7aad2953c0e5eb</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">75744bb5b01ef62b6915e55785bd42a945b325ddb7f123f0a11777702a42f904</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">5093abf0e161cee519dc8d2a71d8ede28a212cab1c0cba7f4681439fe58bbc1a</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">47ba228ca00a37cc15ccf6a9c4652a6fca96634201e65eb95a4cb354e38eb33c</sum>
        </package>
        <package name="ipa-server" arch="aarch64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-4.12.2-24.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">423c13b6e78e69cf4369468cfdc6cc284bba2f456182b7ac5ea666df432d8637</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-common-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">d51abb9a704469c8fcfc1b2a1b4ddb7c26c16a2435b35a61d62cefb5aeebd594</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-dns-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">1c1d5b78f31b2f73883906d472f58a8ea5e8a54a3a1bbc3cfc84b44f3f514b8c</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="aarch64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-24.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">59e907f42a11185a8aee72aa07c02345767b57df64b4e56d50a51a9b604bf7c6</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="aarch64" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-24.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">61133c1243f672c0c873d46221257f4b99629f4921435b2ce765afeffc83b7f5</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipaclient-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">fb3029b088891bad80443ccc23f16928d47e9ed109d7081e2bcb4ef7f6bee08d</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipalib-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">d0443950c78b0bd4142c09462e1f2bcacabd02835e3afb176e71bd02b62ad86b</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="24.el10_1.1" src="ipa-4.12.2-24.el10_1.1.src.rpm">
          <filename>python3-ipaserver-4.12.2-24.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">0bd398d681243e4de7c442df874a15304a0cf695e5736b5040399a851b644bf4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21032</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Integer Overflow in Cookie Expiration Date Handling in libsoup (CVE-2025-4945)

* libsoup: Out-of-Bounds Read in Cookie Date Handling of libsoup HTTP Library (CVE-2025-11021)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11021" id="CVE-2025-11021" type="cve" title="CVE-2025-11021" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4945" id="CVE-2025-4945" type="cve" title="CVE-2025-4945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367175" id="2367175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2399627" id="2399627" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21032" id="RLSA-2025:21032" type="self" title="RLSA-2025:21032" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.6" src="libsoup3-3.6.5-3.el10_1.6.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.6.aarch64.rpm</filename>
          <sum type="sha256">afbe9a982f4626bc84763baedc63e5b29cf8b5a1c0cb61e6d6b80da8b5a71d47</sum>
        </package>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.6" src="libsoup3-3.6.5-3.el10_1.6.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.6.aarch64.rpm</filename>
          <sum type="sha256">dc47d85945942bf373f5883ee68ca00653da40fc3daac9c95846f3d44d1fc895</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21037</id>
    <title>Important: qt6-qtsvg security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qt6-qtsvg.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Scalable Vector Graphics (SVG) is an XML-based language for describing two-dimensional vector graphics. Qt provides classes for rendering and displaying SVG drawings in widgets and on other paint devices.

Security Fix(es):

* qtsvg: Use-after-free vulnerability in Qt SVG (CVE-2025-10729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10729" id="CVE-2025-10729" type="cve" title="CVE-2025-10729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401241" id="2401241" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21037" id="RLSA-2025:21037" type="self" title="RLSA-2025:21037" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qt6-qtsvg" arch="aarch64" epoch="0" version="6.9.1" release="2.el10_1.1" src="qt6-qtsvg-6.9.1-2.el10_1.1.src.rpm">
          <filename>qt6-qtsvg-6.9.1-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">3ff2cb179c9f265a18f26ab20419e4c5a4fd9b87ccc0287cc5c3a4d823c2aaf0</sum>
        </package>
        <package name="qt6-qtsvg-devel" arch="aarch64" epoch="0" version="6.9.1" release="2.el10_1.1" src="qt6-qtsvg-6.9.1-2.el10_1.1.src.rpm">
          <filename>qt6-qtsvg-devel-6.9.1-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">501c481eebe8f09b23f581fa7044a4e8a638305ab1588457d10731aefaa4b030</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21034</id>
    <title>Important: bind security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:24" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: Cache poisoning attacks with unsolicited RRs (CVE-2025-40778)

* bind: Cache poisoning due to weak PRNG (CVE-2025-40780)

* bind: Resource exhaustion via malformed DNSKEY handling (CVE-2025-8677)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40778" id="CVE-2025-40778" type="cve" title="CVE-2025-40778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40780" id="CVE-2025-40780" type="cve" title="CVE-2025-40780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8677" id="CVE-2025-8677" type="cve" title="CVE-2025-8677" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405827" id="2405827" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405829" id="2405829" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405830" id="2405830" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21034" id="RLSA-2025:21034" type="self" title="RLSA-2025:21034" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="bind" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-9.18.33-10.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">9a2a1d6c52f5d3d9b95dcf5dd958d2582d035e2f5b12cffdf9ebaf703a75c3c9</sum>
        </package>
        <package name="bind-chroot" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-chroot-9.18.33-10.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">c33b71ed4823271bfbef945c34209584b4b90cd839cef1050f815c5f50a83fab</sum>
        </package>
        <package name="bind-dnssec-utils" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-10.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">c2894d3c9d13f6a54469ca0bc7526ee8724f4f07e49eaafbe67b8250c52d7a85</sum>
        </package>
        <package name="bind-libs" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-libs-9.18.33-10.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">5add201e2e5ed33099f655fdd378449c7475cf8e8057e414601a4e9ea1d0b8f2</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-license-9.18.33-10.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">2c9c63219d146ae32dc4bc03c04bf15a22ceef7fa40fdd33bd8865eac1c33a16</sum>
        </package>
        <package name="bind-utils" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.2" src="bind-9.18.33-10.el10_1.2.src.rpm">
          <filename>bind-utils-9.18.33-10.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">74e1400c6aaee4661ca91c87a9b4ce3ab8fa13dbdb1f354d59fdfff7c3d260d2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21142</id>
    <title>Important: python-kdcproxy security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-kdcproxy.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-kdcproxy: Unauthenticated SSRF via Realm?Controlled DNS SRV (CVE-2025-59088)

* python-kdcproxy: Remote DoS via unbounded TCP upstream buffering (CVE-2025-59089)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59088" id="CVE-2025-59088" type="cve" title="CVE-2025-59088" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59089" id="CVE-2025-59089" type="cve" title="CVE-2025-59089" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393955" id="2393955" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393958" id="2393958" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21142" id="RLSA-2025:21142" type="self" title="RLSA-2025:21142" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-kdcproxy" arch="noarch" epoch="0" version="1.0.0" release="19.el10_1" src="python-kdcproxy-1.0.0-19.el10_1.src.rpm">
          <filename>python3-kdcproxy-1.0.0-19.el10_1.noarch.rpm</filename>
          <sum type="sha256">92ae0a11b605fc8a2757c1ea35a49218ca517b019c9804e8a23375aa7aec3b5f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21220</id>
    <title>Important: podman security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* runc: container escape and denial of service due to arbitrary write gadgets and procfs write redirects (CVE-2025-52881)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52881" id="CVE-2025-52881" type="cve" title="CVE-2025-52881" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404715" id="2404715" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21220" id="RLSA-2025:21220" type="self" title="RLSA-2025:21220" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman" arch="aarch64" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-5.6.0-6.el10_1.aarch64.rpm</filename>
          <sum type="sha256">96e064880f0b1668975c0acc48fac3e2dc6575d003732f6ca42571218b08cef6</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-6.el10_1.noarch.rpm</filename>
          <sum type="sha256">6db94e38c5be0caccf548d216622fd7c72e5d8298bdcadd0ce06fcb54934dcdf</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.6.0" release="6.el10_1" src="podman-5.6.0-6.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-6.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f7b63269cf30ba5784b142de1b8076f35a579d8a7afd63e2fed66fe13c0a6f9a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21281</id>
    <title>Important: firefox security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

* firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

* firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

* firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

* firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

* firefox: Race condition in the Graphics component (CVE-2025-13012)

* firefox: Spoofing issue in Firefox (CVE-2025-13015)

* firefox: Mitigation bypass in the DOM: Core &amp; HTML component (CVE-2025-13013)

* firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012" id="CVE-2025-13012" type="cve" title="CVE-2025-13012" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013" id="CVE-2025-13013" type="cve" title="CVE-2025-13013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014" id="CVE-2025-13014" type="cve" title="CVE-2025-13014" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015" id="CVE-2025-13015" type="cve" title="CVE-2025-13015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016" id="CVE-2025-13016" type="cve" title="CVE-2025-13016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017" id="CVE-2025-13017" type="cve" title="CVE-2025-13017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018" id="CVE-2025-13018" type="cve" title="CVE-2025-13018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019" id="CVE-2025-13019" type="cve" title="CVE-2025-13019" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020" id="CVE-2025-13020" type="cve" title="CVE-2025-13020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414079" id="2414079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414080" id="2414080" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414083" id="2414083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414084" id="2414084" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414085" id="2414085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414086" id="2414086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414090" id="2414090" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414091" id="2414091" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414092" id="2414092" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21281" id="RLSA-2025:21281" type="self" title="RLSA-2025:21281" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.5.0" release="2.el10_1" src="firefox-140.5.0-2.el10_1.src.rpm">
          <filename>firefox-140.5.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d71f0851e7dedf3e96757534aef318d45ca8f9a48dc69cd5da9467926af5c751</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:21843</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-11-21 18:19:15" />
    <updated date="2025-12-05 09:08:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Mitigation bypass in the DOM: Security component (CVE-2025-13018)

* firefox: Use-after-free in the Audio/Video component (CVE-2025-13014)

* firefox: Incorrect boundary conditions in the JavaScript: WebAssembly component (CVE-2025-13016)

* firefox: Same-origin policy bypass in the DOM: Workers component (CVE-2025-13019)

* firefox: Use-after-free in the WebRTC: Audio/Video component (CVE-2025-13020)

* firefox: Race condition in the Graphics component (CVE-2025-13012)

* firefox: Spoofing issue in Firefox (CVE-2025-13015)

* firefox: Mitigation bypass in the DOM: Core &amp; HTML component (CVE-2025-13013)

* firefox: Same-origin policy bypass in the DOM: Notifications component (CVE-2025-13017)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13012" id="CVE-2025-13012" type="cve" title="CVE-2025-13012" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13013" id="CVE-2025-13013" type="cve" title="CVE-2025-13013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13014" id="CVE-2025-13014" type="cve" title="CVE-2025-13014" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13015" id="CVE-2025-13015" type="cve" title="CVE-2025-13015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13016" id="CVE-2025-13016" type="cve" title="CVE-2025-13016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13017" id="CVE-2025-13017" type="cve" title="CVE-2025-13017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13018" id="CVE-2025-13018" type="cve" title="CVE-2025-13018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13019" id="CVE-2025-13019" type="cve" title="CVE-2025-13019" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13020" id="CVE-2025-13020" type="cve" title="CVE-2025-13020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414079" id="2414079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414080" id="2414080" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414083" id="2414083" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414084" id="2414084" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414085" id="2414085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414086" id="2414086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414090" id="2414090" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414091" id="2414091" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414092" id="2414092" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:21843" id="RLSA-2025:21843" type="self" title="RLSA-2025:21843" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.5.0" release="2.el10_1" src="thunderbird-140.5.0-2.el10_1.src.rpm">
          <filename>thunderbird-140.5.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d57b23712cae585fd2a622871bf7a276f8c193cf17ce16a326a30f23c659de59</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23141</id>
    <title>Moderate: ruby security update</title>
    <issued date="2026-01-03 09:07:36" />
    <updated date="2026-01-17 09:08:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* resolv: Denial of Service in resolv gem (CVE-2025-24294)

* rexml: REXML denial of service (CVE-2025-58767)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24294" id="CVE-2025-24294" type="cve" title="CVE-2025-24294" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58767" id="CVE-2025-58767" type="cve" title="CVE-2025-58767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61594" id="CVE-2025-61594" type="cve" title="CVE-2025-61594" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379684" id="2379684" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2396186" id="2396186" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426336" id="2426336" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23141" id="RLSA-2025:23141" type="self" title="RLSA-2025:23141" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ruby" arch="aarch64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-3.3.10-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">944623500087134d82fbfa5e13a1b785e33c8c54767ede6e98a07412773a2d07</sum>
        </package>
        <package name="ruby-bundled-gems" arch="aarch64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-bundled-gems-3.3.10-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">85c9ec99e95c83130b1f2eaf693d7e0d59c74960f641cc69d68a2cc4b21227de</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-default-gems-3.3.10-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">40f44efb34d21198b1c29a0929c4c51675d04e983cd81465f8cf1532b07441b1</sum>
        </package>
        <package name="ruby-devel" arch="aarch64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-devel-3.3.10-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">30dd9ebcbf6af48b61778189182888c47790f3b71e6ad8af90cfb35d70165b1e</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="aarch64" epoch="0" version="3.1.5" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b4c58e85086061d864ca732e5f583db03928cab405fbf07f9dbc5c2a7ba8e90e</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-bundler-2.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">058f37cc1517c22c9bbb5bd1fca687bfa62588b74e84fe713ee7461bdd23e8bb</sum>
        </package>
        <package name="rubygem-io-console" arch="aarch64" epoch="0" version="0.7.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-io-console-0.7.1-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a499bbe93b18d7d89065ce202a9603b799c45ebc9643e6b80105067a3845202a</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-irb-1.13.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">e4edd538b5968a839b91e449d8349daec2f196776c60d9077d93d5967f77596a</sum>
        </package>
        <package name="rubygem-json" arch="aarch64" epoch="0" version="2.7.2" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-json-2.7.2-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9a7dcb05ac7b8f22ed2766aec3e7b26d0536462e2ce06057f9983c3851470d96</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-minitest-5.20.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">0434b5728cd4944228035d9b77680d2858734453f31d74c391c56f8c2d67d98a</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-power_assert-2.0.3-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">d0bde6352c0ae723efdc4a97696de00def0d82f6a8e8ef7e2400afccce648d59</sum>
        </package>
        <package name="rubygem-psych" arch="aarch64" epoch="0" version="5.1.2" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-psych-5.1.2-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1bf9102ffd8e2001c66767d5b2acb2f737fc8c040e519ca9563a968a39f6a900</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rake-13.1.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">42114b64369326aa4a84ad5f32f116690e712ea7ed501003737ce2bde8ab583f</sum>
        </package>
        <package name="rubygem-rbs" arch="aarch64" epoch="0" version="3.4.0" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rbs-3.4.0-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7d9ba463a2c4b1e647fa2ba8855ebe703d9f441cf6350e7d0337b3c81c676542</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">e71510b81e9beb13670a44249383320eb7c5fa1d774a38adf64bbc7df697536f</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.4.4" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rexml-3.4.4-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">f5ce0a935c6cd55f8b83cae6456ffb26c1a8b64e2ad50ee51e84267fc4207995</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-rss-0.3.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">07912be4be20e8c39e41041841ad3d5e259a8f3cafedc1e6b69b92a9f58c5a20</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygems-3.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">4619bd0477a6a2b7bdfed9977c03765198f1c4f300874e94133bb6a3ff80934c</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygems-devel-3.5.22-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">8d675850b3900bef9a8445e114d3bdcec9a1043b871e659daa0a1b64b9b5f72e</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-test-unit-3.6.1-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">4567bdec139bad08bd4c25cc304bcd6729fa5765f351f045dd9c6cf89e9e609c</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>rubygem-typeprof-0.21.9-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">d513b152dafea61d7a1f55ad03e2e1ebd0a489a4593a77434377e57c089e87ee</sum>
        </package>
        <package name="ruby-libs" arch="aarch64" epoch="0" version="3.3.10" release="11.el10_1" src="ruby-3.3.10-11.el10_1.src.rpm">
          <filename>ruby-libs-3.3.10-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">34c666ba26be12535a485d9effb67fefc41176c85429250bd005fe1564486ce4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23294</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23294" id="RLSA-2025:23294" type="self" title="RLSA-2025:23294" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="skopeo" arch="aarch64" epoch="2" version="1.20.0" release="2.el10_1" src="skopeo-1.20.0-2.el10_1.src.rpm">
          <filename>skopeo-1.20.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7e0b87eb16f159a3aee23d90d9bcf47135ad48a1f3588970c1efd3b275793246</sum>
        </package>
        <package name="skopeo-tests" arch="aarch64" epoch="2" version="1.20.0" release="2.el10_1" src="skopeo-1.20.0-2.el10_1.src.rpm">
          <filename>skopeo-tests-1.20.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">13a36d67e893f61499d223239c27741b4a135d357688a6865615b0ac95751ed5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23295</id>
    <title>Moderate: podman security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23295" id="RLSA-2025:23295" type="self" title="RLSA-2025:23295" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman" arch="aarch64" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-5.6.0-8.el10_1.aarch64.rpm</filename>
          <sum type="sha256">05cd6e9ec69fd74392992e0cb6b37c88f02137dd5c17bcb3e1e2bdd485688342</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-8.el10_1.noarch.rpm</filename>
          <sum type="sha256">b8dfeb260bbe9bea9e3be8bc0e4fc7c6f61cd18d5ce124845e41bedfb126c84f</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.6.0" release="8.el10_1" src="podman-5.6.0-8.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-8.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fc56a7028fbc49bec91238d60e0f6c04ea02850c54f40576d23663193be45e91</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23664</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/expr-lang/expr: Expr: Denial of Service via uncontrolled recursion in expression evaluation (CVE-2025-68156)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68156" id="CVE-2025-68156" type="cve" title="CVE-2025-68156" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2422891" id="2422891" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23664" id="RLSA-2025:23664" type="self" title="RLSA-2025:23664" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="aarch64" epoch="0" version="0.135.0" release="2.el10_1" src="opentelemetry-collector-0.135.0-2.el10_1.src.rpm">
          <filename>opentelemetry-collector-0.135.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7ac7119e3a483c730667fd42c111f0d5e423330257cbbbc7b2f3039c316d9d05</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23667</id>
    <title>Important: git-lfs security update</title>
    <issued date="2025-12-20 09:08:07" />
    <updated date="2026-01-03 09:08:37" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* git-lfs: Git LFS may write to arbitrary files via crafted symlinks (CVE-2025-26625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26625" id="CVE-2025-26625" type="cve" title="CVE-2025-26625" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404720" id="2404720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23667" id="RLSA-2025:23667" type="self" title="RLSA-2025:23667" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git-lfs" arch="aarch64" epoch="0" version="3.6.1" release="4.el10_1" src="git-lfs-3.6.1-4.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-4.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9f9deecc4005d6bb7d02beee6cb2f00c4264dd872ec2c420ce5e79e57aac5fea</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23738</id>
    <title>Important: mod_md security update</title>
    <issued date="2025-12-24 09:09:08" />
    <updated date="2026-01-07 09:06:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_md.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

* mod_md: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55753" id="CVE-2025-55753" type="cve" title="CVE-2025-55753" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419140" id="2419140" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23738" id="RLSA-2025:23738" type="self" title="RLSA-2025:23738" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_md" arch="aarch64" epoch="1" version="2.4.26" release="4.el10_1" src="mod_md-2.4.26-4.el10_1.src.rpm">
          <filename>mod_md-2.4.26-4.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6e7ac44867435db96888d3fb19369d1115fe17dc2548e1321ace601377a9faf1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:23932</id>
    <title>Important: httpd security update</title>
    <issued date="2025-12-24 09:09:08" />
    <updated date="2026-01-07 09:06:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)

* httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)

* httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58098" id="CVE-2025-58098" type="cve" title="CVE-2025-58098" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-65082" id="CVE-2025-65082" type="cve" title="CVE-2025-65082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66200" id="CVE-2025-66200" type="cve" title="CVE-2025-66200" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419139" id="2419139" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419262" id="2419262" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419365" id="2419365" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:23932" id="RLSA-2025:23932" type="self" title="RLSA-2025:23932" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="httpd" arch="aarch64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">05f9ee417d595f5bb6f92a6fecc4013edc2a5f697d3e530a87380d998c6c28cc</sum>
        </package>
        <package name="httpd-core" arch="aarch64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-core-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">e5c2c17ba36be7d7bc8b7f298b88026bd89c52bdd655f86671e6f52730b03163</sum>
        </package>
        <package name="httpd-devel" arch="aarch64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-devel-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">af6066c94d5134369d7ff3e10203aa90c37444e58da612f43c220b441af36123</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-filesystem-2.4.63-4.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">ecf3854d6a4894a4600c34687ac57b55daae3e1a185750514a825ac7b1500d75</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-manual-2.4.63-4.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">6949a406e6a3155db79dc44fc713116f5b40b1d345b6749ab09b2d783faa80af</sum>
        </package>
        <package name="httpd-tools" arch="aarch64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>httpd-tools-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">5b6115ac068757f1342f4f4b94370f721308e64621b9d6cfb90c9d74f701f1f7</sum>
        </package>
        <package name="mod_ldap" arch="aarch64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_ldap-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">6767da279e79b84fd25a85877383832a79f7b85e9e0038ecfd3e89372fc9a847</sum>
        </package>
        <package name="mod_lua" arch="aarch64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_lua-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">99d8bd89bb02b0cbad0d8d474d64cb193d53cce0d5b75560f5cfe20feb6f6dd0</sum>
        </package>
        <package name="mod_proxy_html" arch="aarch64" epoch="1" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_proxy_html-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">29c23c7fc6ba160078ca413ef32181d4d5cdc885b572f8cb6a71c8004e6b1ed1</sum>
        </package>
        <package name="mod_session" arch="aarch64" epoch="0" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_session-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">101903e397cd5ba54eb44ab62b1dc43bb2a144b6be7f2252b163e67dbd5748ab</sum>
        </package>
        <package name="mod_ssl" arch="aarch64" epoch="1" version="2.4.63" release="4.el10_1.3" src="httpd-2.4.63-4.el10_1.3.src.rpm">
          <filename>mod_ssl-2.4.63-4.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">60a06e4950d6e8017668c57caf4cd8d406b4a7404d8a66c8ebfec5c3ac5e7aa1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0025</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-01-05 09:08:05" />
    <updated date="2026-01-19 09:09:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Memory safety bugs fixed in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146 (CVE-2025-14333)

* firefox: Use-after-free in the WebRTC: Signaling component (CVE-2025-14321)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14325)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2025-14322)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14328)

* firefox: Privilege escalation in the Netmonitor component (CVE-2025-14329)

* firefox: Same-origin policy bypass in the Request Handling component (CVE-2025-14331)

* firefox: Privilege escalation in the DOM: Notifications component (CVE-2025-14323)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14330)

* firefox: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2025-14324)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14321" id="CVE-2025-14321" type="cve" title="CVE-2025-14321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14322" id="CVE-2025-14322" type="cve" title="CVE-2025-14322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14323" id="CVE-2025-14323" type="cve" title="CVE-2025-14323" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14324" id="CVE-2025-14324" type="cve" title="CVE-2025-14324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14325" id="CVE-2025-14325" type="cve" title="CVE-2025-14325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14328" id="CVE-2025-14328" type="cve" title="CVE-2025-14328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14329" id="CVE-2025-14329" type="cve" title="CVE-2025-14329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14330" id="CVE-2025-14330" type="cve" title="CVE-2025-14330" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14331" id="CVE-2025-14331" type="cve" title="CVE-2025-14331" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14333" id="CVE-2025-14333" type="cve" title="CVE-2025-14333" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420502" id="2420502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420503" id="2420503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420504" id="2420504" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420506" id="2420506" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420508" id="2420508" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420509" id="2420509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420512" id="2420512" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420513" id="2420513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420516" id="2420516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420517" id="2420517" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0025" id="RLSA-2026:0025" type="self" title="RLSA-2026:0025" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.6.0" release="1.el10_1" src="thunderbird-140.6.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.6.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a4b568a6ebf3d620c8f50bc2a66ab0af9b15e6a27389551a72de69d0c7fd4b7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0525</id>
    <title>Moderate: postgresql16 security update</title>
    <issued date="2026-01-14 09:14:26" />
    <updated date="2026-01-28 09:10:53" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: libpq undersizes allocations, via integer wraparound (CVE-2025-12818)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12818" id="CVE-2025-12818" type="cve" title="CVE-2025-12818" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414826" id="2414826" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0525" id="RLSA-2026:0525" type="self" title="RLSA-2026:0525" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql-docs" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6ad76302d2e7eeeb12201b3a35d3b70fc257ec19862023f4e01a6310101bfa20</sum>
        </package>
        <package name="postgresql-contrib" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">29e9f359d0d9f773e5dfd7543b195be35da0ca8f14a2fb8c38f41ede28e3905d</sum>
        </package>
        <package name="postgresql" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">718816baff61e4706caf98ef549665f82f208bf5ae51bff76edae0f86b82c605</sum>
        </package>
        <package name="postgresql-pltcl" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a1475bfa2ab364b60c7a623acb7a61605d5c786ddc56e7919fb473412cbe4179</sum>
        </package>
        <package name="postgresql-server-devel" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">84b180c330ebe6e6f0b3c5d8ebd160928dce161192dc616d62a3aa00fd3fa0e9</sum>
        </package>
        <package name="postgresql-test" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-test-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ff240a2ce1814be403a3f2befa9f28cb6d475197709eedc6b8f1b1c66297fc56</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0bdfc6adeb8abb606e994dcb083de5eb2b73b2ff6f7c63deadddab589890125d</sum>
        </package>
        <package name="postgresql-server" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-server-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">e040d1994b686c8b2f9e1b3f8203b503ee3129c481eac127baaec3235ef5217d</sum>
        </package>
        <package name="postgresql-private-libs" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">bdb7dd6765a3ccda70bc636aa807be62402a5ce184d6680483ef3922c045e77f</sum>
        </package>
        <package name="postgresql-plpython3" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">bcc0ebae0d7a4cc8d4d4b8d156277b92578368759f84284d3a3b4ee1d7e5b1aa</sum>
        </package>
        <package name="postgresql-upgrade" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ffa94e88420a6cd5f1b2c367f7d3d0238e0960de03fc68c9b7d1ec4b275a4983</sum>
        </package>
        <package name="postgresql-private-devel" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">dc8b895ae3c8760701a9c4a7a61ea5b06cd7ab7449c722822412eb1e6b9d56e7</sum>
        </package>
        <package name="postgresql-plperl" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ae01ac985e7746170f2bc7aac559fcb774ca5231558d21e91a72e684ef6a9a36</sum>
        </package>
        <package name="postgresql-static" arch="aarch64" epoch="0" version="16.11" release="1.el10_1" src="postgresql16-16.11-1.el10_1.src.rpm">
          <filename>postgresql-static-16.11-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7e89f303442b495c9d4c586ccb299c4a6ae8b6c245b5522ee508340d20756448</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0108</id>
    <title>Moderate: gcc-toolset-15-binutils security update</title>
    <issued date="2026-01-09 09:08:06" />
    <updated date="2026-01-23 09:10:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gcc-toolset-15-binutils.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Binutils is a collection of binary utilities, including ar (for creating, modifying and extracting from archives), as (a family of GNU assemblers), gprof (for displaying call graph profile data), ld (the GNU linker), nm (for listing symbols from object files), objcopy (for copying and translating object files), objdump (for displaying information from object files), ranlib (for generating an index for the contents of an archive), readelf (for displaying detailed information about binary files), size (for listing the section sizes of an object or archive file), strings (for listing printable strings from files), strip (for discarding symbols), and addr2line (for converting addresses to file and line).

Security Fix(es):

* binutils: GNU Binutils Linker heap-based overflow (CVE-2025-11083)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11083" id="CVE-2025-11083" type="cve" title="CVE-2025-11083" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2399948" id="2399948" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0108" id="RLSA-2026:0108" type="self" title="RLSA-2026:0108" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gcc-toolset-15-binutils-gprofng" arch="aarch64" epoch="0" version="2.44" release="7.el10_1.1" src="gcc-toolset-15-binutils-2.44-7.el10_1.1.src.rpm">
          <filename>gcc-toolset-15-binutils-gprofng-2.44-7.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">4c28d8d1d45a2110dc07ae0a2fd288111ac9236a19ddffbf7ea05df10756771b</sum>
        </package>
        <package name="gcc-toolset-15-binutils-gold" arch="aarch64" epoch="0" version="2.44" release="7.el10_1.1" src="gcc-toolset-15-binutils-2.44-7.el10_1.1.src.rpm">
          <filename>gcc-toolset-15-binutils-gold-2.44-7.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">1637f6347d55e733ba329f633903b5caee24d072b14a0014e5fbe3feb21d489c</sum>
        </package>
        <package name="gcc-toolset-15-binutils-devel" arch="aarch64" epoch="0" version="2.44" release="7.el10_1.1" src="gcc-toolset-15-binutils-2.44-7.el10_1.1.src.rpm">
          <filename>gcc-toolset-15-binutils-devel-2.44-7.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">1e002624aa98ac73e7ed00e21705da73369ae4949cc0cfb03d20d618354c79c5</sum>
        </package>
        <package name="gcc-toolset-15-binutils" arch="aarch64" epoch="0" version="2.44" release="7.el10_1.1" src="gcc-toolset-15-binutils-2.44-7.el10_1.1.src.rpm">
          <filename>gcc-toolset-15-binutils-2.44-7.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">4c37a1125e632d47c8e04594021980ff94ebef3d60b32c339062e410489f482d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0128</id>
    <title>Moderate: poppler security update</title>
    <issued date="2026-01-09 09:08:06" />
    <updated date="2026-01-23 09:10:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for poppler.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

* poppler: Out-of-Bounds Read in Poppler (CVE-2025-32365)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32365" id="CVE-2025-32365" type="cve" title="CVE-2025-32365" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357656" id="2357656" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0128" id="RLSA-2026:0128" type="self" title="RLSA-2026:0128" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="poppler-qt6" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_1" src="poppler-24.02.0-7.el10_1.src.rpm">
          <filename>poppler-qt6-24.02.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f591c48441a1d0f2cd28a1ed6f15e22998b1586d70a912a97aa691e345017149</sum>
        </package>
        <package name="poppler-glib" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_1" src="poppler-24.02.0-7.el10_1.src.rpm">
          <filename>poppler-glib-24.02.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">e5c61ad172e6af32b9cb98b2ee1dfc33771d3b2f3824d171fdaa4941665e0d0a</sum>
        </package>
        <package name="poppler" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_1" src="poppler-24.02.0-7.el10_1.src.rpm">
          <filename>poppler-24.02.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9e294ab4e09336f1a19103d41ff958f8c6bd21ef1d042f546078818b4787b4c5</sum>
        </package>
        <package name="poppler-utils" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_1" src="poppler-24.02.0-7.el10_1.src.rpm">
          <filename>poppler-utils-24.02.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2d08080a790ae0f0d70f6fa0cdfc9b0a57a47b414cf92fa0df7cd670affc8c73</sum>
        </package>
        <package name="poppler-cpp" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_1" src="poppler-24.02.0-7.el10_1.src.rpm">
          <filename>poppler-cpp-24.02.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">23a3fc4d4275bddfea1f9ad481e11fc25c613c368e36daf4c31abc6c82538b47</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0136</id>
    <title>Important: mariadb10.11 security update</title>
    <issued date="2026-01-09 09:08:06" />
    <updated date="2026-01-23 09:10:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mariadb10.11.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mysql: High Privilege Denial of Service Vulnerability in MySQL Server (CVE-2025-21490)

* mariadb: MariaDB Server Crash Due to Empty Backtrace Log (CVE-2023-52969)

* mariadb: MariaDB Server Crash (CVE-2023-52971)

* mariadb: MariaDB Server Crash via Item_direct_view_ref (CVE-2023-52970)

* mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

* mariadb: MariaDB: mariadb-dump utility vulnerable to remote code execution via improper path validation (CVE-2025-13699)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52969" id="CVE-2023-52969" type="cve" title="CVE-2023-52969" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52970" id="CVE-2023-52970" type="cve" title="CVE-2023-52970" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52971" id="CVE-2023-52971" type="cve" title="CVE-2023-52971" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13699" id="CVE-2025-13699" type="cve" title="CVE-2025-13699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21490" id="CVE-2025-21490" type="cve" title="CVE-2025-21490" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693" id="CVE-2025-30693" type="cve" title="CVE-2025-30693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722" id="CVE-2025-30722" type="cve" title="CVE-2025-30722" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2339221" id="2339221" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2350918" id="2350918" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359963" id="2359963" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2350917" id="2350917" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2417693" id="2417693" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359885" id="2359885" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2350916" id="2350916" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0136" id="RLSA-2026:0136" type="self" title="RLSA-2026:0136" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mariadb-gssapi-server" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-gssapi-server-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">25ebaf09ec9daf6183955b272539effcfe97d9de401e3187107d1cc3497b7c25</sum>
        </package>
        <package name="mariadb-errmsg" arch="noarch" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-errmsg-10.11.15-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">69320eecbd59d79eb9724ace818d407ce4f80529844369f213009d7b602a8ddc</sum>
        </package>
        <package name="mariadb-devel" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-devel-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8dca652d1afe061496ebb739e68ff623df979f6e4ac60813b1f1780ca39d874e</sum>
        </package>
        <package name="mariadb-server-utils" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-server-utils-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9b012c54aa7b16859f21a226b9833d47c1f42bc12f258c9d64716a61b2e708e2</sum>
        </package>
        <package name="mariadb-embedded-devel" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-embedded-devel-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">91f5095c5b0031d120df7a36c64edc2fe935eb4e462f4f0bf5934bca0d29dec3</sum>
        </package>
        <package name="mariadb-embedded" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-embedded-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d8e0c51c5972ecc5a0a08067cf15c68c8304750c2d40d59fbb1fa37b095cc2e1</sum>
        </package>
        <package name="mariadb-server" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-server-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4ecb9b51430cf22f7f4d6916f55bf5a463bebf493139e003e39946eaa6491c25</sum>
        </package>
        <package name="mariadb-pam" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-pam-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9a198d50562a0ef5f60f04d3e11769f70d7177d0aeb4e646692f76dd707be0aa</sum>
        </package>
        <package name="mariadb-test" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-test-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4fe162f26e1cb8465d1da2eb35e92fbb09a064df0420a03a6afb02deac0ae897</sum>
        </package>
        <package name="mariadb-client-utils" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-client-utils-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">00b11bd964e9ce59f1dd43523e3ba2e4188a57f9122e0d405ee53c077b8dd0c6</sum>
        </package>
        <package name="mariadb-oqgraph-engine" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-oqgraph-engine-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1f5d16389123051400df3100ab8bd34496de91af7bccff018ed30e2f053346f8</sum>
        </package>
        <package name="mariadb-backup" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-backup-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8eb7a4c319c5375fc6625c647a7ed01ffe83914f013fb6bbd4e5dc93afb1751a</sum>
        </package>
        <package name="mariadb-server-galera" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-server-galera-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8f87c01d0879edbbffa05d3801279a14398998a560bd9af771c7871a0f045635</sum>
        </package>
        <package name="mariadb-common" arch="noarch" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-common-10.11.15-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">f2617fbee4e48f6d49569f3a183c3615a339e8060bdc9a66787b37af5d9177bb</sum>
        </package>
        <package name="mariadb" arch="aarch64" epoch="3" version="10.11.15" release="1.el10_1" src="mariadb10.11-10.11.15-1.el10_1.src.rpm">
          <filename>mariadb-10.11.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d415f057c5d8a3623cdaaf27ff359742c860d1f11ea8ee3aa60639e844811423</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0423</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-01-15 09:16:30" />
    <updated date="2026-01-29 09:12:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: libsoup: Duplicate Host Header Handling Causes Host-Parsing Discrepancy (First- vs Last-Value Wins) (CVE-2025-14523)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14523" id="CVE-2025-14523" type="cve" title="CVE-2025-14523" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2421349" id="2421349" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0423" id="RLSA-2026:0423" type="self" title="RLSA-2026:0423" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.8" src="libsoup3-3.6.5-3.el10_1.8.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.8.aarch64.rpm</filename>
          <sum type="sha256">3f4f87b5be60b806b28e93246d370751671a62ed78e6357ee39b74f7611dfd10</sum>
        </package>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.8" src="libsoup3-3.6.5-3.el10_1.8.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.8.aarch64.rpm</filename>
          <sum type="sha256">6cb52e9559e9f9d02c3b683204aa9347b898b341757ce047fa0404e8c1273188</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0436</id>
    <title>Important: buildah security update</title>
    <issued date="2026-01-15 09:16:30" />
    <updated date="2026-01-29 09:12:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47913" id="CVE-2025-47913" type="cve" title="CVE-2025-47913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414943" id="2414943" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0436" id="RLSA-2026:0436" type="self" title="RLSA-2026:0436" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.41.8" release="1.el10_1" src="buildah-1.41.8-1.el10_1.src.rpm">
          <filename>buildah-tests-1.41.8-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9833ea46b5810cdffada23dc8ec60a4da9d965a6559e5586c8d8e19abc5f6042</sum>
        </package>
        <package name="buildah" arch="aarch64" epoch="2" version="1.41.8" release="1.el10_1" src="buildah-1.41.8-1.el10_1.src.rpm">
          <filename>buildah-1.41.8-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5500e7ef9bfeb59be0a7740ab85c0052a3261b5fbaee1b4b591225fa3385ebc7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0770</id>
    <title>Important: gpsd security update</title>
    <issued date="2026-01-21 09:06:31" />
    <updated date="2026-02-03 17:25:19" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gpsd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>gpsd is a service daemon that mediates access to a GPS sensor connected to the host computer by serial or USB interface, making its data on the location/course/velocity of the sensor available to be queried on TCP port 2947 of the host computer.  With gpsd, multiple GPS client applications (such as navigational and war-driving software) can share access to a GPS without contention or loss of data.  Also, gpsd responds to queries with a format that is substantially easier to parse than NMEA 0183.

Security Fix(es):

* gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing (CVE-2025-67269)

* gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling (CVE-2025-67268)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67268" id="CVE-2025-67268" type="cve" title="CVE-2025-67268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67269" id="CVE-2025-67269" type="cve" title="CVE-2025-67269" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426835" id="2426835" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2426810" id="2426810" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0770" id="RLSA-2026:0770" type="self" title="RLSA-2026:0770" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gpsd" arch="aarch64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>gpsd-3.26.1-1.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">aa7b942c12b1289ac78dbafc7c3743386dcfa9bd90d78b1d4b96f31471809f50</sum>
        </package>
        <package name="python3-gpsd" arch="aarch64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>python3-gpsd-3.26.1-1.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">ed924ee7d3c30bafe53ea4aed5cb73de7640c13b46fd423c72dbf57078b5eb44</sum>
        </package>
        <package name="gpsd-clients" arch="aarch64" epoch="1" version="3.26.1" release="1.el10_1.1" src="gpsd-3.26.1-1.el10_1.1.src.rpm">
          <filename>gpsd-clients-3.26.1-1.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">d69b1f1e711d67f49623834e2a8b7728adf864ea07ed90255a98db1d10c6f9df</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0545</id>
    <title>Important: podman security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS (CVE-2025-47913)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47913" id="CVE-2025-47913" type="cve" title="CVE-2025-47913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2414943" id="2414943" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0545" id="RLSA-2026:0545" type="self" title="RLSA-2026:0545" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-11.el10_1.noarch.rpm</filename>
          <sum type="sha256">16c5e9f16eb94c5e9b7fe3a1eda9b8ea23b083e81067e88b0f31f4d7582476a1</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">409b19c1ac0d574819f66ee96f6a814956682f22b303f4d91c39c52ee5094447</sum>
        </package>
        <package name="podman" arch="aarch64" epoch="7" version="5.6.0" release="11.el10_1" src="podman-5.6.0-11.el10_1.src.rpm">
          <filename>podman-5.6.0-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ac23a66ccb0bd144c95919b107c10db2f683216ab5b153cb74684b79fd15412f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0606</id>
    <title>Moderate: vsftpd security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for vsftpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The vsftpd packages include a Very Secure File Transfer Protocol (FTP) daemon, which is used to serve files over a network.

Security Fix(es):

* vsftpd: vsftpd: Denial of service via integer overflow in ls command parameter parsing (CVE-2025-14242)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14242" id="CVE-2025-14242" type="cve" title="CVE-2025-14242" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2419826" id="2419826" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0606" id="RLSA-2026:0606" type="self" title="RLSA-2026:0606" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="vsftpd" arch="aarch64" epoch="0" version="3.0.5" release="10.el10_1.1" src="vsftpd-3.0.5-10.el10_1.1.src.rpm">
          <filename>vsftpd-3.0.5-10.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">7cd71433abfd12d17b4b4e3ced2b06915ede05deb7a4aca2c60edf95b8e2e3a9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0668</id>
    <title>Important: net-snmp security update</title>
    <issued date="2026-01-17 09:07:37" />
    <updated date="2026-01-30 22:12:38" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for net-snmp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The net-snmp packages provide various libraries and tools for the Simple Network Management Protocol (SNMP), including an SNMP library, an extensible agent, tools for requesting or setting information from SNMP agents, tools for generating and handling SNMP traps, a version of the netstat command which uses SNMP, and a Tk/Perl Management Information Base (MIB) browser.

Security Fix(es):

* net-snmp: buffer overflow via a specially crafted packet can cause a crash in snmptrapd (CVE-2025-68615)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68615" id="CVE-2025-68615" type="cve" title="CVE-2025-68615" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2424618" id="2424618" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0668" id="RLSA-2026:0668" type="self" title="RLSA-2026:0668" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="net-snmp-libs" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-libs-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">65128a3a092d39d8e78d70535a81b1f9ad5cfae39b0fe957c5074433fea59cba</sum>
        </package>
        <package name="python3-net-snmp" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>python3-net-snmp-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">ab8b309838eae7b5d77718e50e41a0988a24cf484cbd73600d5509b28064a05d</sum>
        </package>
        <package name="net-snmp-utils" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-utils-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">58f48422e667223e64550c0174799618a8e86bf8f7b6ec3571d65a8d4236fcf3</sum>
        </package>
        <package name="net-snmp" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">f1d890233f363738ffe1a8c57b11a5ad66f04643f25355a28f1ed456c6ab1b5a</sum>
        </package>
        <package name="net-snmp-perl" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-perl-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">3afe21c4ce6d9d0a5bdb5d29d0403eb686a0495194fa7e47a438811e2ec35132</sum>
        </package>
        <package name="net-snmp-agent-libs" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-agent-libs-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">6c6b3896361153e8106021bff52047616c9f42a4a5c1b073754dbe55b2817293</sum>
        </package>
        <package name="net-snmp-perl-module" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-perl-module-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">110b41f03c7810d8a14b9ec69a4cd36ed87c3f8dcd72767a6505891c14df9987</sum>
        </package>
        <package name="net-snmp-devel" arch="aarch64" epoch="1" version="5.9.4" release="15.el10_1.2" src="net-snmp-5.9.4-15.el10_1.2.src.rpm">
          <filename>net-snmp-devel-5.9.4-15.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">cdde93f16fa29fa7f2adb94fe1c88e42bdd54d7b5f3ca7b582f38fc1aebe037a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:0922</id>
    <title>Important: golang security update</title>
    <issued date="2026-01-23 09:09:09" />
    <updated date="2026-02-06 09:10:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:0922" id="RLSA-2026:0922" type="self" title="RLSA-2026:0922" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">37193f1ea5fe167f83ebd687d22a6c0911a285d06a3865a229f59e019e02323f</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">509934389da150ab8af62eadc5261fc91afbeb1f02291b5dd3b94fb73fd64393</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.5-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4762c854bac065ef6b94039ddcb1a4e1a3066afb1cc9f479c1e78afaa22a00a8</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.5-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f19bc7bd5d38e5e8f56146cb99f3b4af4da352c2f57134b34f0fd539c1276895</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">0baede789c6eb9f29fb31fc4f2eeac953f7f11de4464a6e5f54155744799cac8</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-1.25.5-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a27db3ba5fe977c26229b9710de1a096165b810c3ad67d02d993731d02826627</sum>
        </package>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-race-1.25.5-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7231701f80f4084664c978f9d7b5d6e50d01f73c766ea37ff3c4ae50f5fad52d</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.5" release="1.el10_1" src="golang-1.25.5-1.el10_1.src.rpm">
          <filename>golang-src-1.25.5-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">3471f8593ee325afc1423143bb49a46d3676a5dbfa904a095a1bb8820e61a05a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1597</id>
    <title>Moderate: iperf3 security update</title>
    <issued date="2026-02-03 17:23:52" />
    <updated date="2026-02-17 09:10:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for iperf3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Iperf is a tool which can measure maximum TCP bandwidth and tune various parameters and UDP characteristics. Iperf reports bandwidth, delay jitter, and data-gram loss.

Security Fix(es):

* iperf3: iperf Heap Buffer Overflow (CVE-2025-54349)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54349" id="CVE-2025-54349" type="cve" title="CVE-2025-54349" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2386151" id="2386151" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1597" id="RLSA-2026:1597" type="self" title="RLSA-2026:1597" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="iperf3" arch="aarch64" epoch="0" version="3.17.1" release="5.el10_1" src="iperf3-3.17.1-5.el10_1.src.rpm">
          <filename>iperf3-3.17.1-5.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4f8540a12578f7a072cb2f5058bf14a2e7fba98773e9eeb594856553c7a1093f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1628</id>
    <title>Important: php security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: heap-based buffer overflow in array_merge() (CVE-2025-14178)

* php: PHP: Information disclosure via getimagesize() function when reading multi-chunk images (CVE-2025-14177)

* php: PHP: Denial of Service via invalid character sequence in PDO PostgreSQL prepared statement (CVE-2025-14180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14177" id="CVE-2025-14177" type="cve" title="CVE-2025-14177" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14178" id="CVE-2025-14178" type="cve" title="CVE-2025-14178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14180" id="CVE-2025-14180" type="cve" title="CVE-2025-14180" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425627" id="2425627" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425625" id="2425625" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2425626" id="2425626" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1628" id="RLSA-2026:1628" type="self" title="RLSA-2026:1628" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="php-dbg" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-dbg-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6c4a9c4501908cbe4ab3966087a53f2299b17a56bdd013c51b8343d06acb6d7f</sum>
        </package>
        <package name="php-pgsql" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-pgsql-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">698bed1e29c40fc9243377bd99f2f129913ed80953c0f6287584524aa122e7ef</sum>
        </package>
        <package name="php-pdo" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-pdo-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5e908033de1d18cffcd91323722ae7e8a947be6cec9e9e33117e8fd63d088508</sum>
        </package>
        <package name="php-odbc" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-odbc-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6c2ea7d2ea1759a8a1625eb1ae0dbf630d5e59e9e747f074487bbe6a096d5e48</sum>
        </package>
        <package name="php-xml" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-xml-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">52438f19e8263e7c402d05cbf64603d52fb29243b871937463a70a27bb3a63dd</sum>
        </package>
        <package name="php-embedded" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-embedded-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1d8ed2fa6f50691c098e546f47e3f67a2c99469f10aedff39b83c1b739727240</sum>
        </package>
        <package name="php-enchant" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-enchant-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">15022b6d216a22ae37f49dca37770dc936631cf24bc34f5aa08547095d1dbd87</sum>
        </package>
        <package name="php-mysqlnd" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-mysqlnd-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">08d7ac47d54463eb3658b9b09efd4f786ffc3d3fc29b6131d49134f07738d765</sum>
        </package>
        <package name="php-ffi" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-ffi-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f4101f85f0abebd0545ae7d0e5c1cc9b7810b8ee12c1206c1ef9ca0b35c60a5e</sum>
        </package>
        <package name="php-process" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-process-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">60d0611d65ab2895acbc71df5cfe350f5047c91ead83ca518dd8b8e05baaa6eb</sum>
        </package>
        <package name="php-fpm" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-fpm-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2d4a8624e7352bac31bb34221b8bbf7fbdb9bd446af957612a43c98815eb339e</sum>
        </package>
        <package name="php-common" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-common-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">e879d95c3aac7698cb001e9f8fd5b0fe9e39fc3d6da2a6a756ac2374d4413f4c</sum>
        </package>
        <package name="php-mbstring" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-mbstring-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a301b33db156d34c0c1af5453707a963dfbbd37c193e54ed4a5b020ba10bfadc</sum>
        </package>
        <package name="php-intl" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-intl-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a5263e62e993459e5b3835ad656c3f8a21c4504e8bda18fad5f9eb6fc2b7a379</sum>
        </package>
        <package name="php-dba" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-dba-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2ff81a0fa27139772e6747f4937379894e220fac501f094577a5e40eef03ddf2</sum>
        </package>
        <package name="php-cli" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-cli-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a7750c9929643813cbdf80ea556754d4a4de41855b6c5ea1b106ff87b4b9e806</sum>
        </package>
        <package name="php-soap" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-soap-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f9c127a1b75d2398df4504105a7070bd804c324873dee64361c2ee5fb8265d60</sum>
        </package>
        <package name="php-snmp" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-snmp-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b4cab09969a2bd62317760b3581117fe69053e1dee6f3cfdfef3ee48bb81a985</sum>
        </package>
        <package name="php-devel" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-devel-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ad5d195bcd2ef9f55f3b947ceec2469b7a43b2642dc34e6a4dce5f23bcd4702c</sum>
        </package>
        <package name="php-opcache" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-opcache-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7d992f5f76033cd8264295fc89a326fe50b857d9da5ad5865626c9c17f883319</sum>
        </package>
        <package name="php-bcmath" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-bcmath-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0199d2e07c7cc004a6a7f8d61a80f892f706e5df07308f6a60dc5e8de5c0cecb</sum>
        </package>
        <package name="php" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">87bcdf9ebbf82d38c5e917b373c0038ebbcd74519cc1670a290243a9fadc368a</sum>
        </package>
        <package name="php-gmp" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-gmp-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fab3d1b5c1bc42e2e6cea5991d483c96810286a146471a408b0afdce156d2265</sum>
        </package>
        <package name="php-ldap" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-ldap-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4f0679eb0b54f6a6048e265ed264c0ca43c7179fccd79e5a78ebe73a6078d39f</sum>
        </package>
        <package name="php-gd" arch="aarch64" epoch="0" version="8.3.29" release="1.el10_1" src="php-8.3.29-1.el10_1.src.rpm">
          <filename>php-gd-8.3.29-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">32f4b2510015f09baafdbf20f44bd3292df84ff3f04b0c84ef577b55e49876d2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1714</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* Wireshark: NULL Pointer Dereference in Wireshark (CVE-2025-9817)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9817" id="CVE-2025-9817" type="cve" title="CVE-2025-9817" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2392839" id="2392839" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1714" id="RLSA-2026:1714" type="self" title="RLSA-2026:1714" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="wireshark-cli" arch="aarch64" epoch="1" version="4.4.2" release="4.el10_1.2" src="wireshark-4.4.2-4.el10_1.2.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">301cf891f788ef5e23c6e62de4a9ee2ed21f8d63138370760d953e1c64ab3c35</sum>
        </package>
        <package name="wireshark" arch="aarch64" epoch="1" version="4.4.2" release="4.el10_1.2" src="wireshark-4.4.2-4.el10_1.2.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">79b67165f9e7b901538149bf15686cddc6f1ce3b868655fcdb0c6cf0746b0b40</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1715</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-02-05 09:13:02" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1715" id="RLSA-2026:1715" type="self" title="RLSA-2026:1715" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipp-usb" arch="aarch64" epoch="0" version="0.9.27" release="4.el10_1" src="golang-github-openprinting-ipp-usb-0.9.27-4.el10_1.src.rpm">
          <filename>ipp-usb-0.9.27-4.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d65cf238385678224b911e2435a2cee0e1e10cf971336e2265730861d7d34ab9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2182</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-02-07 09:09:45" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Signed to Unsigned Conversion Error Leading to Stack-Based Buffer Overflow in libsoup NTLM Authentication (CVE-2026-0719)

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0719" id="CVE-2026-0719" type="cve" title="CVE-2026-0719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1761" id="CVE-2026-1761" type="cve" title="CVE-2026-1761" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2427906" id="2427906" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435961" id="2435961" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2182" id="RLSA-2026:2182" type="self" title="RLSA-2026:2182" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.9" src="libsoup3-3.6.5-3.el10_1.9.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.9.aarch64.rpm</filename>
          <sum type="sha256">0a37b468e9002a7d6e29e27f4507c426537242d9d0727666b0eeb926a7595150</sum>
        </package>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.9" src="libsoup3-3.6.5-3.el10_1.9.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.9.aarch64.rpm</filename>
          <sum type="sha256">e1a6e92578dc57d26db6cc65a160bb4c42da848b28f9780c8aaece8c0afb49a9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1905</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23490" id="CVE-2026-23490" type="cve" title="CVE-2026-23490" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430472" id="2430472" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1905" id="RLSA-2026:1905" type="self" title="RLSA-2026:1905" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6d6b49af741df947e13524e43e0955aa2c0f52403d8bf836334e6c951c07664b</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">f7b20f7e215b4808d5083ef2fdb88b7fe6852b022696e398c5923317cb84e699</sum>
        </package>
        <package name="fence-agents-common" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-common-4.16.0-13.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">e76a601b5dcdb471addf34ba7149b2fa538e0faff4a8213127f9c36cfb948f03</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">744983f9b876d2e6204e4fa9f7ccf98b53900005a2c60501e820359f56301108</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">fa3c44b37e4e9b99ecde0486d8ffdb9b7686e34e6f96a5a7a1ca25e3e96f342e</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">da9c4f59307029c579f0231587b0f226112896e8d9524a0072cba6995bcd8f62</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">db27ed6e5c4c2bedc1c57e6d188c2fb8eb1b4190db5e3ccf2bc85cd699e31c56</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">a13f18f3a7352dbb80c55920b5804ac145c308861beb7f98d23cb04ce6fb55c1</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-virsh-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6946997cd0e441920755d88aae9fc5e3dff75ac1a8d70a71a78728c2d4ecf17f</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">ad6341e317306438f9eb28bf844390b525aa784bdcd3d86ca3201141bc319895</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c352c5b8f487314eb9267a04de69cff78ab1cf752e767ed24dcc9ee172d06f95</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-emerson-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">4d41c05e178981fa8db8579bf696f853f15a1ea37354bbe12366f1b70c49142f</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-apc-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6069ff740536ce03e921217bbcc695237f025395e8675551bede3ba6b2a2a9e0</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">3d8158d5f7fad1e6437ab26b4ebb670d22bc2bffacd74debda5eca8fbc5d99e8</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-sbd-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">f00dd62eab14ee407ca82c221c62884e7a7015f8faa54b8f1ea0f448f9502ca6</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">94f12803ea6b260f160dad9c1da96ca3eab05aaacfd02ed23457c52e051b1a48</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rsb-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">db6c37fa9ffa72f12c41d25c5a6182a9a712196e9438e62f70332f930d5526cf</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">ac8ec113d3e4561b7ad8cc68dc070a75892c982c2accd5e90838a19f7684667d</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">20573bb73c629bbaa9630fc494c081d0b5050bf42fc24f2c2bc048df656ff272</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">59aba5896367a98b1c2fc5d2ddb177d18a415f74504d32a1ba40be7e1d2a2e35</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">04d3d314ab0871cb6b3a2e5b675e043493c3d322e4a78e51075d51e3b0589a61</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-mpath-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">69f5e537c670b4b47389c422b242cd9a62d5f5f28a09bc47c3a58397601902ec</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">9d70edbb0cd1a6268436c33a1e99c54d9f56c3fa8c7f0140d04ba88547648405</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-brocade-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">088994c92aa2eed0381485f4fcbb0c4a6d6d5d38011614fc0cfc133ecc7ea5ce</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-scsi-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">a3c22cbaf14cd9c68558c19337b5e4d82d6ed053c3e3798aa9fdb60db8538b83</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c938db8c5d2443f7a19598454d72eb7d4cc00f4c460e2db8aa0cae6c323dc40e</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-drac5-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">2cbd0cba564e2dc0c8f1df64abb3633714c5cfce3cca1f62bab8212b0e02c1b7</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">7ec071eefb60bebdcb40ac3b4d3dde0211749971d7a01296dfe45deb5110e6f4</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">b6ca56e874c07d826cbc2c6db3ed94cae4164f3a892b7a428297eeea98219d09</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-13.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">11fffaf6234962f327509a38a4168066fc9c5627c187b92e24369055edec7f85</sum>
        </package>
        <package name="fence-agents-all" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-all-4.16.0-13.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">e3980a63eef6c0cd6885b889e7f2def942b55ff2acd250d537dada14f3dbd00e</sum>
        </package>
        <package name="fence-agents-redfish" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-redfish-4.16.0-13.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">a0062478784abb34816ab8fb4002756f029c3a157dfb4303b6b7b92fe486ae88</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">20384778df91636f46cee3afb7d0ffbcb5153d988d4fe84f48df27276066bc11</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-eps-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">c394a51084efead2948dd570410324d03a3f7ad7536d02a7ca00aedf7c7e2a6c</sum>
        </package>
        <package name="fence-agents-kdump" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-kdump-4.16.0-13.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">6bd0ec9931b058130a6cf780c239ef5f4a888a8f1541576d8ee6ab557afe2062</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-wti-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">6a0c5faaebea74abe72a2fe4b1aa6f14c69b0f31376863858d5d7c45abfca561</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">957b8b2ba4630b26ed33a390e830e4cfe18212722e40bb0734b6943471b29578</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">5790c225105735536180d29888748191f67188e202ca93084b61cb61e9fc0832</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-rsa-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">176fd22fc375634e906848efe06cb418e9b0209dd59442ffa99d05d1c3372885</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.2" src="fence-agents-4.16.0-13.el10_1.2.src.rpm">
          <filename>fence-agents-lpar-4.16.0-13.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">0a130538f252739c95f1b60984a0c614bab4f99fbb4e170c49c988d8e80e6065</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1842</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

* nodejs: Nodejs denial of service (CVE-2026-21637)

* nodejs: Nodejs denial of service (CVE-2025-59466)

* nodejs: Nodejs denial of service (CVE-2025-59465)

* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

* nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55130" id="CVE-2025-55130" type="cve" title="CVE-2025-55130" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55131" id="CVE-2025-55131" type="cve" title="CVE-2025-55131" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55132" id="CVE-2025-55132" type="cve" title="CVE-2025-55132" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59465" id="CVE-2025-59465" type="cve" title="CVE-2025-59465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59466" id="CVE-2025-59466" type="cve" title="CVE-2025-59466" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431349" id="2431349" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431343" id="2431343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431352" id="2431352" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431350" id="2431350" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431338" id="2431338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1842" id="RLSA-2026:1842" type="self" title="RLSA-2026:1842" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nodejs24-full-i18n" arch="aarch64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-full-i18n-24.13.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b2f2cf0fb2d935358e4056ff27f7c33439d560b1cd9b8ad22513e6dde1aac1fc</sum>
        </package>
        <package name="nodejs24-libs" arch="aarch64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-libs-24.13.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">06d66ec530f1dcbc878501788cb830b9c4bf65c80d7dc79de737f277a81fef2c</sum>
        </package>
        <package name="nodejs24" arch="aarch64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-24.13.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a7c63c53a850635da0e96ffbeb893234eee4ce19eb08b844bad1465cdbeba93d</sum>
        </package>
        <package name="nodejs24-devel" arch="aarch64" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-devel-24.13.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7aaf97e30a39cc5da91bcce16ed5852e417d2da55fed4e488f80af89e3195235</sum>
        </package>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.13.0" release="1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-docs-24.13.0-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">1d2e9d7d3bbf686a1862ba194782f22e5eb522f1643084d926e5ba576ab067d0</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.6.2" release="1.24.13.0.1.el10_1" src="nodejs24-24.13.0-1.el10_1.src.rpm">
          <filename>nodejs24-npm-11.6.2-1.24.13.0.1.el10_1.noarch.rpm</filename>
          <sum type="sha256">47139c6e8c75276e94a4d2cc6f41ac80bd7d7eb07b95f00f1db117d1754e7b48</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1843</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs filesystem permissions bypass (CVE-2025-55132)

* nodejs: Nodejs denial of service (CVE-2026-21637)

* nodejs: Nodejs denial of service (CVE-2025-59466)

* nodejs: Nodejs denial of service (CVE-2025-59465)

* nodejs: Nodejs uninitialized memory exposure (CVE-2025-55131)

* nodejs: Nodejs file permissions bypass (CVE-2025-55130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55130" id="CVE-2025-55130" type="cve" title="CVE-2025-55130" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55131" id="CVE-2025-55131" type="cve" title="CVE-2025-55131" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55132" id="CVE-2025-55132" type="cve" title="CVE-2025-55132" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59465" id="CVE-2025-59465" type="cve" title="CVE-2025-59465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59466" id="CVE-2025-59466" type="cve" title="CVE-2025-59466" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431349" id="2431349" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431343" id="2431343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431352" id="2431352" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431350" id="2431350" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431338" id="2431338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1843" id="RLSA-2026:1843" type="self" title="RLSA-2026:1843" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-docs-22.22.0-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">12418e04b77a2c1137c2647a82575b946895b7fc9ae0b47193086ae6efb251f4</sum>
        </package>
        <package name="nodejs-npm" arch="aarch64" epoch="1" version="10.9.4" release="1.22.22.0.3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-npm-10.9.4-1.22.22.0.3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7f1d2405e14c38d486c23c7d113c9e2864c8b1c30723e07687140f71e95a9134</sum>
        </package>
        <package name="nodejs-libs" arch="aarch64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-libs-22.22.0-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">343340f93ef462e5125f157e5d8637e9f5a5588bb5eb6846c0fe8d9328df6cf5</sum>
        </package>
        <package name="nodejs" arch="aarch64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-22.22.0-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3631edce758706d83cba8c9bc19e864293f215f6bae43217275bf88f527858df</sum>
        </package>
        <package name="nodejs-full-i18n" arch="aarch64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-full-i18n-22.22.0-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c3056b4675b5eba4703041b8e552450ff720c063914b01ceeebb0833b3cc8558</sum>
        </package>
        <package name="nodejs-devel" arch="aarch64" epoch="1" version="22.22.0" release="3.el10_1" src="nodejs22-22.22.0-3.el10_1.src.rpm">
          <filename>nodejs-devel-22.22.0-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">41d826fab39802c657b1de01dd4e6812519ebbe9deb4499ba1190df2179630a7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1831</id>
    <title>Moderate: qemu-kvm security update</title>
    <issued date="2026-02-06 09:08:48" />
    <updated date="2026-02-18 09:09:25" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qemu-kvm.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

* qemu-kvm: VNC WebSocket handshake use-after-free (CVE-2025-11234)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11234" id="CVE-2025-11234" type="cve" title="CVE-2025-11234" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2401209" id="2401209" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1831" id="RLSA-2026:1831" type="self" title="RLSA-2026:1831" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qemu-kvm-device-display-virtio-gpu" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">6ec02f07bee2f43669897d8869a12b44e1c1c19bfea8729f4eaa67ad5ecf3b10</sum>
        </package>
        <package name="qemu-kvm-audio-pa" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-audio-pa-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">2bb8a46f38c8c6d70aecc1810dfdb9f15f0a095560bd223e34fad8c210a191b3</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">57beeea3faee8bf8e37efbe0aa512659d6fb67eda0a067de00c5d054684abe6e</sum>
        </package>
        <package name="qemu-kvm-device-usb-host" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">c35d1281aa55e8e54424566045679deeefba271c1133785f566139853924d3c3</sum>
        </package>
        <package name="qemu-kvm-docs" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-docs-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">e46c6cd807c20579279668987549ae04c8db75d0d9502cae160d434afce10e6b</sum>
        </package>
        <package name="qemu-pr-helper" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-pr-helper-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">ae60f8e8b3a42b65c024abcc80df0a21eba2a4c7b25ae78c5664079f720b2152</sum>
        </package>
        <package name="qemu-guest-agent" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-guest-agent-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">92cab52a4dc32731bf774edfa083fc1c068e3996bfaa7c01afc9f38a0905e3d4</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">28d9e1d14fdeaf4518d6d27e28db1c881e1212322466e08d6e312cfed56daa3c</sum>
        </package>
        <package name="qemu-kvm-tools" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-tools-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">b419b13648fdaccb721c492e7e01abcf17e9366975cac319edece1235bbab3df</sum>
        </package>
        <package name="qemu-kvm" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">324bd7aa5987737d351a77c045096d0144dd3d7036b91dd43d02d0eded844d56</sum>
        </package>
        <package name="qemu-kvm-core" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-core-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">0df0fc8aaec9b4daf196fe604d2cf16022541620e9b75f870288f165b6547668</sum>
        </package>
        <package name="qemu-kvm-block-curl" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-curl-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">17a1b9e23f9e67d4b3ea735ebf4518ee01f353a2bc6809c6967f96a306704182</sum>
        </package>
        <package name="qemu-kvm-block-rbd" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-rbd-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">fbc6a1b3c369a3d247f85a0a68313e18aead765cb9eb74ec9ef141ee425d0d2b</sum>
        </package>
        <package name="qemu-kvm-common" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-common-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">70512fe02a4f1c8febb835418015e08b9967b3a037870a2a13de220b1b9812d7</sum>
        </package>
        <package name="qemu-img" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-img-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">cd909500bcd9a362b95d0dc93d00b303f044b8cd25b1d7453e9653451e0d42cc</sum>
        </package>
        <package name="qemu-kvm-block-blkio" arch="aarch64" epoch="8" version="10.0.0" release="14.el10_1.5" src="qemu-kvm-10.0.0-14.el10_1.5.src.rpm">
          <filename>qemu-kvm-block-blkio-10.0.0-14.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">d5b68f2eda003ef09320281b11ca4b44e8bc08cbc9121b162536f1399269107e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2225</id>
    <title>Critical: keylime security update</title>
    <issued date="2026-02-11 09:16:03" />
    <updated date="2026-02-24 18:58:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication (CVE-2026-1709)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1709" id="CVE-2026-1709" type="cve" title="CVE-2026-1709" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435514" id="2435514" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2225" id="RLSA-2026:2225" type="self" title="RLSA-2026:2225" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="keylime" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-7.12.1-11.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">8def11266f93e32ea6f789eac9e21ffa132ae9e1c93f2b7e262e0f0d793c7451</sum>
        </package>
        <package name="keylime-tenant" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-tenant-7.12.1-11.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">3584f087ff48a41813188e40feeb8780b9f3e387b14e2551432294075020eead</sum>
        </package>
        <package name="python3-keylime" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>python3-keylime-7.12.1-11.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">3b61efb7aa539a708f5c5ba81f25ae4cac206ada8d5388ca317954da02ac1448</sum>
        </package>
        <package name="keylime-verifier" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-verifier-7.12.1-11.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">cf3d2a6c0776dbf19abad9104fbd5485165d497ad3c44b3f2227e8ae78b9ee46</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-selinux-7.12.1-11.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">cf74ec0786a2fb42cf5d46aeb335f4a59596ac3b4c0f380088d7dc98a4912fed</sum>
        </package>
        <package name="keylime-tools" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-tools-7.12.1-11.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">39e3108b74ee54f3567712adc88bb4365c8cc9481079a002c8211ead90a157b1</sum>
        </package>
        <package name="keylime-registrar" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-registrar-7.12.1-11.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">de8590776235dedd3c9d50bab58fcd36d14e14dc554d26c89ba1e1c358b233e6</sum>
        </package>
        <package name="keylime-base" arch="aarch64" epoch="0" version="7.12.1" release="11.el10_1.4" src="keylime-7.12.1-11.el10_1.4.src.rpm">
          <filename>keylime-base-7.12.1-11.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">eddba0fc2d4a40a488b1dccc084748ae774e97b0813dbc283fb63991da8d1e4d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2222</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-02-11 09:16:03" />
    <updated date="2026-02-24 18:58:17" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server. (CVE-2026-23530)

* freerdp: FreeRDP: Denial of Service and potential code execution via use-after-free vulnerability (CVE-2026-23884)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via malicious server (CVE-2026-23883)

* freerdp: FreeRDP: Heap buffer overflow leads to denial of service and potential code execution (CVE-2026-23533)

* freerdp: FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution. (CVE-2026-23531)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via client-side heap buffer overflow (CVE-2026-23534)

* freerdp: FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow (CVE-2026-23532)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23530" id="CVE-2026-23530" type="cve" title="CVE-2026-23530" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23531" id="CVE-2026-23531" type="cve" title="CVE-2026-23531" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23532" id="CVE-2026-23532" type="cve" title="CVE-2026-23532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23533" id="CVE-2026-23533" type="cve" title="CVE-2026-23533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23534" id="CVE-2026-23534" type="cve" title="CVE-2026-23534" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23883" id="CVE-2026-23883" type="cve" title="CVE-2026-23883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23884" id="CVE-2026-23884" type="cve" title="CVE-2026-23884" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430880" id="2430880" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430886" id="2430886" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430885" id="2430885" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430891" id="2430891" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430877" id="2430877" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430887" id="2430887" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430888" id="2430888" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2222" id="RLSA-2026:2222" type="self" title="RLSA-2026:2222" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">6c50e3a53dce27ef6b780370b217b34ecaeb8228e680b4fe8f00c8b802d0b475</sum>
        </package>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">9a79651a569b97e28e68d7dc5b3538f4ad1dad04412b6dca936c234a7c96f978</sum>
        </package>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.1" src="freerdp-3.10.3-5.el10_1.1.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">e8ac5ce229a3c8ff3d7dc10872818e02c9e9f18de1e430367815c54895431fdd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3443</id>
    <title>Important: valkey security update</title>
    <issued date="2026-02-28 09:08:38" />
    <updated date="2026-03-14 06:06:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* Valkey: Valkey: Data tampering and denial of service via improper null character handling in Lua scripts (CVE-2025-67733)

* valkey: Valkey: Denial of Service via invalid clusterbus packet (CVE-2026-21863)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67733" id="CVE-2025-67733" type="cve" title="CVE-2025-67733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21863" id="CVE-2026-21863" type="cve" title="CVE-2026-21863" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442025" id="2442025" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442026" id="2442026" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3443" id="RLSA-2026:3443" type="self" title="RLSA-2026:3443" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="valkey-devel" arch="aarch64" epoch="0" version="8.0.7" release="1.el10_1" src="valkey-8.0.7-1.el10_1.src.rpm">
          <filename>valkey-devel-8.0.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fb61ab75465a0b50a8e84993434d5906e30538a4e0244c703238324875d1ce4a</sum>
        </package>
        <package name="valkey" arch="aarch64" epoch="0" version="8.0.7" release="1.el10_1" src="valkey-8.0.7-1.el10_1.src.rpm">
          <filename>valkey-8.0.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8a735f989883a4a2c16995c4fe277ed4e26a9ebfa0ab030ed2fa586c4246d43f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2410</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2026-02-13 09:09:56" />
    <updated date="2026-02-26 20:49:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response (CVE-2026-1761)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1761" id="CVE-2026-1761" type="cve" title="CVE-2026-1761" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2435961" id="2435961" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2410" id="RLSA-2026:2410" type="self" title="RLSA-2026:2410" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.10" src="libsoup3-3.6.5-3.el10_1.10.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.10.aarch64.rpm</filename>
          <sum type="sha256">4c488e987043a34d90a3606e86ad2121463ed2e88137251100129f5378a7648f</sum>
        </package>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.10" src="libsoup3-3.6.5-3.el10_1.10.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.10.aarch64.rpm</filename>
          <sum type="sha256">32b14b7ddeea297a4317e43a824c7b6605fe2367454c42401a38a87cf449ba82</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2706</id>
    <title>Important: golang security update</title>
    <issued date="2026-02-17 09:08:42" />
    <updated date="2026-03-02 09:10:55" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* cmd/cgo: Potential code smuggling via doc comments in cmd/cgo (CVE-2025-61732)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61732" id="CVE-2025-61732" type="cve" title="CVE-2025-61732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437016" id="2437016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2706" id="RLSA-2026:2706" type="self" title="RLSA-2026:2706" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e919b39c47979171d95fba6b72cbe2c625a403eb2d65dc8417c5a5b4cf5ef7de</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">97aa82b1cf4a2c1bb7d5f3d9ef76d973a4c22e2cb03fb4fe37647a81686df78a</sum>
        </package>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-race-1.25.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3c604feaf2a939a0b417ad9255e57dea543d7bdadad84dd43d0023cf0a18d38b</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">27e6ef9ca5cf6b646ea3832990b77afbdef885afd9c6768c360cc95d1d5c87e1</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-1.25.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">bf9bfa259b5b58712f5a5a6d7b0b36a43b75acad3398a779495575bf93c9aa5d</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">a5c9084a174853dde1a972c47efc09986f37062a178d9846e02f2964cabc0bb6</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.7-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f573b951ff1ad692fa7a27660c24c4efa6c47efebd651bfd70f21e1c809823ad</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.7" release="1.el10_1" src="golang-1.25.7-1.el10_1.src.rpm">
          <filename>golang-src-1.25.7-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">f155d31640cca7f4abb754b982b9f359504bc9047e1852dc24d168bb3f631e68</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:2914</id>
    <title>Important: grafana security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* grafana/grafana/pkg/services/dashboards: Grafana Dashboard Permissions Scope Bypass Enables Cross?Dashboard Privilege Escalation (CVE-2026-21721)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21721" id="CVE-2026-21721" type="cve" title="CVE-2026-21721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433242" id="2433242" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:2914" id="RLSA-2026:2914" type="self" title="RLSA-2026:2914" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="22.el10_1" src="grafana-10.2.6-22.el10_1.src.rpm">
          <filename>grafana-10.2.6-22.el10_1.aarch64.rpm</filename>
          <sum type="sha256">df5eea01d376f334298ec08e65a22231fd28884ecbaef4c18625db3b3cb02ce9</sum>
        </package>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="22.el10_1" src="grafana-10.2.6-22.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-22.el10_1.aarch64.rpm</filename>
          <sum type="sha256">aabd1540901ad0f4dc0773a0a5fe4e2e574172e713ea201e3a15e89e4a949d84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3035</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3035" id="RLSA-2026:3035" type="self" title="RLSA-2026:3035" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-pcp" arch="aarch64" epoch="0" version="5.3.0" release="2.el10_1" src="grafana-pcp-5.3.0-2.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7a79916864d96dbd96353f8a650a2084f37d95ad9b195c4d90b8dd6d3ed731a4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3033</id>
    <title>Important: munge security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for munge.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MUNGE (MUNGE Uid 'N' Gid Emporium) is an authentication service for creating and validating credentials. It is designed to be highly scalable for use in an HPC cluster environment. It allows a process to authenticate the UID and GID of another local or remote process within a group of hosts having common users and groups. These hosts form a security realm that is defined by a shared cryptographic key. Clients within this security realm can create and validate credentials without the use of root privileges, reserved ports, or platform-specific methods.

Security Fix(es):

* MUNGE: MUNGE has a buffer overflow in message unpacking allows key leakage and credential forgery (CVE-2026-25506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25506" id="CVE-2026-25506" type="cve" title="CVE-2026-25506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438715" id="2438715" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3033" id="RLSA-2026:3033" type="self" title="RLSA-2026:3033" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="munge-libs" arch="aarch64" epoch="0" version="0.5.15" release="11.el10_1" src="munge-0.5.15-11.el10_1.src.rpm">
          <filename>munge-libs-0.5.15-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ea2666a262fda12c14d91430e7c4484d10dabf2470234547519ad6bbb840700a</sum>
        </package>
        <package name="munge" arch="aarch64" epoch="0" version="0.5.15" release="11.el10_1" src="munge-0.5.15-11.el10_1.src.rpm">
          <filename>munge-0.5.15-11.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c9f26b9deba2140a1c19492908024fe6d71b72c52050b383887a6f55bc702313</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3068</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22855)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22853)

* freerdp: FreeRDP global-buffer-overflow (CVE-2026-22858)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22859)

* freerdp: FreeRDP: Denial of Service via use after free in ecam_channel_write (CVE-2026-24678)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22853" id="CVE-2026-22853" type="cve" title="CVE-2026-22853" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22855" id="CVE-2026-22855" type="cve" title="CVE-2026-22855" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22858" id="CVE-2026-22858" type="cve" title="CVE-2026-22858" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22859" id="CVE-2026-22859" type="cve" title="CVE-2026-22859" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24678" id="CVE-2026-24678" type="cve" title="CVE-2026-24678" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429653" id="2429653" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429649" id="2429649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429647" id="2429647" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438197" id="2438197" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429645" id="2429645" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3068" id="RLSA-2026:3068" type="self" title="RLSA-2026:3068" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">4b3effbb143be7b78275f25a2664fc73cb25e34126a92ca56cbd57c3f3b73d95</sum>
        </package>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">2ab2849c3e37b845507323d69c74bc42b93b85a4bc9324a1c4795ad897927e48</sum>
        </package>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.2" src="freerdp-3.10.3-5.el10_1.2.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">811887e2d37cb5b41f0e3c90aac1fda17dcfad6f0d2db7d741e86d9c5c4ffaf4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3092</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3092" id="RLSA-2026:3092" type="self" title="RLSA-2026:3092" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipp-usb" arch="aarch64" epoch="0" version="0.9.27" release="5.el10_1" src="golang-github-openprinting-ipp-usb-0.9.27-5.el10_1.src.rpm">
          <filename>ipp-usb-0.9.27-5.el10_1.aarch64.rpm</filename>
          <sum type="sha256">dc86dc842d9e17d3015ead567165ac7ecdfd0af52e0e0f9a6ff0697fdba44336</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3094</id>
    <title>Important: protobuf security update</title>
    <issued date="2026-02-24 18:56:34" />
    <updated date="2026-03-10 18:08:44" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for protobuf.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The protobuf packages provide Protocol Buffers, Google's data interchange format. Protocol Buffers can encode structured data in an efficient yet extensible format, and provide a flexible, efficient, and automated mechanism for serializing structured data.

Security Fix(es):

* python: protobuf: Protobuf: Denial of Service due to recursion depth bypass (CVE-2026-0994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0994" id="CVE-2026-0994" type="cve" title="CVE-2026-0994" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2432398" id="2432398" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3094" id="RLSA-2026:3094" type="self" title="RLSA-2026:3094" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="protobuf" arch="aarch64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>protobuf-3.19.6-15.el10_1.aarch64.rpm</filename>
          <sum type="sha256">806d72f2dbe36e24f79718dcac08dc3b79e9adf74221dd51d1287a9da654a83e</sum>
        </package>
        <package name="python3-protobuf" arch="aarch64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>python3-protobuf-3.19.6-15.el10_1.aarch64.rpm</filename>
          <sum type="sha256">de0dd3fa70dabe679539ddc5fdfb34d12408567ed7e512c73d027c3f279d1f8f</sum>
        </package>
        <package name="protobuf-lite" arch="aarch64" epoch="0" version="3.19.6" release="15.el10_1" src="protobuf-3.19.6-15.el10_1.src.rpm">
          <filename>protobuf-lite-3.19.6-15.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b317b737289c9bdbcb1e71781f4d3db4c5df8bed043a820507228a3363685a8b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3208</id>
    <title>Moderate: 389-ds-base security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow (CVE-2025-14905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14905" id="CVE-2025-14905" type="cve" title="CVE-2025-14905" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423624" id="2423624" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3208" id="RLSA-2026:3208" type="self" title="RLSA-2026:3208" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="389-ds-base-libs" arch="aarch64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-libs-3.1.3-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">26b1e9f8faa3da5b5fe0cb221f30acd04e96dbb95673845c9d73cd268e14d0d4</sum>
        </package>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>python3-lib389-3.1.3-7.el10_1.noarch.rpm</filename>
          <sum type="sha256">3de41c1f87bf374e89d73ff11abb7793efb0c38be054059155cde52dc2d29e48</sum>
        </package>
        <package name="389-ds-base" arch="aarch64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-3.1.3-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">319a5967f68a7b84ca3b6d2092010deba75e63bc0c41c9093322fc589f2d9f3a</sum>
        </package>
        <package name="389-ds-base-snmp" arch="aarch64" epoch="0" version="3.1.3" release="7.el10_1" src="389-ds-base-3.1.3-7.el10_1.src.rpm">
          <filename>389-ds-base-snmp-3.1.3-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">072a0fb2e3b73d53175d3a581f304a72e5649e7dcb5bceadd3b59e67be87c6fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3297</id>
    <title>Important: buildah security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3297" id="RLSA-2026:3297" type="self" title="RLSA-2026:3297" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.41.8" release="2.el10_1" src="buildah-1.41.8-2.el10_1.src.rpm">
          <filename>buildah-tests-1.41.8-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">81def32dbc068938bc433c46c6f4e2e731d74330b7678e5a2ee91b405a9cdafd</sum>
        </package>
        <package name="buildah" arch="aarch64" epoch="2" version="1.41.8" release="2.el10_1" src="buildah-1.41.8-2.el10_1.src.rpm">
          <filename>buildah-1.41.8-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b133eb1c0c0277c9acd944697416b888997c8691cbf4f1d6467715502a46127c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3336</id>
    <title>Important: podman security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3336" id="RLSA-2026:3336" type="self" title="RLSA-2026:3336" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-remote-5.6.0-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">57d0c788a64ff153f4993fc5bd786247f6c5bf002762688cde516aae95284337</sum>
        </package>
        <package name="podman" arch="aarch64" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-5.6.0-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">95b483f618429f5bfd2d8d9b32954abaf47b4cee5dc10551a436b07dfa7a58b7</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.6.0" release="12.el10_1" src="podman-5.6.0-12.el10_1.src.rpm">
          <filename>podman-docker-5.6.0-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">2dd7bd90122e6ba9f8bd5e0acc65c7395f2d0160075dfdf770e2df9ff4cb4f41</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3343</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3343" id="RLSA-2026:3343" type="self" title="RLSA-2026:3343" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="skopeo" arch="aarch64" epoch="2" version="1.20.0" release="3.el10_1" src="skopeo-1.20.0-3.el10_1.src.rpm">
          <filename>skopeo-1.20.0-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">e60d2ca35fad0c0e137f93ce4dd0c5a1daa15cecceb565840ddf9d500e0165a9</sum>
        </package>
        <package name="skopeo-tests" arch="aarch64" epoch="2" version="1.20.0" release="3.el10_1" src="skopeo-1.20.0-3.el10_1.src.rpm">
          <filename>skopeo-tests-1.20.0-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8c5658f0ae5d9790ef3bb8901ee31ba6b579aca7d994b9487afad0eb4d9dd0de</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3354</id>
    <title>Important: python-pyasn1 security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-pyasn1.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID (CVE-2026-23490)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23490" id="CVE-2026-23490" type="cve" title="CVE-2026-23490" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430472" id="2430472" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3354" id="RLSA-2026:3354" type="self" title="RLSA-2026:3354" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-pyasn1-modules" arch="noarch" epoch="0" version="0.6.2" release="1.el10_1" src="python-pyasn1-0.6.2-1.el10_1.src.rpm">
          <filename>python3-pyasn1-modules-0.6.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">1c60e78956141e52bf419861d056c95bcbddda4c480f855146d603ddf86e41e1</sum>
        </package>
        <package name="python3-pyasn1" arch="noarch" epoch="0" version="0.6.2" release="1.el10_1" src="python-pyasn1-0.6.2-1.el10_1.src.rpm">
          <filename>python3-pyasn1-0.6.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">ce218548da8b604e37639340da121a27df8b87cc1901835fb99135a70de2dfd1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3361</id>
    <title>Important: firefox security update</title>
    <issued date="2026-02-26 20:47:54" />
    <updated date="2026-03-12 18:08:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

* firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)

* firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)

* firefox: Undefined behavior in the DOM: Core &amp; HTML component (CVE-2026-2771)

* firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)

* firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)

* firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)

* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)

* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)

* firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)

* firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)

* firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)

* firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)

* firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)

* firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)

* firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)

* firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)

* firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)

* firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)

* firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)

* firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)

* firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)

* firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)

* firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)

* firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)

* firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)

* firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core &amp; HTML component (CVE-2026-2778)

* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)

* firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2757" id="CVE-2026-2757" type="cve" title="CVE-2026-2757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2758" id="CVE-2026-2758" type="cve" title="CVE-2026-2758" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2759" id="CVE-2026-2759" type="cve" title="CVE-2026-2759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2760" id="CVE-2026-2760" type="cve" title="CVE-2026-2760" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2761" id="CVE-2026-2761" type="cve" title="CVE-2026-2761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2762" id="CVE-2026-2762" type="cve" title="CVE-2026-2762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2763" id="CVE-2026-2763" type="cve" title="CVE-2026-2763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2764" id="CVE-2026-2764" type="cve" title="CVE-2026-2764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2765" id="CVE-2026-2765" type="cve" title="CVE-2026-2765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2766" id="CVE-2026-2766" type="cve" title="CVE-2026-2766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2767" id="CVE-2026-2767" type="cve" title="CVE-2026-2767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2768" id="CVE-2026-2768" type="cve" title="CVE-2026-2768" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2769" id="CVE-2026-2769" type="cve" title="CVE-2026-2769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2770" id="CVE-2026-2770" type="cve" title="CVE-2026-2770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2771" id="CVE-2026-2771" type="cve" title="CVE-2026-2771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2772" id="CVE-2026-2772" type="cve" title="CVE-2026-2772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2773" id="CVE-2026-2773" type="cve" title="CVE-2026-2773" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2774" id="CVE-2026-2774" type="cve" title="CVE-2026-2774" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2775" id="CVE-2026-2775" type="cve" title="CVE-2026-2775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2776" id="CVE-2026-2776" type="cve" title="CVE-2026-2776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2777" id="CVE-2026-2777" type="cve" title="CVE-2026-2777" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2778" id="CVE-2026-2778" type="cve" title="CVE-2026-2778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2779" id="CVE-2026-2779" type="cve" title="CVE-2026-2779" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2780" id="CVE-2026-2780" type="cve" title="CVE-2026-2780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781" id="CVE-2026-2781" type="cve" title="CVE-2026-2781" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2782" id="CVE-2026-2782" type="cve" title="CVE-2026-2782" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2783" id="CVE-2026-2783" type="cve" title="CVE-2026-2783" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2784" id="CVE-2026-2784" type="cve" title="CVE-2026-2784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2785" id="CVE-2026-2785" type="cve" title="CVE-2026-2785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2786" id="CVE-2026-2786" type="cve" title="CVE-2026-2786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2787" id="CVE-2026-2787" type="cve" title="CVE-2026-2787" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2788" id="CVE-2026-2788" type="cve" title="CVE-2026-2788" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2789" id="CVE-2026-2789" type="cve" title="CVE-2026-2789" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2790" id="CVE-2026-2790" type="cve" title="CVE-2026-2790" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2791" id="CVE-2026-2791" type="cve" title="CVE-2026-2791" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2792" id="CVE-2026-2792" type="cve" title="CVE-2026-2792" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2793" id="CVE-2026-2793" type="cve" title="CVE-2026-2793" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442331" id="2442331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442337" id="2442337" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442322" id="2442322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442295" id="2442295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442292" id="2442292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442343" id="2442343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442290" id="2442290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442307" id="2442307" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442316" id="2442316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442304" id="2442304" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442328" id="2442328" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442335" id="2442335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442318" id="2442318" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442342" id="2442342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442288" id="2442288" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442325" id="2442325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442320" id="2442320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442291" id="2442291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442314" id="2442314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442312" id="2442312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442297" id="2442297" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442324" id="2442324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442319" id="2442319" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442327" id="2442327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442300" id="2442300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442313" id="2442313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442284" id="2442284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442287" id="2442287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442308" id="2442308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442298" id="2442298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442294" id="2442294" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442333" id="2442333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442309" id="2442309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442334" id="2442334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442329" id="2442329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442326" id="2442326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442302" id="2442302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3361" id="RLSA-2026:3361" type="self" title="RLSA-2026:3361" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.8.0" release="2.el10_1" src="firefox-140.8.0-2.el10_1.src.rpm">
          <filename>firefox-140.8.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4cbeddaaae9df0afd49202d212dde4ac7aaa00938a2e0b01bb9ce2f364a98229</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3476</id>
    <title>Important: udisks2 security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for udisks2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

* udisks: Missing Authorization Check Allows Unprivileged Users to Back Up LUKS Headers via udisks D-Bus API (CVE-2026-26104)

* udisks: Missing Authorization Check Allows Unprivileged Users to Restore LUKS Headers via udisks D-Bus API (CVE-2026-26103)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26103" id="CVE-2026-26103" type="cve" title="CVE-2026-26103" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26104" id="CVE-2026-26104" type="cve" title="CVE-2026-26104" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433719" id="2433719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2433717" id="2433717" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3476" id="RLSA-2026:3476" type="self" title="RLSA-2026:3476" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="udisks2-iscsi" arch="aarch64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-iscsi-2.10.90-6.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">2846ed88369f769581a15901d887284ed05d7115f4d7e41d596f13a03b8cc312</sum>
        </package>
        <package name="udisks2-lvm2" arch="aarch64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-lvm2-2.10.90-6.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">6650579bc79e215f4c1e74f2fefb8ce89f4883b4d93a2752e5d6723a0427873b</sum>
        </package>
        <package name="libudisks2" arch="aarch64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>libudisks2-2.10.90-6.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">d2f899c180947aa4a82f63989973bc53d9355213692a863d2014897420b82c1c</sum>
        </package>
        <package name="udisks2-lsm" arch="aarch64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-lsm-2.10.90-6.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">e7cf77198448cb36d2387194f62db36c286b28e69ce088fb2031cc595b9305c6</sum>
        </package>
        <package name="udisks2" arch="aarch64" epoch="0" version="2.10.90" release="6.el10_1.1" src="udisks2-2.10.90-6.el10_1.1.src.rpm">
          <filename>udisks2-2.10.90-6.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">f3ddb6f75eda632037980ca2aef04162c8a7d5d7738b270996b218661b317f60</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3517</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

* firefox: Invalid pointer in the JavaScript Engine component (CVE-2026-2785)

* firefox: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2793)

* firefox: Undefined behavior in the DOM: Core &amp; HTML component (CVE-2026-2771)

* firefox: Integer overflow in the Audio/Video component (CVE-2026-2774)

* firefox: Sandbox escape due to incorrect boundary conditions in the Telemetry component in External Software (CVE-2026-2776)

* firefox: Integer overflow in the Libraries component in NSS (CVE-2026-2781)

* firefox: Use-after-free in the JavaScript Engine: JIT component (CVE-2026-2766)

* firefox: Use-after-free in the Storage: IndexedDB component (CVE-2026-2769)

* firefox: Use-after-free in the DOM: Window and Location component (CVE-2026-2787)

* firefox: Sandbox escape in the Storage: IndexedDB component (CVE-2026-2768)

* firefox: Information disclosure due to JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-2783)

* firefox: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-2788)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-2784)

* firefox: Incorrect boundary conditions in the Graphics: ImageLib component (CVE-2026-2759)

* firefox: Integer overflow in the JavaScript: Standard Library component (CVE-2026-2762)

* firefox: Sandbox escape in the Graphics: WebRender component (CVE-2026-2761)

* firefox: Privilege escalation in the Messaging System component (CVE-2026-2777)

* firefox: Same-origin policy bypass in the Networking: JAR component (CVE-2026-2790)

* firefox: Mitigation bypass in the DOM: HTML Parser component (CVE-2026-2775)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2763)

* firefox: Memory safety bugs fixed in Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148 (CVE-2026-2792)

* firefox: Incorrect boundary conditions in the Web Audio component (CVE-2026-2773)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2786)

* firefox: Use-after-free in the Graphics: ImageLib component (CVE-2026-2789)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Audio/Video component (CVE-2026-2757)

* firefox: Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component (CVE-2026-2760)

* firefox: Use-after-free in the Audio/Video: Playback component (CVE-2026-2772)

* firefox: Incorrect boundary conditions in the Networking: JAR component (CVE-2026-2779)

* firefox: Use-after-free in the JavaScript: WebAssembly component (CVE-2026-2767)

* firefox: JIT miscompilation, use-after-free in the JavaScript Engine: JIT component (CVE-2026-2764)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2782)

* firefox: Use-after-free in the JavaScript Engine component (CVE-2026-2765)

* firefox: Privilege escalation in the Netmonitor component (CVE-2026-2780)

* firefox: Sandbox escape due to incorrect boundary conditions in the DOM: Core &amp; HTML component (CVE-2026-2778)

* firefox: Use-after-free in the JavaScript: GC component (CVE-2026-2758)

* firefox: Mitigation bypass in the Networking: Cache component (CVE-2026-2791)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-2770)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2757" id="CVE-2026-2757" type="cve" title="CVE-2026-2757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2758" id="CVE-2026-2758" type="cve" title="CVE-2026-2758" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2759" id="CVE-2026-2759" type="cve" title="CVE-2026-2759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2760" id="CVE-2026-2760" type="cve" title="CVE-2026-2760" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2761" id="CVE-2026-2761" type="cve" title="CVE-2026-2761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2762" id="CVE-2026-2762" type="cve" title="CVE-2026-2762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2763" id="CVE-2026-2763" type="cve" title="CVE-2026-2763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2764" id="CVE-2026-2764" type="cve" title="CVE-2026-2764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2765" id="CVE-2026-2765" type="cve" title="CVE-2026-2765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2766" id="CVE-2026-2766" type="cve" title="CVE-2026-2766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2767" id="CVE-2026-2767" type="cve" title="CVE-2026-2767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2768" id="CVE-2026-2768" type="cve" title="CVE-2026-2768" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2769" id="CVE-2026-2769" type="cve" title="CVE-2026-2769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2770" id="CVE-2026-2770" type="cve" title="CVE-2026-2770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2771" id="CVE-2026-2771" type="cve" title="CVE-2026-2771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2772" id="CVE-2026-2772" type="cve" title="CVE-2026-2772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2773" id="CVE-2026-2773" type="cve" title="CVE-2026-2773" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2774" id="CVE-2026-2774" type="cve" title="CVE-2026-2774" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2775" id="CVE-2026-2775" type="cve" title="CVE-2026-2775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2776" id="CVE-2026-2776" type="cve" title="CVE-2026-2776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2777" id="CVE-2026-2777" type="cve" title="CVE-2026-2777" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2778" id="CVE-2026-2778" type="cve" title="CVE-2026-2778" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2779" id="CVE-2026-2779" type="cve" title="CVE-2026-2779" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2780" id="CVE-2026-2780" type="cve" title="CVE-2026-2780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2781" id="CVE-2026-2781" type="cve" title="CVE-2026-2781" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2782" id="CVE-2026-2782" type="cve" title="CVE-2026-2782" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2783" id="CVE-2026-2783" type="cve" title="CVE-2026-2783" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2784" id="CVE-2026-2784" type="cve" title="CVE-2026-2784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2785" id="CVE-2026-2785" type="cve" title="CVE-2026-2785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2786" id="CVE-2026-2786" type="cve" title="CVE-2026-2786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2787" id="CVE-2026-2787" type="cve" title="CVE-2026-2787" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2788" id="CVE-2026-2788" type="cve" title="CVE-2026-2788" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2789" id="CVE-2026-2789" type="cve" title="CVE-2026-2789" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2790" id="CVE-2026-2790" type="cve" title="CVE-2026-2790" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2791" id="CVE-2026-2791" type="cve" title="CVE-2026-2791" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2792" id="CVE-2026-2792" type="cve" title="CVE-2026-2792" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2793" id="CVE-2026-2793" type="cve" title="CVE-2026-2793" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442331" id="2442331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442337" id="2442337" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442322" id="2442322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442295" id="2442295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442292" id="2442292" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442343" id="2442343" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442290" id="2442290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442307" id="2442307" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442316" id="2442316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442304" id="2442304" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442328" id="2442328" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442335" id="2442335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442318" id="2442318" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442342" id="2442342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442288" id="2442288" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442325" id="2442325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442320" id="2442320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442291" id="2442291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442314" id="2442314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442312" id="2442312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442297" id="2442297" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442324" id="2442324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442319" id="2442319" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442327" id="2442327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442300" id="2442300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442313" id="2442313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442284" id="2442284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442287" id="2442287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442308" id="2442308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442298" id="2442298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442294" id="2442294" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442333" id="2442333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442309" id="2442309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442334" id="2442334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442329" id="2442329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442326" id="2442326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442302" id="2442302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3517" id="RLSA-2026:3517" type="self" title="RLSA-2026:3517" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.8.0" release="2.el10_1" src="thunderbird-140.8.0-2.el10_1.src.rpm">
          <filename>thunderbird-140.8.0-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6ce97e242e831d7ebbc0d90ab48b32ae56bec5538e4543c23261efdb15381a81</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3669</id>
    <title>Important: go-rpm-macros security update</title>
    <issued date="2026-03-05 09:12:24" />
    <updated date="2026-03-19 06:08:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-rpm-macros.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages.  It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3669" id="RLSA-2026:3669" type="self" title="RLSA-2026:3669" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="go-rpm-macros" arch="aarch64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-rpm-macros-3.6.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1924cbef9571fbd843a02607feb720653e1e038499793c7e7b155d77eef4b656</sum>
        </package>
        <package name="go-srpm-macros" arch="noarch" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-srpm-macros-3.6.0-7.el10_1.noarch.rpm</filename>
          <sum type="sha256">fc47fdd7894de333af41c359159c250478c82358fff84549f21a5b18fb3f2448</sum>
        </package>
        <package name="go-rpm-templates" arch="aarch64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-rpm-templates-3.6.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">e0fa838ee333178b5dd85b4b8fc50abe5c4e141397d4600be973650adcae15c3</sum>
        </package>
        <package name="go-filesystem" arch="aarch64" epoch="0" version="3.6.0" release="7.el10_1" src="go-rpm-macros-3.6.0-7.el10_1.src.rpm">
          <filename>go-filesystem-3.6.0-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">20fe0568e591afc1be2969879fddbfb4a85fdfc7ead52fc171a0b518a15f28ca</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4164</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-03-11 12:08:24" />
    <updated date="2026-03-25 12:11:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4164" id="RLSA-2026:4164" type="self" title="RLSA-2026:4164" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git-lfs" arch="aarch64" epoch="0" version="3.6.1" release="7.el10_1" src="git-lfs-3.6.1-7.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8b4e9cfcb792e4e4821c7a37831a23066e2f56cac282d3b3f3915fad230a6826</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4629</id>
    <title>Important: libvpx security update</title>
    <issued date="2026-03-17 12:07:50" />
    <updated date="2026-03-31 12:09:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libvpx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Heap buffer overflow in libvpx (CVE-2026-2447)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2447" id="CVE-2026-2447" type="cve" title="CVE-2026-2447" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440219" id="2440219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4629" id="RLSA-2026:4629" type="self" title="RLSA-2026:4629" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libvpx" arch="aarch64" epoch="0" version="1.14.1" release="6.el10_1" src="libvpx-1.14.1-6.el10_1.src.rpm">
          <filename>libvpx-1.14.1-6.el10_1.aarch64.rpm</filename>
          <sum type="sha256">97eba5e94e295f214bfbff2015dd12e9f5f0a1adc8b3a7d019bf33021654e887</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3864</id>
    <title>Important: delve security update</title>
    <issued date="2026-03-07 12:07:41" />
    <updated date="2026-03-21 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3864" id="RLSA-2026:3864" type="self" title="RLSA-2026:3864" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="delve" arch="aarch64" epoch="0" version="1.25.2" release="2.el10_1" src="delve-1.25.2-2.el10_1.src.rpm">
          <filename>delve-1.25.2-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">feb02b3e0bde6fec983eb70df04c98a9a225560227d1a7c2ec207318f91bec30</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4450</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-03-13 12:06:58" />
    <updated date="2026-03-27 12:10:55" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.115 and .NET Runtime 9.0.14.Security Fix(es):

* .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

* asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26127" id="CVE-2026-26127" type="cve" title="CVE-2026-26127" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26130" id="CVE-2026-26130" type="cve" title="CVE-2026-26130" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446134" id="2446134" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446098" id="2446098" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4450" id="RLSA-2026:4450" type="self" title="RLSA-2026:4450" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.115" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.115-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">58e585bf16cf6036bdabb9b9cf9ca579fbc715078147f96cf91f785565b39ce5</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a4a547b4edd7ed83fb211cb12aa66e0f7c1109875397cac174e3851c257d62d5</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">45a65b39a287b4eb47837a927e026902f9bdc385f1a74b331aed3f082ded3a88</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4fc8b0d8b3aa2a53cd1c9fb8115d73a7fab3a922c3a2d64687846ebdc84da725</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.115" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-templates-9.0-9.0.115-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f74f03041e4217f9814e60ce2c50fac88a1c15c14b6079493007b762f24d0c68</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">76ba651d90446196b0e615837f8f3469b080418f5329225b7893511013d583da</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">dcb2245d6444a5a913ba60fa0451f2f8c17f3c2fb0953b2ad368490b7972c21e</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2758c696bb7620558d9307f018ae2991c10776b536aacb0ea961451c0531dacd</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">16936a0b440a050a31d94b67c9f3ce281c546e4920952ed807d54d6c1aa84c1a</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.115" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.115-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f88dae472cfd9c5abe6f64baa2685b9959d5b026153cdee6af70ac83258fe8e1</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.115" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.115-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">dc2c699adb4098cb859e69934e6c7bbaf9fbac2375991c93b4aa599ecee8767c</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.14" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.14-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d4f3a81a2c0b89383ad0fa136b4dbe1f77e2045b5f2e245ac65cf36f65a016d2</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.115" release="1.el10_1" src="dotnet9.0-9.0.115-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.115-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">79dcd92be07aa65d491ea62f2a061390ac8d2be1eb7bd9aae84a8cc3a861796b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4453</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-03-13 12:06:58" />
    <updated date="2026-03-27 12:10:55" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.104 and .NET Runtime 10.0.4.Security Fix(es):

* .net: .NET: Denial of Service via out-of-bounds read (CVE-2026-26127)

* asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26127" id="CVE-2026-26127" type="cve" title="CVE-2026-26127" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26130" id="CVE-2026-26130" type="cve" title="CVE-2026-26130" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446134" id="2446134" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446098" id="2446098" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4453" id="RLSA-2026:4453" type="self" title="RLSA-2026:4453" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">421b47c74b49c1cdcbd9bdb0efa02978d5f2a2c41ad5db6b331fb3da7ac2669e</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" arch="aarch64" epoch="0" version="10.0.104" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.104-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6593463674ed3bbc664e9a994e30ef62e80eeb42b889ae320e34162958a8a507</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c834437b7c6531226a47b099ba47ac128b0cce7ee4877efa9ce337084112894d</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ac0987d5407e2161f23a43ab644f6cae75063310b69631acec4b9583a6706bca</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">575bee70469a01fac5c25ca5c5544e620e16089d1ddd2a8867069635898cfca9</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="aarch64" epoch="0" version="10.0.104" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-templates-10.0-10.0.104-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">48cb2b34f9b68f05ef495bfba9c93be04d9a206e15393a0266e47edc552fafe7</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">be55ee958bfc7475173cf384bf7f51a38a52ac0d19b3a1dd2090c91edd688c76</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="aarch64" epoch="0" version="10.0.104" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.104-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0e32d95f5c2bf5a78f096aa58ccc1fa9c1b24a94d0f598ae50205434a538519b</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b25065c2818eb3cab7de5350baef8d4b1dfc0297ea8c508ee859de9eddc8e96a</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-host-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d905a9b7ae4e8e477d12b1f92d299e99640bdf3a39e19cf392f67d1d3bd025cd</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">aa7fad3acf18533df4be3719ad4bbab7041687515f0fa3ee181f4dc7cb900a66</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="aarch64" epoch="0" version="10.0.4" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.4-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">bb0812764357fb41d008ba9abeec4dc5224f95195eebc268d049c5f72b0ec88d</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="aarch64" epoch="0" version="10.0.104" release="1.el10_1" src="dotnet10.0-10.0.104-1.el10_1.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.104-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3e0dbe65768185782b64f6bf4d48567d2b8736ed30c418fe875c64e019c67f9d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4451</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-03-13 12:06:58" />
    <updated date="2026-03-27 12:10:55" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.125 and .NET Runtime 8.0.25.Security Fix(es):

* asp.net: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-26130)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26130" id="CVE-2026-26130" type="cve" title="CVE-2026-26130" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446134" id="2446134" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4451" id="RLSA-2026:4451" type="self" title="RLSA-2026:4451" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">eb86169f1730722ba6e7a103544c0ee209b2a3ae2c1e9f14c262571b7cb0bece</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1c69f96ff326dfcf3bd37f568a000853cb1c53f5ef7f01782ac237eeaede991f</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.125" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.125-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d960a2291c803932dd600d09d4e08cee8b71106dcb2340626555d18164c5e62d</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a8c08bcd53efc398f4135e3cb8d48897af49d2081883f3e360f3c0a62167cd0c</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5701735b09dcb414b3e5771013e93f65b4f273d74b8010382ff0a83effc9456f</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.125" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-templates-8.0-8.0.125-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">eb976d77010ed48451aceecc6d3908cbca16b807ab2b53d568a38ce83003006a</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4479d5526027660523f1c770a2215651f1baea3e81d28b6d06cb23586e503ddd</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.125" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.125-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fbd6c58f8fe39b8748db6b9f7db59c611835d81eaf83ea5cc4c883726b403f4f</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c764921a6d48d83ce50d27c6d534e0a68ad6dd7b08eafdc62ad876b4f24573a4</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c643d6f97bceb00a8910caa5c4c44ad2dd87601061a6e9a95fd7530aa58ce30d</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.25" release="1.el10_1" src="dotnet8.0-8.0.125-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.25-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c1f206228b69e994056525ea1ea8046d80535760b834336401b0b31db7a3af5f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3887</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-03-06 06:05:39" />
    <updated date="2026-03-20 06:07:20" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)

* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)

* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439326" id="2439326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439324" id="2439324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439325" id="2439325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439322" id="2439322" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3887" id="RLSA-2026:3887" type="self" title="RLSA-2026:3887" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql-contrib" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">01398d626bd2aadf5f1443b9560304aa178e31eb785300923280bcdff1a84b93</sum>
        </package>
        <package name="postgresql-docs" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">77fb175a2eb11f9769c448e454069f2d6cd6ab6b830753f6b42597fbd6abce8d</sum>
        </package>
        <package name="postgresql-server-devel" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f8b0e7f02f1b2628efa2515d4a3ba949dd2449741cd630baeee6913dfd23e01a</sum>
        </package>
        <package name="postgresql-test" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-test-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">17fbdc88026973e87e0d5cb60f0b9c31d5b6dc798d469fe2559197c6397da952</sum>
        </package>
        <package name="postgresql-private-libs" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fd553e0dae6b71db943f37fb6c8969281491075f8f636810282477e128e4e218</sum>
        </package>
        <package name="postgresql-server" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">203f203510bd18855e2bd3ec7cf5e559a751bbfdc9c7f89b8a5c2170588ee07f</sum>
        </package>
        <package name="postgresql-upgrade" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d265da341b0cb519a3d2e4a6520b63e8677a574388fd2538fe2dd0199ca7df36</sum>
        </package>
        <package name="postgresql-static" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-static-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6b902ea005eb1b25c0d494e33dbe1ba498505d3efd8d6c4e3394ff9c752984ed</sum>
        </package>
        <package name="postgresql-plperl" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f5e6e99649cc96b35b096ae82fcf92f320d4da7ff662e8a4b10d2b2d8a816b1f</sum>
        </package>
        <package name="postgresql-private-devel" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0f26d9a474d6d16a0c04b6a6ae073cf4324b33506bd8f46178a9463a4263645c</sum>
        </package>
        <package name="postgresql" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6e7e8b1105e66494a198975a4361efb5073b2fc29c263e0e7fc5bec564526254</sum>
        </package>
        <package name="postgresql-pltcl" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">19d44acb10d4e6f094bf962f100cdcbedbf9a39d6f7e6d27b273fd36632deb76</sum>
        </package>
        <package name="postgresql-plpython3" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d7c1c54015ec1fcdeca475bda78759126cfc0bc999ec987ef7839e4479009594</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3a31766ef382f27e2be14c99e2c7c45d0a917b411c45ccaaa1f1952cf9888a35</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4705</id>
    <title>Moderate: nginx security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1642" id="CVE-2026-1642" type="cve" title="CVE-2026-1642" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436738" id="2436738" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4705" id="RLSA-2026:4705" type="self" title="RLSA-2026:4705" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nginx-mod-http-xslt-filter" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1245899ba7ad291912e9abbefcfab5051f2d7c02fe0e08beaa7c848585a95ff6</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">79ed29bcacacd9cc33577d07d5654293e4b03969d366b769d5af1283c0520f7f</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">2e48093d794898fb1642f0bb71e0ef1f0e0e446a3654319b193ad44620e105ff</sum>
        </package>
        <package name="nginx-mod-stream" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">08b1d78906f5725ecb656dc0317a87ed7e9d51b556f5b73139f7017bf0e3085b</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">51c827dc857a5f2dc68124427eb572d3e802a0af24a5fb2c4b6b35040035659c</sum>
        </package>
        <package name="nginx-mod-mail" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0d9b8752c08fb14080841d06a1b7243f98230fe0b615016896a8212cd083e2d2</sum>
        </package>
        <package name="nginx-core" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a1a7a39344ed304e03a325ec01e44f7feaf357d15c14d44fe8aaafaa907aa6d7</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">181b674c0cd77cd494499242f41b59c06a0b49baa0cbdc38f09807c1f0e6723d</sum>
        </package>
        <package name="nginx" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1" src="nginx-1.26.3-2.el10_1.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f14d0bfea2780e22ad1bacd739107101822d86dde3c90e8add5e02957f3dc924</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5145</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5145" id="RLSA-2026:5145" type="self" title="RLSA-2026:5145" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="aarch64" epoch="0" version="0.2.3" release="4.el10_1" src="yggdrasil-worker-package-manager-0.2.3-4.el10_1.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-4.el10_1.aarch64.rpm</filename>
          <sum type="sha256">246b954da435b72e9a163a34d5bce7e5e29e71e9b17e121f7fe0c01f770b2eb0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5146</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-03-27 12:07:50" />
    <updated date="2026-04-10 12:09:40" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5146" id="RLSA-2026:5146" type="self" title="RLSA-2026:5146" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil" arch="aarch64" epoch="0" version="0.4.8" release="3.el10_1" src="yggdrasil-0.4.8-3.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">80f80e5c062362444f79e134444dd1d04b4460991a59b9f5f7e1c52f24bffdaf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7672</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5731" id="CVE-2026-5731" type="cve" title="CVE-2026-5731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5732" id="CVE-2026-5732" type="cve" title="CVE-2026-5732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5734" id="CVE-2026-5734" type="cve" title="CVE-2026-5734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455897" id="2455897" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455908" id="2455908" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455901" id="2455901" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7672" id="RLSA-2026:7672" type="self" title="RLSA-2026:7672" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.9.1" release="1.el10_1" src="firefox-140.9.1-1.el10_1.src.rpm">
          <filename>firefox-140.9.1-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a94b88a147798343a25ba310f86681ea531d8504fe2dca9e2a2b2feccfbe4404</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7680</id>
    <title>Important: perl-XML-Parser security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-XML-Parser.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then used to parse the document. Expat options may be provided when the XML::Parser object is created. These options are then passed on to the Expat object on each parse call. They can also be given as extra arguments to the parse methods, in which case they override options given at XML::Parser creation time.

Security Fix(es):

* perl-xml-parser: XML::Parser: Memory corruption via deeply nested XML files (CVE-2006-10003)

* perl-xml-parser: XML::Parser for Perl: Heap corruption and denial of service from crafted XML input (CVE-2006-10002)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10002" id="CVE-2006-10002" type="cve" title="CVE-2006-10002" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-10003" id="CVE-2006-10003" type="cve" title="CVE-2006-10003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448999" id="2448999" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449001" id="2449001" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7680" id="RLSA-2026:7680" type="self" title="RLSA-2026:7680" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl-XML-Parser" arch="aarch64" epoch="0" version="2.47" release="6.1.el10_1" src="perl-XML-Parser-2.47-6.1.el10_1.src.rpm">
          <filename>perl-XML-Parser-2.47-6.1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">61d5c94b050a2880010a9fd4a7af46e22b4346c9ef5834ebbd002c047739f8e6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7675</id>
    <title>Important: nodejs24 security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Nodejs denial of service (CVE-2026-21637)

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

* undici: Undici: Denial of Service due to uncontrolled resource consumption (CVE-2026-2581)

* undici: Undici: HTTP header injection and request smuggling vulnerability (CVE-2026-1527)

* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

* Node.js: Node.js: Denial of Service via malformed Internationalized Domain Name processing (CVE-2026-21712)

* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

* Node.js: Node.js: Information disclosure due to `fs.realpathSync.native()` bypassing filesystem read restrictions (CVE-2026-21715)

* nodejs: Node.js: Permission bypass allows unauthorized modification of file permissions and ownership via incomplete security fix. (CVE-2026-21716)

* Node.js: Node.js: Unauthorized inter-process communication due to missing Unix Domain Socket permission checks (CVE-2026-21711)

* Node.js: Node.js: Information disclosure via timing oracle in HMAC verification (CVE-2026-21713)

* Node.js: Node.js: Memory leak and Denial of Service via crafted HTTP/2 WINDOW_UPDATE frames (CVE-2026-21714)

* nodejs: v8: Node.js: Denial of Service via V8 string hashing mechanism due to predictable hash collisions (CVE-2026-21717)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1525" id="CVE-2026-1525" type="cve" title="CVE-2026-1525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1526" id="CVE-2026-1526" type="cve" title="CVE-2026-1526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1527" id="CVE-2026-1527" type="cve" title="CVE-2026-1527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1528" id="CVE-2026-1528" type="cve" title="CVE-2026-1528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21637" id="CVE-2026-21637" type="cve" title="CVE-2026-21637" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21710" id="CVE-2026-21710" type="cve" title="CVE-2026-21710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21711" id="CVE-2026-21711" type="cve" title="CVE-2026-21711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21712" id="CVE-2026-21712" type="cve" title="CVE-2026-21712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21713" id="CVE-2026-21713" type="cve" title="CVE-2026-21713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21714" id="CVE-2026-21714" type="cve" title="CVE-2026-21714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21715" id="CVE-2026-21715" type="cve" title="CVE-2026-21715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21716" id="CVE-2026-21716" type="cve" title="CVE-2026-21716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21717" id="CVE-2026-21717" type="cve" title="CVE-2026-21717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2229" id="CVE-2026-2229" type="cve" title="CVE-2026-2229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25547" id="CVE-2026-25547" type="cve" title="CVE-2026-25547" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2581" id="CVE-2026-2581" type="cve" title="CVE-2026-2581" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26996" id="CVE-2026-26996" type="cve" title="CVE-2026-26996" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135" id="CVE-2026-27135" type="cve" title="CVE-2026-27135" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453162" id="2453162" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447142" id="2447142" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453160" id="2453160" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447144" id="2447144" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447140" id="2447140" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453161" id="2453161" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436942" id="2436942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453151" id="2453151" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453037" id="2453037" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447141" id="2447141" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453158" id="2453158" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453157" id="2453157" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453152" id="2453152" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2441268" id="2441268" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448754" id="2448754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447143" id="2447143" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431340" id="2431340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447145" id="2447145" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7675" id="RLSA-2026:7675" type="self" title="RLSA-2026:7675" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nodejs24-devel" arch="aarch64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-devel-24.14.1-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">220261467073a6b41cd65e53dd00c2396d88e5b391d11b6ffdb4787659651088</sum>
        </package>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-docs-24.14.1-2.el10_1.noarch.rpm</filename>
          <sum type="sha256">ddbec5004cc902972469c329b9376ecdba0d2394339a57df343f4248be51ac78</sum>
        </package>
        <package name="nodejs24" arch="aarch64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-24.14.1-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f887344b37337a1aa1316a217ff98e60a74696235f74d5ec32d75178e4d7863c</sum>
        </package>
        <package name="nodejs24-full-i18n" arch="aarch64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-full-i18n-24.14.1-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c2cd173aca34721a2e3ea84820ada77c6c030f19439ec2379ea1553a0baba3ed</sum>
        </package>
        <package name="nodejs24-libs" arch="aarch64" epoch="1" version="24.14.1" release="2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-libs-24.14.1-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ac7387ac8789d744c7156e2fe0f8a6146c93e43659265f734553935cc0f5da34</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.11.0" release="1.24.14.1.2.el10_1" src="nodejs24-24.14.1-2.el10_1.src.rpm">
          <filename>nodejs24-npm-11.11.0-1.24.14.1.2.el10_1.noarch.rpm</filename>
          <sum type="sha256">efc7fe76818e6134795e26544413a2fd735ad8ffeca272117f0111c64d2c261e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7992</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7992" id="RLSA-2026:7992" type="self" title="RLSA-2026:7992" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipp-usb" arch="aarch64" epoch="0" version="0.9.27" release="5.el10_1.1" src="golang-github-openprinting-ipp-usb-0.9.27-5.el10_1.1.src.rpm">
          <filename>ipp-usb-0.9.27-5.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">41bcdc792e3641e1a655c71cecbdfe12382d4c17939121f1aa42c5e3bc021392</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8119</id>
    <title>Important: squid security update</title>
    <issued date="2026-04-15 12:07:10" />
    <updated date="2026-04-29 12:08:58" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for squid.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects.

Security Fix(es):

* squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)

* Squid: Squid: Denial of Service via crafted ICP traffic (CVE-2026-32748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32748" id="CVE-2026-32748" type="cve" title="CVE-2026-32748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33526" id="CVE-2026-33526" type="cve" title="CVE-2026-33526" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451574" id="2451574" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451577" id="2451577" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8119" id="RLSA-2026:8119" type="self" title="RLSA-2026:8119" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="squid" arch="aarch64" epoch="7" version="6.10" release="6.el10_1.3" src="squid-6.10-6.el10_1.3.src.rpm">
          <filename>squid-6.10-6.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">beb689b99a645e39c328b2751b89d6721fffb38b01640f626458ecc85f88ea8d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7005</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-04-10 12:07:15" />
    <updated date="2026-04-24 12:08:46" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7005" id="RLSA-2026:7005" type="self" title="RLSA-2026:7005" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git-lfs" arch="aarch64" epoch="0" version="3.6.1" release="8.el10_1" src="git-lfs-3.6.1-8.el10_1.src.rpm">
          <filename>git-lfs-3.6.1-8.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0fdd8a5904bbd7dc5d3e4d89a53e98c009213a3f16c5db83a21718361fa99750</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7081</id>
    <title>Moderate: libtiff security update</title>
    <issued date="2026-04-10 12:07:15" />
    <updated date="2026-04-24 12:08:46" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: Segment fault in libtiff  in TIFFReadRGBATileExt() leading to denial of service (CVE-2023-52356)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52356" id="CVE-2023-52356" type="cve" title="CVE-2023-52356" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2251344" id="2251344" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7081" id="RLSA-2026:7081" type="self" title="RLSA-2026:7081" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libtiff-devel" arch="aarch64" epoch="0" version="4.6.0" release="6.el10_1.2" src="libtiff-4.6.0-6.el10_1.2.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">1689e4ae79837e798e0ff1e6e94035675487f6d3f2faa668c1665a797f4aa230</sum>
        </package>
        <package name="libtiff" arch="aarch64" epoch="0" version="4.6.0" release="6.el10_1.2" src="libtiff-4.6.0-6.el10_1.2.src.rpm">
          <filename>libtiff-4.6.0-6.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">362a5e6080cf5be5810b39d8eaf1a27532ffb480838c835ff08f99e204df87b3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8458</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* FreeRDP: FreeRDP: Heap buffer overflow allows arbitrary code execution via crafted pixel data (CVE-2026-33984)

* FreeRDP: FreeRDP: Denial of Service via specially crafted Remote Desktop Protocol messages (CVE-2026-33983)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33983" id="CVE-2026-33983" type="cve" title="CVE-2026-33983" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33984" id="CVE-2026-33984" type="cve" title="CVE-2026-33984" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453220" id="2453220" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453219" id="2453219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8458" id="RLSA-2026:8458" type="self" title="RLSA-2026:8458" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.6.aarch64.rpm</filename>
          <sum type="sha256">0c816496e69bdf272fb87a69e90fa78198f235c0cb875f9149f136fc7d55d51a</sum>
        </package>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.6.aarch64.rpm</filename>
          <sum type="sha256">34b8a545bb269f8361ac27b430863eaf8831f7b0cdb038b5c50da05e98a2d7cf</sum>
        </package>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.6" src="freerdp-3.10.3-5.el10_1.6.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.6.aarch64.rpm</filename>
          <sum type="sha256">cddf2a801be32f795e0d7a64ced38b980a9e7e4834e7b4c3940a03f0a99e7bd9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8470</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.126 and .NET Runtime 8.0.26.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8470" id="RLSA-2026:8470" type="self" title="RLSA-2026:8470" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">cae1880448c129b7792339c17855a2e6158aa5a7723efceca8ecefd656fcd842</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">362b8b0fe1e19c2702ad04d835760d9d8e1bf4a278299c850ad66cea23ac426b</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">765a6c27325478cd63540c41725d7ccc9cac6b6f0344c40b096d67f60b34a424</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.126-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">037eae0b6632afdbd5fc2f2c79579b86f33d0da9dac692157d638ec23a9d5412</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">bca51b352ab4d51b77327643c182d7ae7a9b116ba044dabd5efdeef3f88c8ccf</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1560203cd12842ec4ee66942a646639c88a30b56ca9ff6a5f9e3f5c72ce0f197</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.126-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ed617b28ae38347fd22c5ac7f6b1c9dacc55cd96ce35dcb7f7301ba9201a13ea</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6ca556c4c1a26616f3c082c184f0936d24cc13c9072ac142f557c92cc97ca42d</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8f705ce6ecd8429ae64af7f60bb141c10f1c68f94b0708edeb19b6ea684f38a4</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.126" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>dotnet-templates-8.0-8.0.126-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f2694ff66b2e600e8806898007f630f320089e2e194d45d3fb933b64ea290acc</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.26" release="1.el10_1" src="dotnet8.0-8.0.126-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.26-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">51acfb9eae864b6795470cb904ccc690e0bd335ba18f97385f6d0110d052c5cb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8472</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.116 and .NET Runtime 9.0.15.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8472" id="RLSA-2026:8472" type="self" title="RLSA-2026:8472" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-templates-9.0-9.0.116-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">832dc5008eb883ba6861b7826043fab28ecb08796bd0b3c054c2f0b906040a88</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">82ae9cbd593dac1d900a727281196ccbaee67ffa898f0578dce49362714f44f0</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c1ac7fc114cb484884bcf89a8b9d2e8080f848a9da7eb2c9c1acb07b5aac913e</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.116-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2e096f244adf0422bc1b25aec3e03ac01c91124099de83284fdf2952bf5a0187</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">055d92f71d6f87411858d84bd58a24834aedce9e41df07711a7fa34230318cf4</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.116-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c6f90836b06bf9e43b9615e1c36c2fea6f4d3c384df14cef0f6a9655faa7c669</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0639a78979ec6008489561b784d8e10f077b31c26010ff56632d420b8ba74181</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9fe6e16a6eac4a1595080420c1f53cfec1cabe0a5d320d57f8890f4947eeb75d</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b3b698eee5f6df967104365c395e26d0cdb20dbfcc4b65306bbd65258fcbd57f</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6fcdd811f5e6ad9fa3b297ce4458eda0d2cb2c1e59bdc2b9dab057c170e291bb</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.15" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.15-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">34c9bd436b506a4d592e8cffdedfa1984da2039ac4cb0af19ea45961d8d40847</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.116-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">833be648aff8fd3b80cf86411fff37cd5845c7cd468f721fd94845acd8c13af3</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.116" release="1.el10_1" src="dotnet9.0-9.0.116-1.el10_1.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.116-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9ddceb4ce5590a2c1eef6114df8368544de7576c1681fd9a0e260c6dd14fbadb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5931</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4684" id="CVE-2026-4684" type="cve" title="CVE-2026-4684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4685" id="CVE-2026-4685" type="cve" title="CVE-2026-4685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4686" id="CVE-2026-4686" type="cve" title="CVE-2026-4686" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4687" id="CVE-2026-4687" type="cve" title="CVE-2026-4687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4688" id="CVE-2026-4688" type="cve" title="CVE-2026-4688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4689" id="CVE-2026-4689" type="cve" title="CVE-2026-4689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4690" id="CVE-2026-4690" type="cve" title="CVE-2026-4690" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4691" id="CVE-2026-4691" type="cve" title="CVE-2026-4691" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4692" id="CVE-2026-4692" type="cve" title="CVE-2026-4692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4693" id="CVE-2026-4693" type="cve" title="CVE-2026-4693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4694" id="CVE-2026-4694" type="cve" title="CVE-2026-4694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4695" id="CVE-2026-4695" type="cve" title="CVE-2026-4695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4696" id="CVE-2026-4696" type="cve" title="CVE-2026-4696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4697" id="CVE-2026-4697" type="cve" title="CVE-2026-4697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4698" id="CVE-2026-4698" type="cve" title="CVE-2026-4698" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4699" id="CVE-2026-4699" type="cve" title="CVE-2026-4699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4700" id="CVE-2026-4700" type="cve" title="CVE-2026-4700" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4701" id="CVE-2026-4701" type="cve" title="CVE-2026-4701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4702" id="CVE-2026-4702" type="cve" title="CVE-2026-4702" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4704" id="CVE-2026-4704" type="cve" title="CVE-2026-4704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4705" id="CVE-2026-4705" type="cve" title="CVE-2026-4705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4706" id="CVE-2026-4706" type="cve" title="CVE-2026-4706" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4707" id="CVE-2026-4707" type="cve" title="CVE-2026-4707" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4708" id="CVE-2026-4708" type="cve" title="CVE-2026-4708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4709" id="CVE-2026-4709" type="cve" title="CVE-2026-4709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4710" id="CVE-2026-4710" type="cve" title="CVE-2026-4710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4711" id="CVE-2026-4711" type="cve" title="CVE-2026-4711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4712" id="CVE-2026-4712" type="cve" title="CVE-2026-4712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4713" id="CVE-2026-4713" type="cve" title="CVE-2026-4713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4714" id="CVE-2026-4714" type="cve" title="CVE-2026-4714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4715" id="CVE-2026-4715" type="cve" title="CVE-2026-4715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4716" id="CVE-2026-4716" type="cve" title="CVE-2026-4716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4717" id="CVE-2026-4717" type="cve" title="CVE-2026-4717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4718" id="CVE-2026-4718" type="cve" title="CVE-2026-4718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4719" id="CVE-2026-4719" type="cve" title="CVE-2026-4719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4720" id="CVE-2026-4720" type="cve" title="CVE-2026-4720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4721" id="CVE-2026-4721" type="cve" title="CVE-2026-4721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450733" id="2450733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450741" id="2450741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450744" id="2450744" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450752" id="2450752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450747" id="2450747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450738" id="2450738" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450710" id="2450710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450755" id="2450755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450725" id="2450725" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450739" id="2450739" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450726" id="2450726" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450714" id="2450714" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450727" id="2450727" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450723" id="2450723" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450724" id="2450724" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450734" id="2450734" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450748" id="2450748" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450757" id="2450757" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450730" id="2450730" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450713" id="2450713" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450711" id="2450711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450719" id="2450719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450729" id="2450729" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450722" id="2450722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450720" id="2450720" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450712" id="2450712" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450718" id="2450718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450751" id="2450751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450735" id="2450735" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450721" id="2450721" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450715" id="2450715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450732" id="2450732" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450742" id="2450742" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450746" id="2450746" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450756" id="2450756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450740" id="2450740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450728" id="2450728" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5931" id="RLSA-2026:5931" type="self" title="RLSA-2026:5931" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.9.0" release="1.el10_1" src="firefox-140.9.0-1.el10_1.src.rpm">
          <filename>firefox-140.9.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4519f9d7d3b0075f11f28bf12f39f7e65624496f8db992ea2c5faf368a85931e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:5941</id>
    <title>Important: golang security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61731" id="CVE-2025-61731" type="cve" title="CVE-2025-61731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434433" id="2434433" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:5941" id="RLSA-2026:5941" type="self" title="RLSA-2026:5941" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-race-1.25.8-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">77fac22d558d5bf5f7b5f22a6632d07f0193bbade56b8825b55c1972bf1d294f</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-docs-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">827d2ee8ef54c00bb4f8440cdcfb6108a00df6f0131c46153600b63e90f61903</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-1.25.8-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5da88df319459e9f67336a83871a1f49f911531db9464b2dce85490adcc3d371</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>go-toolset-1.25.8-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ca1c2595861d69b72e84e7f3057e86d7d2519a1b033add92d5a958b04304327d</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-bin-1.25.8-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">e4b2dd4e3b580a105c34c0e410ef2497136399eb794a46d818f4737ae03da2fd</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-tests-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">db3ff67272fcaf8c30871aa3c5e138379325eaf9acb04905b84eb2e7ed68db4b</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-misc-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fc08056daced4942367d12f1740d6eb3537d643175a8a7a443a4ea76dc5195e4</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.8" release="1.el10_1" src="golang-1.25.8-1.el10_1.src.rpm">
          <filename>golang-src-1.25.8-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">e5958f50c1ecb5d498b5fd89b07951b2dc97e9b4f8975f25537fb7f9a97136be</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6259</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

* GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

* GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

* GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

* GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447496" id="2447496" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447492" id="2447492" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447495" id="2447495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447498" id="2447498" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447503" id="2447503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447490" id="2447490" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447500" id="2447500" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6259" id="RLSA-2026:6259" type="self" title="RLSA-2026:6259" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gstreamer1-plugins-ugly-free" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-ugly-free-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.24.11-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6093dae01bd2e4dc6af047a50c0332093f298e9ceb28d7ae8b9f91e7e8bc7d83</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" arch="aarch64" epoch="0" version="1.24.11" release="3.el10_1" src="gstreamer1-plugins-bad-free-1.24.11-3.el10_1.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.24.11-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">078556fe86fc229b57f598071b956e975a214f2dae6cfcd80c87374fc1199b15</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.24.11-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">666ae10f5e8d2873228aa31fb2bd90ae492ee10379a388243efe864ade4b34ab</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="aarch64" epoch="0" version="1.24.11" release="3.el10_1" src="gstreamer1-plugins-bad-free-1.24.11-3.el10_1.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.24.11-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">cb3b342b8bc4b237bde89d3f589dce9660fe662e21cff71764312427181b96d9</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-good-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-good-1.24.11-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9b21919264690893c53147bbb8e0294cde2f0396789318c7b760ade0b4570db6</sum>
        </package>
        <package name="gstreamer1-plugins-base-devel" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.24.11-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ab67cb55b0a67dcc84cca8463d95a657c5e0dd6ce1aa0295e925fa21f1d5417c</sum>
        </package>
        <package name="gstreamer1-plugins-base" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-base-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-base-1.24.11-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0ab9d426a879482704a659ff10dfaf428690f6d2be55c018f7376a4fc244000f</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_1" src="gstreamer1-plugins-good-1.24.11-2.el10_1.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.24.11-2.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5e4912d067146ba1123c959e6530d75529af378931f9de70c5ea16a6b11b4b0f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6342</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4721)

* firefox: thunderbird: Privilege escalation in the Netmonitor component (CVE-2026-4717)

* firefox: thunderbird: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-4688)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4706)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4695)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4689)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component (CVE-2026-4698)

* firefox: thunderbird: Incorrect boundary conditions, uninitialized memory in the JavaScript Engine component (CVE-2026-4716)

* firefox: thunderbird: Race condition, use-after-free in the Graphics: WebRender component (CVE-2026-4684)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4705)

* firefox: thunderbird: Uninitialized memory in the Graphics: Canvas2D component (CVE-2026-4715)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4685)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4714)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: GMP component (CVE-2026-4709)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video component (CVE-2026-4710)

* firefox: thunderbird: Information disclosure in the Widget: Cocoa component (CVE-2026-4712)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-4697)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4713)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions, integer overflow in the XPCOM component (CVE-2026-4690)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-4711)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4686)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics component (CVE-2026-4708)

* firefox: thunderbird: Use-after-free in the CSS Parsing and Computation component (CVE-2026-4691)

* firefox: thunderbird: Incorrect boundary conditions in the Layout: Text and Fonts component (CVE-2026-4699)

* firefox: thunderbird: Use-after-free in the Layout: Text and Fonts component (CVE-2026-4696)

* firefox: thunderbird: Incorrect boundary conditions in the Audio/Video: Playback component (CVE-2026-4693)

* firefox: thunderbird: Undefined behavior in the WebRTC: Signaling component (CVE-2026-4718)

* firefox: thunderbird: JIT miscompilation in the JavaScript Engine component (CVE-2026-4702)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Text component (CVE-2026-4719)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics component (CVE-2026-4694)

* firefox: thunderbird: Sandbox escape in the Responsive Design Mode component (CVE-2026-4692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.9, Thunderbird ESR 140.9, Firefox 149 and Thunderbird 149 (CVE-2026-4720)

* firefox: thunderbird: Mitigation bypass in the Networking: HTTP component (CVE-2026-4700)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: Canvas2D component (CVE-2026-4707)

* firefox: thunderbird: Denial-of-service in the WebRTC: Signaling component (CVE-2026-4704)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Telemetry component (CVE-2026-4687)

* thunderbird: Out of bounds read in IMAP parsing (CVE-2026-4371)

* thunderbird: Spoofing issue in Thunderbird (CVE-2026-3889)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3889" id="CVE-2026-3889" type="cve" title="CVE-2026-3889" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4371" id="CVE-2026-4371" type="cve" title="CVE-2026-4371" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4684" id="CVE-2026-4684" type="cve" title="CVE-2026-4684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4685" id="CVE-2026-4685" type="cve" title="CVE-2026-4685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4686" id="CVE-2026-4686" type="cve" title="CVE-2026-4686" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4687" id="CVE-2026-4687" type="cve" title="CVE-2026-4687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4688" id="CVE-2026-4688" type="cve" title="CVE-2026-4688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4689" id="CVE-2026-4689" type="cve" title="CVE-2026-4689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4690" id="CVE-2026-4690" type="cve" title="CVE-2026-4690" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4691" id="CVE-2026-4691" type="cve" title="CVE-2026-4691" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4692" id="CVE-2026-4692" type="cve" title="CVE-2026-4692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4693" id="CVE-2026-4693" type="cve" title="CVE-2026-4693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4694" id="CVE-2026-4694" type="cve" title="CVE-2026-4694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4695" id="CVE-2026-4695" type="cve" title="CVE-2026-4695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4696" id="CVE-2026-4696" type="cve" title="CVE-2026-4696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4697" id="CVE-2026-4697" type="cve" title="CVE-2026-4697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4698" id="CVE-2026-4698" type="cve" title="CVE-2026-4698" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4699" id="CVE-2026-4699" type="cve" title="CVE-2026-4699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4700" id="CVE-2026-4700" type="cve" title="CVE-2026-4700" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4701" id="CVE-2026-4701" type="cve" title="CVE-2026-4701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4702" id="CVE-2026-4702" type="cve" title="CVE-2026-4702" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4704" id="CVE-2026-4704" type="cve" title="CVE-2026-4704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4705" id="CVE-2026-4705" type="cve" title="CVE-2026-4705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4706" id="CVE-2026-4706" type="cve" title="CVE-2026-4706" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4707" id="CVE-2026-4707" type="cve" title="CVE-2026-4707" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4708" id="CVE-2026-4708" type="cve" title="CVE-2026-4708" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4709" id="CVE-2026-4709" type="cve" title="CVE-2026-4709" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4710" id="CVE-2026-4710" type="cve" title="CVE-2026-4710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4711" id="CVE-2026-4711" type="cve" title="CVE-2026-4711" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4712" id="CVE-2026-4712" type="cve" title="CVE-2026-4712" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4713" id="CVE-2026-4713" type="cve" title="CVE-2026-4713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4714" id="CVE-2026-4714" type="cve" title="CVE-2026-4714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4715" id="CVE-2026-4715" type="cve" title="CVE-2026-4715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4716" id="CVE-2026-4716" type="cve" title="CVE-2026-4716" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4717" id="CVE-2026-4717" type="cve" title="CVE-2026-4717" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4718" id="CVE-2026-4718" type="cve" title="CVE-2026-4718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4719" id="CVE-2026-4719" type="cve" title="CVE-2026-4719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4720" id="CVE-2026-4720" type="cve" title="CVE-2026-4720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4721" id="CVE-2026-4721" type="cve" title="CVE-2026-4721" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450733" id="2450733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450741" id="2450741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450744" id="2450744" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450752" id="2450752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450747" id="2450747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450738" id="2450738" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450710" id="2450710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450755" id="2450755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450725" id="2450725" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450739" id="2450739" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450726" id="2450726" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450714" id="2450714" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450727" id="2450727" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450723" id="2450723" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450724" id="2450724" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451006" id="2451006" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450734" id="2450734" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450748" id="2450748" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450757" id="2450757" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450730" id="2450730" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450713" id="2450713" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450711" id="2450711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450719" id="2450719" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451001" id="2451001" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450729" id="2450729" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450722" id="2450722" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450720" id="2450720" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450712" id="2450712" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450718" id="2450718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450751" id="2450751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450735" id="2450735" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450721" id="2450721" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450715" id="2450715" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450732" id="2450732" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450742" id="2450742" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450746" id="2450746" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450756" id="2450756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450740" id="2450740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450728" id="2450728" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6342" id="RLSA-2026:6342" type="self" title="RLSA-2026:6342" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.9.0" release="1.el10_1" src="thunderbird-140.9.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.9.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">464613117edee219e3389e8f05c28dda67e70af911f80ecb533454b5d9af36d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6344</id>
    <title>Important: grafana security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6344" id="RLSA-2026:6344" type="self" title="RLSA-2026:6344" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="23.el10_1" src="grafana-10.2.6-23.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-23.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fdbc398a27590656ae3db1d34d70178d7cd189acb123a8373e1857080b004e17</sum>
        </package>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="23.el10_1" src="grafana-10.2.6-23.el10_1.src.rpm">
          <filename>grafana-10.2.6-23.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fdd54ce5cc8325095540a5668892776ae1c94a9419f100fd270f85fa263b7534</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6388</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6388" id="RLSA-2026:6388" type="self" title="RLSA-2026:6388" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-pcp" arch="aarch64" epoch="0" version="5.3.0" release="3.el10_1" src="grafana-pcp-5.3.0-3.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c64be16c501bb97a125ddf8c2cf56f5e9eeab97ad538ca47f5bd0b7b476ce765</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6622</id>
    <title>Moderate: crun security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for crun.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>crun is a OCI runtime

Security Fix(es):

* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30892" id="CVE-2026-30892" type="cve" title="CVE-2026-30892" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451576" id="2451576" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6622" id="RLSA-2026:6622" type="self" title="RLSA-2026:6622" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="crun" arch="aarch64" epoch="0" version="1.27" release="1.el10_1" src="crun-1.27-1.el10_1.src.rpm">
          <filename>crun-1.27-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6dae1e917881377c35bdf98203466e1e74729cea1448b5a530ca5812e7aef7f6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6799</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP heap-use-after-free (CVE-2026-22856)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22854)

* freerdp: FreeRDP heap-buffer-overflow (CVE-2026-22852)

* freerdp: FreeRDP: Denial of Service via FastGlyph parsing buffer overflow (CVE-2026-23732)

* freerdp: FreeRDP: Denial of Service via use-after-free in AUDIN format renegotiation (CVE-2026-24676)

* freerdp: FreeRDP has a heap-use-after-free in video_timer (CVE-2026-24491)

* freerdp: FreeRDP has a NULL Pointer Dereference in rdp_write_logon_info_v2() (CVE-2026-23948)

* freerdp: FreeRDP has a Heap-use-after-free in play_thread (CVE-2026-24684)

* freerdp: FreeRDP has a heap-use-after-free in urb_bulk_transfer_cb (CVE-2026-24681)

* freerdp: FreeRDP has a Heap-buffer-overflow in audio_formats_free (CVE-2026-24682)

* freerdp: FreeRDP has a heap-use-after-free in ainput_send_input_event (CVE-2026-24683)

* freerdp: FreeRDP has a heap-buffer-overflow in urb_select_interface (CVE-2026-24679)

* freerdp: FreeRDP has a Heap-use-after-free in urb_select_interface (CVE-2026-24675)

* freerdp: FreeRDP: Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages (CVE-2026-31806)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22852" id="CVE-2026-22852" type="cve" title="CVE-2026-22852" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22854" id="CVE-2026-22854" type="cve" title="CVE-2026-22854" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22856" id="CVE-2026-22856" type="cve" title="CVE-2026-22856" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23732" id="CVE-2026-23732" type="cve" title="CVE-2026-23732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23948" id="CVE-2026-23948" type="cve" title="CVE-2026-23948" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24491" id="CVE-2026-24491" type="cve" title="CVE-2026-24491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24675" id="CVE-2026-24675" type="cve" title="CVE-2026-24675" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24676" id="CVE-2026-24676" type="cve" title="CVE-2026-24676" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24679" id="CVE-2026-24679" type="cve" title="CVE-2026-24679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24681" id="CVE-2026-24681" type="cve" title="CVE-2026-24681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24682" id="CVE-2026-24682" type="cve" title="CVE-2026-24682" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24683" id="CVE-2026-24683" type="cve" title="CVE-2026-24683" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24684" id="CVE-2026-24684" type="cve" title="CVE-2026-24684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31806" id="CVE-2026-31806" type="cve" title="CVE-2026-31806" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438207" id="2438207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429652" id="2429652" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438217" id="2438217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429654" id="2429654" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438216" id="2438216" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2430881" id="2430881" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438202" id="2438202" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438221" id="2438221" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447376" id="2447376" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2429650" id="2429650" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438201" id="2438201" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438212" id="2438212" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438210" id="2438210" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2438208" id="2438208" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6799" id="RLSA-2026:6799" type="self" title="RLSA-2026:6799" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">e8183e7868aaadd76e4ef168defd9ec92bb64f7994503e8b5df6f820cd49f03a</sum>
        </package>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">023c41d81e437ab7dbafc36a7318f4067c2e9bfb7be095a4f2bc85264d56e7e4</sum>
        </package>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.5" src="freerdp-3.10.3-5.el10_1.5.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">03255f67eb6b9f6428883037c46fa3f312b8c7f67a8ff0e519e20a9bf239cf80</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6817</id>
    <title>Important: capstone security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for capstone.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community.

Security Fix(es):

* capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114)

* capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution. (CVE-2025-67873)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67873" id="CVE-2025-67873" type="cve" title="CVE-2025-67873" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68114" id="CVE-2025-68114" type="cve" title="CVE-2025-68114" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423416" id="2423416" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2423419" id="2423419" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6817" id="RLSA-2026:6817" type="self" title="RLSA-2026:6817" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="capstone" arch="aarch64" epoch="0" version="5.0.1" release="7.el10_1" src="capstone-5.0.1-7.el10_1.src.rpm">
          <filename>capstone-5.0.1-7.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5b7be214e38afebe8aa099c814028cb748d00ab0aa59fcc93383301b98151139</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:6906</id>
    <title>Important: nginx security update</title>
    <issued date="2026-04-09 12:07:05" />
    <updated date="2026-04-23 12:09:01" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647)

* NGINX: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module (CVE-2026-27654)

* NGINX: NGINX: Denial of Service due to memory corruption via crafted MP4 file (CVE-2026-27784)

* NGINX: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled (CVE-2026-27651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27651" id="CVE-2026-27651" type="cve" title="CVE-2026-27651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27654" id="CVE-2026-27654" type="cve" title="CVE-2026-27654" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27784" id="CVE-2026-27784" type="cve" title="CVE-2026-27784" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32647" id="CVE-2026-32647" type="cve" title="CVE-2026-32647" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450776" id="2450776" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450791" id="2450791" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449598" id="2449598" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450785" id="2450785" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:6906" id="RLSA-2026:6906" type="self" title="RLSA-2026:6906" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">0cf5d43356d16886e4f7d968b477fef07cda8f308e07da83bcade0af8a691d45</sum>
        </package>
        <package name="nginx-mod-stream" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">c4b01108d75f319765cce6f8d0f2163aae4fae06e9d34e2efde49c28ed662263</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.1.noarch.rpm</filename>
          <sum type="sha256">945bf06d1fdc8c45505929a01d6b1ef0a0341bd292a4a118850bbf05d3acdb66</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">6ac3cd1434d322e52288870ff4d2f3b51bdbf2f56af9a1fb52663ede754feed6</sum>
        </package>
        <package name="nginx-core" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">ec864263e3bfbc8f7bcae957a8656aaa43e063a81b05f31392a4653480845a30</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">d65585f056db00cdf8bd541f4ae8fd6dfc35362a0cde80e09a57e14627ab7321</sum>
        </package>
        <package name="nginx" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">119c7bf0a7fdeeef4685febcfadbee458570b07d43b38af5aea9110bd3f1a363</sum>
        </package>
        <package name="nginx-mod-mail" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">54aff26507e108f58f27a1db672ee98b4607926dea3d3b720aebe9d4242d97c3</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.1" src="nginx-1.26.3-2.el10_1.1.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">2434b28039b71b6a55fa7bc407dee49dc87a001923dd94fac52a3c07fddd9ec7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7682</id>
    <title>Important: openexr security update</title>
    <issued date="2026-04-16 18:06:57" />
    <updated date="2026-04-30 18:08:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* openexr: OpenEXR: Arbitrary code execution via integer overflow in EXR file processing (CVE-2026-27622)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27622" id="CVE-2026-27622" type="cve" title="CVE-2026-27622" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2444251" id="2444251" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7682" id="RLSA-2026:7682" type="self" title="RLSA-2026:7682" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="openexr" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_1.1" src="openexr-3.1.10-8.el10_1.1.src.rpm">
          <filename>openexr-3.1.10-8.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">89568f073538019cc53f3c5b033013f47d26548bd69d9155d9afa20f48b2597a</sum>
        </package>
        <package name="openexr-libs" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_1.1" src="openexr-3.1.10-8.el10_1.1.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">e31418a040e2e927710ab7a7343b69fc987816b9fbebada73e51c8bf3f9a413a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8312</id>
    <title>Important: bind security update</title>
    <issued date="2026-04-16 18:06:57" />
    <updated date="2026-04-30 18:08:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1519" id="CVE-2026-1519" type="cve" title="CVE-2026-1519" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451305" id="2451305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8312" id="RLSA-2026:8312" type="self" title="RLSA-2026:8312" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="bind-utils" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-utils-9.18.33-10.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">e2e2ed81b2560f9cc9bda4a8e2ab5efaf7ba408463579102db98aea2b7c1e45d</sum>
        </package>
        <package name="bind-dnssec-utils" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-10.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">17cd12d5cb7753eea9bb235d76799b5cee41ab8e95449bde8486587c85e55c0e</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-license-9.18.33-10.el10_1.3.noarch.rpm</filename>
          <sum type="sha256">90e75203bd53bc0e6581db642fb9c148b0b20799bcb7cb181ba24b59c5d16611</sum>
        </package>
        <package name="bind-chroot" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-chroot-9.18.33-10.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">22312c13821defbec973a89fca657d1ecda3bf95055c87738a2d42ef922c12d9</sum>
        </package>
        <package name="bind" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-9.18.33-10.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">83cf566f59424cfebf30349f1f071fa58f185ba542582a21a59acf90b95d3568</sum>
        </package>
        <package name="bind-libs" arch="aarch64" epoch="2" version="9.18.33" release="10.el10_1.3" src="bind-9.18.33-10.el10_1.3.src.rpm">
          <filename>bind-libs-9.18.33-10.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">fde145156a4f9b254666b3830b2e387a406d762a7e2190fc759bafd0f3bf8c54</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8467</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-04-18 12:07:14" />
    <updated date="2026-05-02 12:08:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.106 and .NET Runtime 10.0.6.Security Fix(es):

* dotnet: .NET: Security Bypass and Denial of Service Vulnerability (CVE-2026-26171)

* dotnet: .NET: Denial of Service via stack overflow (CVE-2026-32203)

* dotnet: .NET: Denial of Service via Infinite Recursion in XmlDecryptionTransform (CVE-2026-33116)

* dotnet: Dotnet: SMTP Command Injection and Header Injection via MailAddress parsing flaw (CVE-2026-32178)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26171" id="CVE-2026-26171" type="cve" title="CVE-2026-26171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32178" id="CVE-2026-32178" type="cve" title="CVE-2026-32178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32203" id="CVE-2026-32203" type="cve" title="CVE-2026-32203" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33116" id="CVE-2026-33116" type="cve" title="CVE-2026-33116" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457741" id="2457741" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457740" id="2457740" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457781" id="2457781" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457739" id="2457739" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8467" id="RLSA-2026:8467" type="self" title="RLSA-2026:8467" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-apphost-pack-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2eb46385c231da76b236fbc6f80ceceb5a3ca908be52e2fe6f5eaf365ce7bd57</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a6a3365fcda525f5d3729d41b1636a2855527c7a710e90b44e117ad946128f30</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8e6b36677d353e46bd1bd2924024e0fd31bca7267e44e191256721b76701b4d3</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-host-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d2e75b8ea0b01cdb7270855c0a78296b97cec129b04d151d9f8002bd3e67a733</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b645f54de5e8306d76fed2090f88cacc8b1750016ad94466dded658ad7540ac4</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c226d2bc52d1fec114b208e6809811360b7b9c901078ffc6b951fa1f6d4e2a21</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4654e0bbc701658cc198fd0e238537f52c001ff8bb2cd6508c577b6b1211be77</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="aarch64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-templates-10.0-10.0.106-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1e6bdad25509700b3a0dbfe433842ba73dbed8f5bc8ab2f0b0c226f99046a7d1</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" arch="aarch64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.106-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">120c8790da1bd76573d4bfdbb9e53950b27171ae544810f172c2c04336699c97</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">ce677bd541789c8b7b98a62310fae77644c599c8a675df74d879893cdd80ab45</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="aarch64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.106-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">616e44bb261eb338e6c33a855072b2e7adea4d11000b9afdbf74749c5131d7d5</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="aarch64" epoch="0" version="10.0.106" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.106-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">8b698b550089d5e33e2c51c19d03ad75c8d1f05215b5c7ccc17838725c9fc415</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.6" release="1.el10_1" src="dotnet10.0-10.0.106-1.el10_1.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.6-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">676a9581482b9621a4e2182437e9807f761d91c53eb14854200d984e3611da47</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8840</id>
    <title>Important: go-rpm-macros security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-rpm-macros.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides build-stage rpm automation to simplify the creation of Go language (golang) packages.  It does not need to be included in the default build root: go-srpm-macros will pull it in for Go packages only.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8840" id="RLSA-2026:8840" type="self" title="RLSA-2026:8840" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="go-srpm-macros" arch="noarch" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-srpm-macros-3.6.0-8.el10_1.noarch.rpm</filename>
          <sum type="sha256">ff881959d3210ef017fb6dd6a8a138c214d341f70d7e38f34fd4adb6efd956c7</sum>
        </package>
        <package name="go-rpm-macros" arch="aarch64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-rpm-macros-3.6.0-8.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1803cfe064f91a070ab20705303f1d57b562c859297a7116a29e0ead9963d04f</sum>
        </package>
        <package name="go-rpm-templates" arch="aarch64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-rpm-templates-3.6.0-8.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3bd29d1a71e672284c04d8734476a87e701337e6afa704307a61f6b6cae85f0b</sum>
        </package>
        <package name="go-filesystem" arch="aarch64" epoch="0" version="3.6.0" release="8.el10_1" src="go-rpm-macros-3.6.0-8.el10_1.src.rpm">
          <filename>go-filesystem-3.6.0-8.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d40f63098b2360a72e76a940ee3dab504886ab4ebf05d0c0f468af33d4e8407f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8842</id>
    <title>Important: delve security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8842" id="RLSA-2026:8842" type="self" title="RLSA-2026:8842" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="delve" arch="aarch64" epoch="0" version="1.25.2" release="3.el10_1" src="delve-1.25.2-3.el10_1.src.rpm">
          <filename>delve-1.25.2-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6710ef9e294eddedc0cce750e5d79b1b93b2c262b2c4ec50bb4ca4e5785a4a8c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:8858</id>
    <title>Important: giflib security update</title>
    <issued date="2026-04-21 12:07:14" />
    <updated date="2026-05-05 12:09:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for giflib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>giflib is a library for reading and writing gif images.

Security Fix(es):

* giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446207" id="2446207" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:8858" id="RLSA-2026:8858" type="self" title="RLSA-2026:8858" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="giflib" arch="aarch64" epoch="0" version="5.2.1" release="22.el10_1.1" src="giflib-5.2.1-22.el10_1.1.src.rpm">
          <filename>giflib-5.2.1-22.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">15e4f5751ff9a8e89af2051d833742387f3ef223e8038797a01312b4075db446</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:7080</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2026-04-12 06:07:10" />
    <updated date="2026-04-26 06:08:43" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)

* minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996)

* minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904)

* undici: undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression (CVE-2026-1526)

* undici: Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter (CVE-2026-2229)

* undici: Undici: HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers (CVE-2026-1525)

* undici: undici: Denial of Service via crafted WebSocket frame with large length (CVE-2026-1528)

* nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135)

* Node.js: Node.js: Denial of Service due to crafted HTTP `__proto__` header (CVE-2026-21710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1525" id="CVE-2026-1525" type="cve" title="CVE-2026-1525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1526" id="CVE-2026-1526" type="cve" title="CVE-2026-1526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1528" id="CVE-2026-1528" type="cve" title="CVE-2026-1528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21710" id="CVE-2026-21710" type="cve" title="CVE-2026-21710" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2229" id="CVE-2026-2229" type="cve" title="CVE-2026-2229" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25547" id="CVE-2026-25547" type="cve" title="CVE-2026-25547" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26996" id="CVE-2026-26996" type="cve" title="CVE-2026-26996" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27135" id="CVE-2026-27135" type="cve" title="CVE-2026-27135" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27904" id="CVE-2026-27904" type="cve" title="CVE-2026-27904" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447142" id="2447142" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442922" id="2442922" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447144" id="2447144" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2441268" id="2441268" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448754" id="2448754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447143" id="2447143" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2436942" id="2436942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453151" id="2453151" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447145" id="2447145" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:7080" id="RLSA-2026:7080" type="self" title="RLSA-2026:7080" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nodejs-libs" arch="aarch64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-libs-22.22.2-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b31bd700d17261fe7aea41c3c8bea4444f84bb8330fd875007eba359fd8961f3</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-docs-22.22.2-1.el10_1.noarch.rpm</filename>
          <sum type="sha256">fa500ed62f11dffa01482db76251ee423b1cabe3ae9f406e6630204b7aa3949c</sum>
        </package>
        <package name="nodejs-devel" arch="aarch64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-devel-22.22.2-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7bd4908e0275f31cfa694c08d94c86471540c324e617e5d449152fdb5c3bd21e</sum>
        </package>
        <package name="nodejs" arch="aarch64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-22.22.2-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3ecdadff700d751171981b24baf0c2aca33b64653c0d0abf88f979bad410ff75</sum>
        </package>
        <package name="nodejs-npm" arch="aarch64" epoch="1" version="10.9.7" release="1.22.22.2.1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-npm-10.9.7-1.22.22.2.1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">75cd791c8da6e77c525b5e4198f30e7c60d524470bc715bbc69fcce0a7c3985b</sum>
        </package>
        <package name="nodejs-full-i18n" arch="aarch64" epoch="1" version="22.22.2" release="1.el10_1" src="nodejs22-22.22.2-1.el10_1.src.rpm">
          <filename>nodejs-full-i18n-22.22.2-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d0fae2a77a8c6e5e29add39fbcd649e277674e0f9f1c6e6bbf60b7bb4c2fc0ec</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10223</id>
    <title>Important: grafana security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27877" id="CVE-2026-27877" type="cve" title="CVE-2026-27877" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452293" id="2452293" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10223" id="RLSA-2026:10223" type="self" title="RLSA-2026:10223" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="24.el10_1" src="grafana-10.2.6-24.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-24.el10_1.aarch64.rpm</filename>
          <sum type="sha256">40fa6368d5ae0e14ed606e7ab38663799ba57c1f3121a9512f98b55b5406fd27</sum>
        </package>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="24.el10_1" src="grafana-10.2.6-24.el10_1.src.rpm">
          <filename>grafana-10.2.6-24.el10_1.aarch64.rpm</filename>
          <sum type="sha256">76f5c1799fa47efb0e719c00be23af70b050ff73c2a807b29fdce177b5c957d9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10707</id>
    <title>Important: gdk-pixbuf2 security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5201" id="CVE-2026-5201" type="cve" title="CVE-2026-5201" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453291" id="2453291" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10707" id="RLSA-2026:10707" type="self" title="RLSA-2026:10707" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gdk-pixbuf2-devel" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">66f0ddb3a8e7a81cd8744737a3669dd9fc916cdd47544693448d89a5e6f62700</sum>
        </package>
        <package name="gdk-pixbuf2-modules" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">930072744e52e81c5e3401ad09af1375b4c520b0298914a764a2eb8f196bd5f9</sum>
        </package>
        <package name="gdk-pixbuf2" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">d4ca9bca3a7b77219790cf0eb4177bb688fc983f568d7f0816f789c33e83fe96</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10767</id>
    <title>Important: firefox security update</title>
    <issued date="2026-04-28 12:06:44" />
    <updated date="2026-05-12 12:09:36" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

* firefox: thunderbird: Spoofing issue in the DOM: Core &amp; HTML component (CVE-2026-6762)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)

* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

* firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746" id="CVE-2026-6746" type="cve" title="CVE-2026-6746" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747" id="CVE-2026-6747" type="cve" title="CVE-2026-6747" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748" id="CVE-2026-6748" type="cve" title="CVE-2026-6748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749" id="CVE-2026-6749" type="cve" title="CVE-2026-6749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750" id="CVE-2026-6750" type="cve" title="CVE-2026-6750" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751" id="CVE-2026-6751" type="cve" title="CVE-2026-6751" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752" id="CVE-2026-6752" type="cve" title="CVE-2026-6752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753" id="CVE-2026-6753" type="cve" title="CVE-2026-6753" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754" id="CVE-2026-6754" type="cve" title="CVE-2026-6754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757" id="CVE-2026-6757" type="cve" title="CVE-2026-6757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759" id="CVE-2026-6759" type="cve" title="CVE-2026-6759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761" id="CVE-2026-6761" type="cve" title="CVE-2026-6761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762" id="CVE-2026-6762" type="cve" title="CVE-2026-6762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763" id="CVE-2026-6763" type="cve" title="CVE-2026-6763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764" id="CVE-2026-6764" type="cve" title="CVE-2026-6764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765" id="CVE-2026-6765" type="cve" title="CVE-2026-6765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766" id="CVE-2026-6766" type="cve" title="CVE-2026-6766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6767" id="CVE-2026-6767" type="cve" title="CVE-2026-6767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769" id="CVE-2026-6769" type="cve" title="CVE-2026-6769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6770" id="CVE-2026-6770" type="cve" title="CVE-2026-6770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6771" id="CVE-2026-6771" type="cve" title="CVE-2026-6771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6772" id="CVE-2026-6772" type="cve" title="CVE-2026-6772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6776" id="CVE-2026-6776" type="cve" title="CVE-2026-6776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6785" id="CVE-2026-6785" type="cve" title="CVE-2026-6785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6786" id="CVE-2026-6786" type="cve" title="CVE-2026-6786" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460109" id="2460109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460112" id="2460112" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460076" id="2460076" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460075" id="2460075" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460086" id="2460086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460104" id="2460104" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460099" id="2460099" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460106" id="2460106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460094" id="2460094" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460088" id="2460088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460105" id="2460105" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460101" id="2460101" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460092" id="2460092" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460107" id="2460107" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460079" id="2460079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460097" id="2460097" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460078" id="2460078" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460096" id="2460096" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460085" id="2460085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460095" id="2460095" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460102" id="2460102" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460108" id="2460108" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460074" id="2460074" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460110" id="2460110" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460103" id="2460103" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10767" id="RLSA-2026:10767" type="self" title="RLSA-2026:10767" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.10.0" release="1.el10_1" src="firefox-140.10.0-1.el10_1.src.rpm">
          <filename>firefox-140.10.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">39444170e169cd064e97308aa6e6d2c3bdbc03db649f30161fe300993fe2177c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9638</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-04-24 12:06:29" />
    <updated date="2026-05-08 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

* libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5734)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.34.1, Firefox ESR 140.9.1, Thunderbird ESR 140.9.1, Firefox 149.0.2 and Thunderbird 149.0.2 (CVE-2026-5731)

* firefox: thunderbird: Incorrect boundary conditions, integer overflow in the Graphics: Text component (CVE-2026-5732)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5731" id="CVE-2026-5731" type="cve" title="CVE-2026-5731" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5732" id="CVE-2026-5732" type="cve" title="CVE-2026-5732" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5734" id="CVE-2026-5734" type="cve" title="CVE-2026-5734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455897" id="2455897" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455908" id="2455908" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455901" id="2455901" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9638" id="RLSA-2026:9638" type="self" title="RLSA-2026:9638" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.9.1" release="1.el10_1" src="thunderbird-140.9.1-1.el10_1.src.rpm">
          <filename>thunderbird-140.9.1-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">76a6dbcd2a259106f1989df4e985c790b36217e026b8533cfe2a96c44f1ecf6a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9666</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2026-04-24 12:06:29" />
    <updated date="2026-05-08 12:09:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Buffer Over-read in Wireshark (CVE-2026-3203)

* wireshark: Improperly Controlled Sequential Memory Allocation in Wireshark (CVE-2026-3201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3201" id="CVE-2026-3201" type="cve" title="CVE-2026-3201" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3203" id="CVE-2026-3203" type="cve" title="CVE-2026-3203" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442639" id="2442639" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442641" id="2442641" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9666" id="RLSA-2026:9666" type="self" title="RLSA-2026:9666" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="wireshark-cli" arch="aarch64" epoch="1" version="4.4.2" release="4.el10_1.4" src="wireshark-4.4.2-4.el10_1.4.src.rpm">
          <filename>wireshark-cli-4.4.2-4.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">cf08fbe98d2eb27ad6b622e417cb474d2340cbf1c238b7b0aa1826ecdb02d4d1</sum>
        </package>
        <package name="wireshark" arch="aarch64" epoch="1" version="4.4.2" release="4.el10_1.4" src="wireshark-4.4.2-4.el10_1.4.src.rpm">
          <filename>wireshark-4.4.2-4.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">dcd3bbd38fa8320b208e2473fd22aa20c6395413f9cf8ac579e934a8160807d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11352</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)

* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)

* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451106" id="2451106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451109" id="2451109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451113" id="2451113" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11352" id="RLSA-2026:11352" type="self" title="RLSA-2026:11352" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="aarch64" epoch="0" version="24.1.5" release="6.el10_1" src="xorg-x11-server-Xwayland-24.1.5-6.el10_1.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-6.el10_1.aarch64.rpm</filename>
          <sum type="sha256">c79f156860e29e5ae5ee894f1e98947562a3c2882ca0807b73793e707d68183b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11412</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11412" id="RLSA-2026:11412" type="self" title="RLSA-2026:11412" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="aarch64" epoch="0" version="0.2.3" release="5.el10_1" src="yggdrasil-worker-package-manager-0.2.3-5.el10_1.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-5.el10_1.aarch64.rpm</filename>
          <sum type="sha256">00733403c60176ab7acdae8c271ae34eaeb2eda2f2f31a35f7fb88f4be66b8de</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11413</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11413" id="RLSA-2026:11413" type="self" title="RLSA-2026:11413" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil" arch="aarch64" epoch="0" version="0.4.8" release="4.el10_1" src="yggdrasil-0.4.8-4.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-4.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a4174014c769b589f59aa5c452cfc0ecd3262fcd924fc292352b762a694ae19a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:12265</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-01 12:06:42" />
    <updated date="2026-05-15 12:09:35" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450768" id="2450768" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:12265" id="RLSA-2026:12265" type="self" title="RLSA-2026:12265" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libtiff" arch="aarch64" epoch="0" version="4.6.0" release="6.el10_1.3" src="libtiff-4.6.0-6.el10_1.3.src.rpm">
          <filename>libtiff-4.6.0-6.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">58e5a3ef195f4c419ebc06ce2428c75530ed10a28d69bdd1ec1ef65524773a8b</sum>
        </package>
        <package name="libtiff-devel" arch="aarch64" epoch="0" version="4.6.0" release="6.el10_1.3" src="libtiff-4.6.0-6.el10_1.3.src.rpm">
          <filename>libtiff-devel-4.6.0-6.el10_1.3.aarch64.rpm</filename>
          <sum type="sha256">5ab8a67acf21e11c812c4546c9bc5ffcf1a9b22a415e023c8d809fa545870d8f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:10217</id>
    <title>Important: golang security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-20 12:09:21" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

* golang: cmd/compile: no-op interface conversion bypasses overlap checking (CVE-2026-27144)

* cmd/go: golang: Go (golang) and cmd/go: Arbitrary Code Execution via malicious SWIG file names (CVE-2026-27140)

* golang: cmd/compile: possible memory corruption after bound check elimination (CVE-2026-27143)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27140" id="CVE-2026-27140" type="cve" title="CVE-2026-27140" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27143" id="CVE-2026-27143" type="cve" title="CVE-2026-27143" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27144" id="CVE-2026-27144" type="cve" title="CVE-2026-27144" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456341" id="2456341" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456340" id="2456340" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456342" id="2456342" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:10217" id="RLSA-2026:10217" type="self" title="RLSA-2026:10217" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>go-toolset-1.25.9-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">577ff8ee29867a6ee05edb5cbb654163428fcceebdbd2bdaed4aaafff14590d2</sum>
        </package>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-race-1.25.9-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">48ee47611306c3dca393447ca27658233f03024bf058a5e7bbd4e5587433e5ce</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-src-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">c8b2050f6299348f527c137cbaaa7506f9b75b3ab33aa4774466bfb457992552</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-docs-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">d8753380e42606a0653d181ffc42dc2d495e83274148de2507dc155cd7479389</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-misc-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">c558ade72ee5699903008d671f4a6085cff226e0b1ae13bdf4166fd411199d09</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-tests-1.25.9-3.el10_1.noarch.rpm</filename>
          <sum type="sha256">f72d0bbd4d6733ded6f92f86b84d8263eea767ec20aca905e01ad00dc4f77c42</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-1.25.9-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">1adb7e05855a648ee61c854074127999a0ef30eb1aefe57b6638061e261f535e</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.25.9" release="3.el10_1" src="golang-1.25.9-3.el10_1.src.rpm">
          <filename>golang-bin-1.25.9-3.el10_1.aarch64.rpm</filename>
          <sum type="sha256">e9a282cf29ec569f2c7dcde9478cc9b300a01f5aa162c17ee565123705160f23</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11712</id>
    <title>Important: grafana security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-20 12:09:21" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11712" id="RLSA-2026:11712" type="self" title="RLSA-2026:11712" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="25.el10_1" src="grafana-10.2.6-25.el10_1.src.rpm">
          <filename>grafana-selinux-10.2.6-25.el10_1.aarch64.rpm</filename>
          <sum type="sha256">be2e3447ee8d30d327e76d494d5089454e46933a5a95f34ecd6bc32f05594db8</sum>
        </package>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="25.el10_1" src="grafana-10.2.6-25.el10_1.src.rpm">
          <filename>grafana-10.2.6-25.el10_1.aarch64.rpm</filename>
          <sum type="sha256">22a0d8b41c13f326740cc9086d00a7a68bf682c697c6a8a50705566b2252add0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:11881</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-20 12:09:21" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:11881" id="RLSA-2026:11881" type="self" title="RLSA-2026:11881" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-pcp" arch="aarch64" epoch="0" version="5.3.0" release="4.el10_1" src="grafana-pcp-5.3.0-4.el10_1.src.rpm">
          <filename>grafana-pcp-5.3.0-4.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2c18f01648825d5b94660a549a968d87adfecec308cbfeba275b9084da2ad0a0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13498</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-20 12:09:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dovecot.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. 

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452175" id="2452175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452179" id="2452179" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452172" id="2452172" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13498" id="RLSA-2026:13498" type="self" title="RLSA-2026:13498" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dovecot-pgsql" arch="aarch64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-pgsql-2.3.21-16.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">3a444da991bda25e09084c8367b96ffb728568f4dc3564c6cc35396cdabd8f0a</sum>
        </package>
        <package name="dovecot" arch="aarch64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-2.3.21-16.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">9db36a7bd17649a451e1df470efb5f298ad435091d069dc31dfc3eb01aa15884</sum>
        </package>
        <package name="dovecot-pigeonhole" arch="aarch64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-16.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">fecba817e0927f69841402cf934d7a172ba6e4661f953088ae1b18c66b29ae5d</sum>
        </package>
        <package name="dovecot-mysql" arch="aarch64" epoch="1" version="2.3.21" release="16.el10_1.1" src="dovecot-2.3.21-16.el10_1.1.src.rpm">
          <filename>dovecot-mysql-2.3.21-16.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">8326d5a5a03087c007caf171e9e323f4a6e5ab4c80a790984315be2a3e555953</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13515</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-20 12:09:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freeipmi.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.

Security Fix(es):

* freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450778" id="2450778" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13515" id="RLSA-2026:13515" type="self" title="RLSA-2026:13515" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freeipmi-ipmiseld" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7702809ec0f6600d13ed16ba2527f59af95f4d34614ca9908e23d361683e8159</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2b558dadf95bacb83e5323f467775044d3c62b2feb3117314cec0a1bca689f37</sum>
        </package>
        <package name="freeipmi" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4983f8bbb603294a173e76353a3436e158589f5c2fa6eb729d2fa3365764b294</sum>
        </package>
        <package name="freeipmi-ipmidetectd" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9b02a4912cfabb30e86854dff744cf1b0b5a8d83c32b2138347d685f8660ac22</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13641</id>
    <title>Moderate: python-tornado security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-20 12:09:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for python-tornado.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31958" id="CVE-2026-31958" type="cve" title="CVE-2026-31958" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35536" id="CVE-2026-35536" type="cve" title="CVE-2026-35536" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2454716" id="2454716" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446765" id="2446765" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13641" id="RLSA-2026:13641" type="self" title="RLSA-2026:13641" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-tornado" arch="aarch64" epoch="0" version="6.5.5" release="1.el10_1.1" src="python-tornado-6.5.5-1.el10_1.1.src.rpm">
          <filename>python3-tornado-6.5.5-1.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">ff34b3890351071a77f637c6d5a7652331505a2f57aaad650843658340c4d107</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13644</id>
    <title>Moderate: corosync security update</title>
    <issued date="2026-05-06 12:05:16" />
    <updated date="2026-05-20 12:09:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for corosync.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

* corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)

* corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35091" id="CVE-2026-35091" type="cve" title="CVE-2026-35091" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35092" id="CVE-2026-35092" type="cve" title="CVE-2026-35092" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453814" id="2453814" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453813" id="2453813" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13644" id="RLSA-2026:13644" type="self" title="RLSA-2026:13644" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="corosynclib" arch="aarch64" epoch="0" version="3.1.9" release="2.el10_1.1" src="corosync-3.1.9-2.el10_1.1.src.rpm">
          <filename>corosynclib-3.1.9-2.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">52d7d12f6feaf7d8445e89337d5a4fc10c2c74805ab32ad37576cb3b1c715e11</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:12285</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-05-07 12:06:53" />
    <updated date="2026-05-21 12:09:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6772)

* firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-6754)

* firefox: thunderbird: Spoofing issue in the DOM: Core &amp; HTML component (CVE-2026-6762)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6752)

* firefox: thunderbird: Other issue in the Storage: IndexedDB component (CVE-2026-6770)

* firefox: thunderbird: Invalid pointer in the JavaScript: WebAssembly component (CVE-2026-6757)

* firefox: thunderbird: Other issue in the Libraries component in NSS (CVE-2026-6767)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6786)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC component (CVE-2026-6753)

* firefox: thunderbird: Use-after-free in the Widget: Cocoa component (CVE-2026-6759)

* firefox: thunderbird: Use-after-free in the WebRTC component (CVE-2026-6747)

* firefox: thunderbird: Information disclosure due to uninitialized memory in the Graphics: Canvas2D component (CVE-2026-6749)

* firefox: thunderbird: Incorrect boundary conditions in the Libraries component in NSS (CVE-2026-6766)

* firefox: thunderbird: Privilege escalation in the Networking component (CVE-2026-6761)

* firefox: thunderbird: Mitigation bypass in the File Handling component (CVE-2026-6763)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-6750)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6748)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.35, Firefox ESR 140.10, Thunderbird ESR 140.10, Firefox 150 and Thunderbird 150 (CVE-2026-6785)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-6771)

* firefox: thunderbird: Incorrect boundary conditions in the DOM: Device Interfaces component (CVE-2026-6764)

* firefox: thunderbird: Information disclosure in the Form Autofill component (CVE-2026-6765)

* firefox: thunderbird: Privilege escalation in the Debugger component (CVE-2026-6769)

* firefox: thunderbird: Uninitialized memory in the Audio/Video: Web Codecs component (CVE-2026-6751)

* firefox: thunderbird: Incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-6776)

* firefox: thunderbird: Use-after-free in the DOM: Core &amp; HTML component (CVE-2026-6746)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6746" id="CVE-2026-6746" type="cve" title="CVE-2026-6746" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6747" id="CVE-2026-6747" type="cve" title="CVE-2026-6747" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6748" id="CVE-2026-6748" type="cve" title="CVE-2026-6748" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6749" id="CVE-2026-6749" type="cve" title="CVE-2026-6749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6750" id="CVE-2026-6750" type="cve" title="CVE-2026-6750" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6751" id="CVE-2026-6751" type="cve" title="CVE-2026-6751" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6752" id="CVE-2026-6752" type="cve" title="CVE-2026-6752" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6753" id="CVE-2026-6753" type="cve" title="CVE-2026-6753" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6754" id="CVE-2026-6754" type="cve" title="CVE-2026-6754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6757" id="CVE-2026-6757" type="cve" title="CVE-2026-6757" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6759" id="CVE-2026-6759" type="cve" title="CVE-2026-6759" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6761" id="CVE-2026-6761" type="cve" title="CVE-2026-6761" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6762" id="CVE-2026-6762" type="cve" title="CVE-2026-6762" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6763" id="CVE-2026-6763" type="cve" title="CVE-2026-6763" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6764" id="CVE-2026-6764" type="cve" title="CVE-2026-6764" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6765" id="CVE-2026-6765" type="cve" title="CVE-2026-6765" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6766" id="CVE-2026-6766" type="cve" title="CVE-2026-6766" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6767" id="CVE-2026-6767" type="cve" title="CVE-2026-6767" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6769" id="CVE-2026-6769" type="cve" title="CVE-2026-6769" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6770" id="CVE-2026-6770" type="cve" title="CVE-2026-6770" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6771" id="CVE-2026-6771" type="cve" title="CVE-2026-6771" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6772" id="CVE-2026-6772" type="cve" title="CVE-2026-6772" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6776" id="CVE-2026-6776" type="cve" title="CVE-2026-6776" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6785" id="CVE-2026-6785" type="cve" title="CVE-2026-6785" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6786" id="CVE-2026-6786" type="cve" title="CVE-2026-6786" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460109" id="2460109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460112" id="2460112" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460076" id="2460076" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460075" id="2460075" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460086" id="2460086" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460104" id="2460104" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460099" id="2460099" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460106" id="2460106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460094" id="2460094" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460088" id="2460088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460105" id="2460105" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460101" id="2460101" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460092" id="2460092" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460107" id="2460107" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460079" id="2460079" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460097" id="2460097" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460078" id="2460078" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460096" id="2460096" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460085" id="2460085" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460095" id="2460095" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460102" id="2460102" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460108" id="2460108" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460074" id="2460074" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460110" id="2460110" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460103" id="2460103" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:12285" id="RLSA-2026:12285" type="self" title="RLSA-2026:12285" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.10.0" release="1.el10_1" src="thunderbird-140.10.0-1.el10_1.src.rpm">
          <filename>thunderbird-140.10.0-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b6f7cd0500452016bb4d364b407662e867f88a820ae5d3c4ee9cde44d5f04346</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13916</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-05-07 12:06:53" />
    <updated date="2026-05-21 12:09:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30922" id="CVE-2026-30922" type="cve" title="CVE-2026-30922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32597" id="CVE-2026-32597" type="cve" title="CVE-2026-32597" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448553" id="2448553" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447194" id="2447194" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13916" id="RLSA-2026:13916" type="self" title="RLSA-2026:13916" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-lpar-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">981ff44f226405eca95e6de80f296cd96e6d1b4aa44e2add42962d867cb76720</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f2ef46ed7dcc733ea9b38e016f831a1b135f2893c60d14eb562e4e4a6da73d17</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">1fab49a737ba68c2d3077e671b149205440fa5382d881d812652b39ef6b47329</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rsa-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">1490f943d5a44cf0007134f184c9795fcd14ebe6b5ad11944a9af07dabaf36b2</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5bae7f51f65347a95f2ecfbf3966ede1047342b13c1a13328f4d43de4fcbf5db</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f1777031e8cc51d50ad0e0c15ea32088bfae61dcffc4936d5497504cdbe6fa90</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">e6a389f09ec2978e64f892d7503d2a80e3754d02607463515c891bedabd045f5</sum>
        </package>
        <package name="fence-agents-kdump" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-kdump-4.16.0-13.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">c02860e85bfb2e010d9054ba761b62d023a3c373510f0c1aa16b91df71639dba</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-mpath-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9061470a51469ddd08a181189747e894f7bda0c5588ba853bc0eaf8e232043b8</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-eps-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">2ced8e456e9e92ffb16fb6294dc77efaac9063b8ed4f54b81036530016a12580</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">10df6b8aa47e2444576424418b573fc242cee671365a867baf0db20901ecf06b</sum>
        </package>
        <package name="fence-agents-common" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-common-4.16.0-13.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">4f539d7a904749ecd1027cb9d4819765105dea5832f2798d1686d90dde011ab2</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9cd6497f78ad316d505950136f9ea2c06b462d6aefed93419db61fcc71cf08d9</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">38c924f9968238922e30064aae6be6e51fed28f09160e5e919a55d9ab2284b93</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">021df5b65d9523b053bcde8500aa3c8bffdb5c64f58dfb164d14f106d66a8d62</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9f506bf9b726167aa665206b4108b5e96cfac636aa2257e564101fbdfbab0d94</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-wti-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">fabd7b4f7ae8f35f1643de268e666997d841520ae6e47c3f8474ff482519bca8</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">bb36d6d3accb87981f37038b330011c9986a995cf600eaf8c77ca5d465cd26cd</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">ce7d9b7547f3dd857702ca013289e8bc6f32a1da6a9e2b81b51894eb244ee3ae</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-brocade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">32eebe0a7a2388ca850db416e3c36f580449aa1ae55217d89a5a58fe50d5c674</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">e5cf28ffff5766813020949d9fef4b6ce4bcc4873a6aa44b7543492b4097fb95</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">4bf67a266a26a0b3d5b6de075c81b4464003b7d594504d7522f00dc3aaf35a37</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-13.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">11ef2699543b0794c6a983d187e0ee8cb10575e52d6871a50c562ddabf6361ac</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">0271eadca27a8a77590ab8bc06935fa8700ae773e690963bbae3a5bda3fa828e</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-rsb-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">16b0e55ce0217b852ebe2ab9e0cf4049885644b34d6b393d0e51ec256f868da1</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-apc-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">8251bb5b72d1d2e816ac108fc3acec1eb97f954d8a69f0c89c291e58c5185bc0</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-drac5-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">9ef0494a9ce4c3a8d62e0bf9fac7aae830d07b51223e49cbb494f60d0cea40ed</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-emerson-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">3488879b0d9eb2daaa441ea673f2dd6581e56a43cdb35f72122e89d9fe1b3dc7</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">0c4374f6d9e78fab3292eaf0d0e7cac5d07715b39f22ae7a8cdcaabbb8caa449</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-virsh-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">81b8f85345b49f128204ba2b7746efe3225b3d21154dc4f2c5f93cf485a25f9b</sum>
        </package>
        <package name="fence-agents-all" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-all-4.16.0-13.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">d8a6dcc1e96baf0406dc61ffc7787290c19c1dc636a0f0d13d3b8b25d84c036f</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">7bcdbce5f15b9018f580617c5fa053b9430e36e42ba8fc35bf9dca753587d6db</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">020b810f275075663aac2863fd6723eb956aa61c4d9de642304064457a1374a2</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">f15d108229f811d4c04d1d82bacdd9fbd217c5781080057dafbbe8786fe58b20</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">b893c4330a530902ba09aee58d5814639d4a162d9454ea4bc9e778fe8d301846</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">96e28b353c60bf7c8196aedcf938f3479458df1f39c735abd70a1aae2a214c27</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5e77f44c1f102777aab4827a4df540d381444cc562272fc62eddcd978081f201</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-scsi-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">5f2cc5c2b757a06f976d74b6e33911904380286ab62827cb364f56e6d626b212</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-sbd-4.16.0-13.el10_1.4.noarch.rpm</filename>
          <sum type="sha256">7df0ffe235bc1349d7945fa8bb51e6e464e6eeb32910d9eaea3b4d0ff3870c54</sum>
        </package>
        <package name="fence-agents-redfish" arch="aarch64" epoch="0" version="4.16.0" release="13.el10_1.4" src="fence-agents-4.16.0-13.el10_1.4.src.rpm">
          <filename>fence-agents-redfish-4.16.0-13.el10_1.4.aarch64.rpm</filename>
          <sum type="sha256">ffe77628280fedfe49cf4f0de0ae3892f98204dc70d4f76cc8af0c34a50d9fe4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:16014</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-27 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

* freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

* freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

* freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

* freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

* freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

* freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

* FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

* FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

* FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25952" id="CVE-2026-25952" type="cve" title="CVE-2026-25952" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25997" id="CVE-2026-25997" type="cve" title="CVE-2026-25997" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26986" id="CVE-2026-26986" type="cve" title="CVE-2026-26986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29775" id="CVE-2026-29775" type="cve" title="CVE-2026-29775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31883" id="CVE-2026-31883" type="cve" title="CVE-2026-31883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31884" id="CVE-2026-31884" type="cve" title="CVE-2026-31884" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31885" id="CVE-2026-31885" type="cve" title="CVE-2026-31885" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33982" id="CVE-2026-33982" type="cve" title="CVE-2026-33982" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33985" id="CVE-2026-33985" type="cve" title="CVE-2026-33985" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33987" id="CVE-2026-33987" type="cve" title="CVE-2026-33987" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442782" id="2442782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442768" id="2442768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453226" id="2453226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447383" id="2447383" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442764" id="2442764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453217" id="2453217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447386" id="2447386" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447385" id="2447385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447379" id="2447379" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453218" id="2453218" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:16014" id="RLSA-2026:16014" type="self" title="RLSA-2026:16014" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>freerdp-libs-3.10.3-5.el10_1.8.aarch64.rpm</filename>
          <sum type="sha256">5c8707680f873cf19586ab07b6384ee3b6847217f2b717cd659e1403e799eba1</sum>
        </package>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>freerdp-3.10.3-5.el10_1.8.aarch64.rpm</filename>
          <sum type="sha256">ea6ca1f2656013c5a95839e0e8a7662e9362f3a6482a00775d515b9eec4be55f</sum>
        </package>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="5.el10_1.8" src="freerdp-3.10.3-5.el10_1.8.src.rpm">
          <filename>libwinpr-3.10.3-5.el10_1.8.aarch64.rpm</filename>
          <sum type="sha256">ca827dbaeadaefa949446413478b493cb421125b04461902d1f60abe681247b2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:15888</id>
    <title>Important: openexr security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-27 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34588" id="CVE-2026-34588" type="cve" title="CVE-2026-34588" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455408" id="2455408" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:15888" id="RLSA-2026:15888" type="self" title="RLSA-2026:15888" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="openexr-libs" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_1.2" src="openexr-3.1.10-8.el10_1.2.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">96717ed6a35bfff0801c70e00dd6dff0d5711eb7c31c83c5e91db421ac73f64f</sum>
        </package>
        <package name="openexr" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_1.2" src="openexr-3.1.10-8.el10_1.2.src.rpm">
          <filename>openexr-3.1.10-8.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">b9404be778ad4e4a35ee836ccedb7c0b521200c6766500e5aa3278e97dd0b6bf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:15968</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2026-05-13 12:06:54" />
    <updated date="2026-05-27 12:09:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)

* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4271" id="CVE-2026-4271" type="cve" title="CVE-2026-4271" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5119" id="CVE-2026-5119" type="cve" title="CVE-2026-5119" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452932" id="2452932" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448044" id="2448044" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:15968" id="RLSA-2026:15968" type="self" title="RLSA-2026:15968" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.11" src="libsoup3-3.6.5-3.el10_1.11.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_1.11.aarch64.rpm</filename>
          <sum type="sha256">fd02550ee602f0aae6ebcabe845b9c4fdaa5fac20650fcca18f776ed533f4edd</sum>
        </package>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_1.11" src="libsoup3-3.6.5-3.el10_1.11.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_1.11.aarch64.rpm</filename>
          <sum type="sha256">336eaa3094041512da0285fc73fb429c4160fbe28f1dbc54bf90f2644d417b9a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:17075</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-16 12:07:04" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:17075" id="RLSA-2026:17075" type="self" title="RLSA-2026:17075" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil" arch="aarch64" epoch="0" version="0.4.8" release="5.el10_1" src="yggdrasil-0.4.8-5.el10_1.src.rpm">
          <filename>yggdrasil-0.4.8-5.el10_1.aarch64.rpm</filename>
          <sum type="sha256">a369be56a87a4e8d693061fa110a03b427dd28235e41eaf5b32ecc8b2b50c876</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18065</id>
    <title>Important: ruby security update</title>
    <issued date="2026-05-19 12:07:45" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41316" id="CVE-2026-41316" type="cve" title="CVE-2026-41316" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2461369" id="2461369" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18065" id="RLSA-2026:18065" type="self" title="RLSA-2026:18065" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-typeprof-0.21.9-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">1591f8f6aa7f4ae1093186cb3d794d2c1e3b6151140c3e97f59529c28281e244</sum>
        </package>
        <package name="rubygem-json" arch="aarch64" epoch="0" version="2.7.2" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-json-2.7.2-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">44d877a3fdb2a842f07c69f2649c003487a6d6d28eacb2da733b0e20bc937a9c</sum>
        </package>
        <package name="ruby-bundled-gems" arch="aarch64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-bundled-gems-3.3.10-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">14f2d05fa1accd5f4a94071d2ca99e58253aba6af75bdfc16e58d3cd4230d501</sum>
        </package>
        <package name="ruby" arch="aarch64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-3.3.10-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0bc2ade504423451d679e4131a0a1d3063799f3cf80f68242faed9fc86fb7bf3</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygems-devel-3.5.22-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">aa4d6cc07d9a3dcbb281df8a91e703aa8f8dbfa04628e73c798394723f082690</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-test-unit-3.6.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">16fe13ffa10c0de42b9cf7b3d26bbf6e7ddd73ad6a2ab7bfed325d439ed4c50a</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-irb-1.13.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">c525023b1949e8ff9d098f95cfb87efb58495b85a9e9f35a229f2cf8a94541bb</sum>
        </package>
        <package name="ruby-devel" arch="aarch64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-devel-3.3.10-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">bb0d10cf21fd5110fc415bc84357af37593d962e8359e7976016f05eb3877ff5</sum>
        </package>
        <package name="rubygem-io-console" arch="aarch64" epoch="0" version="0.7.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-io-console-0.7.1-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">062d4b2923dfb8794397c1cda2504a6d32d7ae7e4c3b6c31ae753f0833de7ae9</sum>
        </package>
        <package name="rubygem-rbs" arch="aarch64" epoch="0" version="3.4.0" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rbs-3.4.0-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">82080e1b59b2766f6635870ab787531f64d16ae6f360f042b144beb154218033</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.4.4" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rexml-3.4.4-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">6ae1d244c5081c03f2190c3168e3e8145469e6727ecd62b08213104f6d98c6bb</sum>
        </package>
        <package name="ruby-libs" arch="aarch64" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-libs-3.3.10-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">55e10640a4bd72f725b5d8037ca60bb38febb4a488b16b7b15227a16488d9593</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-bundler-2.5.22-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">8c629183e49a02ee3e3a1e4f7f7ace24e7321c4a8ab14eb9ed5823b4084b2549</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.10" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>ruby-default-gems-3.3.10-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">a0b5aecda2a23b08fbd4f51197bc7e8dc14cbd9138c912950af5ecdc14095dae</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygems-3.5.22-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">d66f9fc8190b04763be7f5be79b3b1425123b140febc4a06e5807ee8a057c38b</sum>
        </package>
        <package name="rubygem-psych" arch="aarch64" epoch="0" version="5.1.2" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-psych-5.1.2-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">144083f5b543c15e5d8caf279d6e56b068eb56c079ce599f6e0f070d9bd4984c</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rss-0.3.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">b3271503289165fa3cad040f6673633a6ef2e6d131f5330908dd57cce9712e80</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="aarch64" epoch="0" version="3.1.5" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-12.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3cf2e6303ff165eee465f638fbfd0490cdadaa21a04378b044bee4c72668db10</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rake-13.1.0-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">bdc61b9c993809f338bd389463110b54e54f316afeee7c9f3ca25de947e8239b</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">9c2dda742c727dc3b7495d63b063789a8b6dbbaab32ed6466a3031c8bd801791</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-minitest-5.20.0-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">23e70e10ea07b826927a7b0fd47cddbe9a657e32a08978715b316ee354271049</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="12.el10_1" src="ruby-3.3.10-12.el10_1.src.rpm">
          <filename>rubygem-power_assert-2.0.3-12.el10_1.noarch.rpm</filename>
          <sum type="sha256">75d0fedf91f6dde0aadca90e8b1babbee4e9d5929918eaafd4f3c2bce22ae45f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18063</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-19 12:07:45" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477116" id="2477116" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18063" id="RLSA-2026:18063" type="self" title="RLSA-2026:18063" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nginx-mod-stream" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-stream-1.26.3-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">220e5c5cf013415e642355022bf24a525af4564f939b0a26937682ad7e70223e</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">8d11bad0f0b9acac5c004e2990c1ee010383844e01c141d7ef9ed76ea57e8588</sum>
        </package>
        <package name="nginx-core" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-core-1.26.3-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">04f9b3cd223305691bb293225823daec6f498bceefd2bdabdc4af7fb72e71a9e</sum>
        </package>
        <package name="nginx" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-1.26.3-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">f47a9208cc4deb1069b578b67284a12ef54a564a459f3c76d114bc51e1358d9b</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">ceeea5e4cc57e6cb423003a97e8665e2fca8122b3c12ada5ad17e61315bbbc74</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-all-modules-1.26.3-2.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">9f7b17160bbf8a7e1a4a7d33b9ba97af2bcf08f1949eddbf017f59f0cb7c3b9d</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-filesystem-1.26.3-2.el10_1.2.noarch.rpm</filename>
          <sum type="sha256">1cd73d91c3f0ee1fb2cfbc0ebd57f038c943c3966dde8ff24f514d31fafc8703</sum>
        </package>
        <package name="nginx-mod-mail" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-mail-1.26.3-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">54e7f6e347e655336e37d9f17426f65f30dd20b016c47c01e1284ea1b02630b2</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="aarch64" epoch="2" version="1.26.3" release="2.el10_1.2" src="nginx-1.26.3-2.el10_1.2.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-2.el10_1.2.aarch64.rpm</filename>
          <sum type="sha256">e1fd043b7ab9fb0264b08926c4e08ba76747a3a8730b792118e32a8cd321a8e8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1838</id>
    <title>Moderate: image-builder security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1838" id="RLSA-2026:1838" type="self" title="RLSA-2026:1838" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="image-builder" arch="aarch64" epoch="0" version="31" release="3.el10_1.rocky.0.2" src="image-builder-31-3.el10_1.rocky.0.2.src.rpm">
          <filename>image-builder-31-3.el10_1.rocky.0.2.aarch64.rpm</filename>
          <sum type="sha256">5d9836b9a414f69e6a611cd8fab0bf674f7b810bb466a09bc02fa0df38a6c3dd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:1837</id>
    <title>Moderate: osbuild-composer security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang: archive/tar: Unbounded allocation when parsing GNU sparse map (CVE-2025-58183)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-58183" id="CVE-2025-58183" type="cve" title="CVE-2025-58183" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2407258" id="2407258" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:1837" id="RLSA-2026:1837" type="self" title="RLSA-2026:1837" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="osbuild-composer-worker" arch="aarch64" epoch="0" version="149" release="4.el10_1.rocky.0.8" src="osbuild-composer-149-4.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-worker-149-4.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">597e4c842ebc8f37065dfe21ade80b2909a0a7d2484cf8368f9b82245ef26265</sum>
        </package>
        <package name="osbuild-composer" arch="aarch64" epoch="0" version="149" release="4.el10_1.rocky.0.8" src="osbuild-composer-149-4.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-149-4.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">693663e8441b1dbe8a471ac6385f016d347970b35fc9b55291481459d85ffe17</sum>
        </package>
        <package name="osbuild-composer-core" arch="aarch64" epoch="0" version="149" release="4.el10_1.rocky.0.8" src="osbuild-composer-149-4.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-core-149-4.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">13caee4d73c252ccf395061cbc4722fb15b52bd1b2fa9c447959245b37c7f5c6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3752</id>
    <title>Important: osbuild-composer security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3752" id="RLSA-2026:3752" type="self" title="RLSA-2026:3752" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="osbuild-composer" arch="aarch64" epoch="0" version="149" release="5.el10_1.rocky.0.8" src="osbuild-composer-149-5.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-149-5.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">46dfb14a1a101d3d1c263f3241c886e8c72ac44e65418f41c50c4db8c6ae4375</sum>
        </package>
        <package name="osbuild-composer-core" arch="aarch64" epoch="0" version="149" release="5.el10_1.rocky.0.8" src="osbuild-composer-149-5.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-core-149-5.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">0d013ca7591ddfcbfc0e469ccfb4c27770b884b33ce94b77a13d8c70dc83498b</sum>
        </package>
        <package name="osbuild-composer-worker" arch="aarch64" epoch="0" version="149" release="5.el10_1.rocky.0.8" src="osbuild-composer-149-5.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-worker-149-5.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">195a94329b05964d1fc3860b71a6ff6171301d2f6afc31ff9c809ea91743b1d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:3840</id>
    <title>Important: image-builder security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:3840" id="RLSA-2026:3840" type="self" title="RLSA-2026:3840" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="image-builder" arch="aarch64" epoch="0" version="31" release="4.el10_1.rocky.0.2" src="image-builder-31-4.el10_1.rocky.0.2.src.rpm">
          <filename>image-builder-31-4.el10_1.rocky.0.2.aarch64.rpm</filename>
          <sum type="sha256">520fa020c8f9fd42e60e64301f4400785957e07914133ae9acd440977bb3148a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:4162</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21941)

* mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21948)

* mysql: InnoDB unspecified vulnerability (CPU Jan 2026) (CVE-2026-21936)

* mysql: Optimizer unspecified vulnerability (CPU Jan 2026) (CVE-2026-21968)

* mysql: DDL unspecified vulnerability (CPU Jan 2026) (CVE-2026-21937)

* mysql: Thread Pooling unspecified vulnerability (CPU Jan 2026) (CVE-2026-21964)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21936" id="CVE-2026-21936" type="cve" title="CVE-2026-21936" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21937" id="CVE-2026-21937" type="cve" title="CVE-2026-21937" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21941" id="CVE-2026-21941" type="cve" title="CVE-2026-21941" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21948" id="CVE-2026-21948" type="cve" title="CVE-2026-21948" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21964" id="CVE-2026-21964" type="cve" title="CVE-2026-21964" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21968" id="CVE-2026-21968" type="cve" title="CVE-2026-21968" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431413" id="2431413" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431385" id="2431385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431431" id="2431431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431402" id="2431402" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431409" id="2431409" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431384" id="2431384" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:4162" id="RLSA-2026:4162" type="self" title="RLSA-2026:4162" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mysql8.4-libs" arch="aarch64" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-libs-8.4.8-1.el10_1.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">780b407c767e847e9a595b78e0a8cd7cd19b186602e4a8c2c4deddb779ca6edd</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-common-8.4.8-1.el10_1.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">7c6a4067dfcdc037824a1dc2ff66ec369d1aab6b88dd78b1c00118980f3c223e</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.8-1.el10_1.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">a3559f314f01fb1114bce29e54f7e5ee1e47b5259fadaae79c034fb071b4e2ca</sum>
        </package>
        <package name="mysql8.4-server" arch="aarch64" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-server-8.4.8-1.el10_1.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">f4161322822a0ae7ed834f6a6820de6c842f4ba36d8742c9d77b716b8867f89c</sum>
        </package>
        <package name="mysql8.4" arch="aarch64" epoch="0" version="8.4.8" release="1.el10_1.rocky.0.1" src="mysql8.4-8.4.8-1.el10_1.rocky.0.1.src.rpm">
          <filename>mysql8.4-8.4.8-1.el10_1.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">bcd0880eb0e64bceab9a8f8aa2db49a15a47dd4984900f1c794016d14c3a7379</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:9693</id>
    <title>Important: java-25-openjdk security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for java-25-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 25 packages provide the OpenJDK 25 Java Runtime Environment and the OpenJDK 25 Java Software Development Kit.

Security Fix(es):

* JDK: Enhance crypto algorithm support (CVE-2026-22007)

* JDK: Improved Arena allocations (CVE-2026-22008)

* JDK: Improve Kerberos credentialing (CVE-2026-22013)

* JDK: Enhance Path Factories Redux (CVE-2026-22016)

* JDK: Enhance Zip file reading (CVE-2026-22018)

* JDK: Enhance certificate chain validation (CVE-2026-22021)

* JDK: Updating FreeType 2.14.1 (CVE-2026-23865)

* JDK: Enhance TLS connection handling (CVE-2026-34282)

* JDK: Enhance key generation (CVE-2026-34268)

This release also updates a number of third-party libraries included in the JDK.  The libraries themselves are affected by the following CVEs, but this is not a statement that the JDK itself is affected:

* giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

* libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion (CVE-2026-33636)

* libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416)

Bug Fix(es):

* When copying files, OpenJDK 25 prefers to use the copy_file_range native function for performance reasons, only falling back to sendfile when this fails.  However, in previous OpenJDK 25 releases, a response of EOPNOTSUPP (operation not supported) did not cause the JDK to fall back to sendfile.  This is rectified in this release. (Rocky Linux-169939, Rocky Linux-169937)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22007" id="CVE-2026-22007" type="cve" title="CVE-2026-22007" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22008" id="CVE-2026-22008" type="cve" title="CVE-2026-22008" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22013" id="CVE-2026-22013" type="cve" title="CVE-2026-22013" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22016" id="CVE-2026-22016" type="cve" title="CVE-2026-22016" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22018" id="CVE-2026-22018" type="cve" title="CVE-2026-22018" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22021" id="CVE-2026-22021" type="cve" title="CVE-2026-22021" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23865" id="CVE-2026-23865" type="cve" title="CVE-2026-23865" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26740" id="CVE-2026-26740" type="cve" title="CVE-2026-26740" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33416" id="CVE-2026-33416" type="cve" title="CVE-2026-33416" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33636" id="CVE-2026-33636" type="cve" title="CVE-2026-33636" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34268" id="CVE-2026-34268" type="cve" title="CVE-2026-34268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34282" id="CVE-2026-34282" type="cve" title="CVE-2026-34282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451819" id="2451819" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451805" id="2451805" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460029" id="2460029" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460041" id="2460041" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460038" id="2460038" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460043" id="2460043" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460039" id="2460039" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448747" id="2448747" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460042" id="2460042" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460040" id="2460040" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2443891" id="2443891" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460044" id="2460044" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:9693" id="RLSA-2026:9693" type="self" title="RLSA-2026:9693" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="java-25-openjdk-javadoc-zip" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-javadoc-zip-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">5893e2d53ede9a2a38f1547e7eec2086bb3fa3810624978db59e31fff41b6465</sum>
        </package>
        <package name="java-25-openjdk-src" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-src-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fb7386b9c91a222a7ba0cb9d8d2b6c33716aa6ea73d8469ee8e2d240f2763621</sum>
        </package>
        <package name="java-25-openjdk-demo" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-demo-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3a192d5fff66534615db0abc66be5ce49a979726bf46de9f50a4248156ab6cdb</sum>
        </package>
        <package name="java-25-openjdk" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b7b16c24837c0b0fa04e7c6267e36f6c002d1e7d9bf9cfe043e3f419a04a44e1</sum>
        </package>
        <package name="java-25-openjdk-javadoc" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-javadoc-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">99c90b8e31653ff0f1f969939c10bbf8291032623a8a1265f466d7c93ed1d2a6</sum>
        </package>
        <package name="java-25-openjdk-devel" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-devel-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f01559dd9fb520c463cf8a4f1401ab0f643c2b066396e700dc848c1661e6cbd0</sum>
        </package>
        <package name="java-25-openjdk-static-libs" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-static-libs-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f06246429821d57b69f5520852a4219172f629a0e6b59e20223c7dbb9793ea69</sum>
        </package>
        <package name="java-25-openjdk-jmods" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-jmods-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">b61d1e09ec9db5b656da153c74b2ad69ec0c62ec6782322b6f83bf2eabb07ef4</sum>
        </package>
        <package name="java-25-openjdk-headless" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-headless-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">70130dcdf26209ee569079319793dea96c2b3f3de10f648a3325ace48d43d3d1</sum>
        </package>
        <package name="java-25-openjdk-crypto-adapter" arch="aarch64" epoch="1" version="25.0.3.0.9" release="1.el10_1" src="java-25-openjdk-25.0.3.0.9-1.el10_1.src.rpm">
          <filename>java-25-openjdk-crypto-adapter-25.0.3.0.9-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3c58d3ebbc2a430e1363a11566cb1a3e5ba9ff316ebcfa381d71fa5fb6d15f1a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13642</id>
    <title>Important: image-builder security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13642" id="RLSA-2026:13642" type="self" title="RLSA-2026:13642" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="image-builder" arch="aarch64" epoch="0" version="31" release="5.el10_1.rocky.0.2" src="image-builder-31-5.el10_1.rocky.0.2.src.rpm">
          <filename>image-builder-31-5.el10_1.rocky.0.2.aarch64.rpm</filename>
          <sum type="sha256">71dc4edb4734f6146ec0ddf2190de3e79d36a182dc720c9a375c4041d99dbdb3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:13643</id>
    <title>Important: osbuild-composer security update</title>
    <issued date="2026-05-21 16:30:00" />
    <updated date="2026-05-29 12:08:30" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.1</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:13643" id="RLSA-2026:13643" type="self" title="RLSA-2026:13643" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="osbuild-composer" arch="aarch64" epoch="0" version="149" release="6.el10_1.rocky.0.8" src="osbuild-composer-149-6.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-149-6.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">b91b2e64269bcdcc3117cb1fb162bb38e296f3f3c4cf0b2c6fda2902f36341c4</sum>
        </package>
        <package name="osbuild-composer-worker" arch="aarch64" epoch="0" version="149" release="6.el10_1.rocky.0.8" src="osbuild-composer-149-6.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-worker-149-6.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">0acde668f8825c3477ba24a486416c4648b585705bd7b582da0075fa9b3ad68b</sum>
        </package>
        <package name="osbuild-composer-core" arch="aarch64" epoch="0" version="149" release="6.el10_1.rocky.0.8" src="osbuild-composer-149-6.el10_1.rocky.0.8.src.rpm">
          <filename>osbuild-composer-core-149-6.el10_1.rocky.0.8.aarch64.rpm</filename>
          <sum type="sha256">06366fd997db88364e4f637f195fcc73167ae7c8632b0b2e15a0f5e39a390cbd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:20567</id>
    <title>Important: qt6-qtdeclarative security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qt6-qtdeclarative.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Qt6 - QtDeclarative component.

Security Fix(es):

* qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file (CVE-2025-14576)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-14576" id="CVE-2025-14576" type="cve" title="CVE-2025-14576" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464114" id="2464114" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:20567" id="RLSA-2026:20567" type="self" title="RLSA-2026:20567" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qt6-qtdeclarative-devel" arch="aarch64" epoch="0" version="6.10.1" release="1.el10_2.1" src="qt6-qtdeclarative-6.10.1-1.el10_2.1.src.rpm">
          <filename>qt6-qtdeclarative-devel-6.10.1-1.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">33322ec4bc2d9b0468851b919aa7e4178b53a280aed5fa7d4f6caace6ec1f286</sum>
        </package>
        <package name="qt6-qtdeclarative" arch="aarch64" epoch="0" version="6.10.1" release="1.el10_2.1" src="qt6-qtdeclarative-6.10.1-1.el10_2.1.src.rpm">
          <filename>qt6-qtdeclarative-6.10.1-1.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">ca3508ed78984b2386203a2fc3c18888b6d4f431f01d16c1814346a0e3e0a698</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:20606</id>
    <title>Important: ruby4.0 security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ruby4.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many features to process text files and to do system management tasks (as in Perl).  It is simple, straight-forward, and extensible.

Security Fix(es):

* ruby/json: Ruby JSON: Denial of Service or Information Disclosure via format string injection (CVE-2026-33210)

* erb: ERB: Arbitrary code execution via deserialization bypass (CVE-2026-41316)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33210" id="CVE-2026-33210" type="cve" title="CVE-2026-33210" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41316" id="CVE-2026-41316" type="cve" title="CVE-2026-41316" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2461369" id="2461369" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449871" id="2449871" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:20606" id="RLSA-2026:20606" type="self" title="RLSA-2026:20606" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ruby4.0-rubygem-pg" arch="aarch64" epoch="0" version="1.6.3" release="34.el10_2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-pg-1.6.3-34.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4b159c1a51cd039c1a5ca78677c3a4a288048c4cca1d3230c847667eccd008dd</sum>
        </package>
        <package name="ruby4.0-rubygem-mysql2" arch="aarch64" epoch="0" version="0.5.7" release="34.el10_2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-mysql2-0.5.7-34.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8db3eb9649fdb8d27a91c99f6618e470f6c8842d140a45b32c8087888d8f41b9</sum>
        </package>
        <package name="ruby4.0-devel" arch="aarch64" epoch="0" version="4.0.3" release="34.el10_2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-devel-4.0.3-34.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f8ae33360a816dfc112825cd0b9777aa19328cac674cfa846d65ced98c303b2a</sum>
        </package>
        <package name="ruby4.0" arch="aarch64" epoch="0" version="4.0.3" release="34.el10_2" src="ruby4.0-4.0.3-34.el10_2.src.rpm">
          <filename>ruby4.0-4.0.3-34.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9530a7765f11091309369a2df62c1dca38dad5c4da4ae63fc6a5272e6c3e0864</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:20600</id>
    <title>Important: wireshark security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405)

* wireshark: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Wireshark (CVE-2026-5656)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5405" id="CVE-2026-5405" type="cve" title="CVE-2026-5405" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5656" id="CVE-2026-5656" type="cve" title="CVE-2026-5656" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464273" id="2464273" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464276" id="2464276" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:20600" id="RLSA-2026:20600" type="self" title="RLSA-2026:20600" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="wireshark" arch="aarch64" epoch="1" version="4.4.2" release="10.el10_2" src="wireshark-4.4.2-10.el10_2.src.rpm">
          <filename>wireshark-4.4.2-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">70c7e0352331eb3978589502607030a921d2117b9f6f407143f716f613d35695</sum>
        </package>
        <package name="wireshark-cli" arch="aarch64" epoch="1" version="4.4.2" release="10.el10_2" src="wireshark-4.4.2-10.el10_2.src.rpm">
          <filename>wireshark-cli-4.4.2-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7e51b56f4d52b8443d85d394de9357f049902af72af920fa3f2cd71528f3a1ab</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18556</id>
    <title>Moderate: unbound security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: DNSBomb vulnerability (CVE-2024-33655)

* unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-33655" id="CVE-2024-33655" type="cve" title="CVE-2024-33655" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11411" id="CVE-2025-11411" type="cve" title="CVE-2025-11411" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2279942" id="2279942" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2405706" id="2405706" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18556" id="RLSA-2026:18556" type="self" title="RLSA-2026:18556" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="unbound" arch="aarch64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-1.24.2-7.el10.aarch64.rpm</filename>
          <sum type="sha256">b766fa453d20896dc88ea3e07207ea97f8deda26154714a98e5b563e6f7731cd</sum>
        </package>
        <package name="python3-unbound" arch="aarch64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10.aarch64.rpm</filename>
          <sum type="sha256">764f7de640e6c5c8ecba70173d8980bd9bdedb0da6a95b86b702b77138cf0d92</sum>
        </package>
        <package name="unbound-libs" arch="aarch64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10.aarch64.rpm</filename>
          <sum type="sha256">7e486bc1fafb15a7b27789f0776ab746cfe98535cd1200c1fa442e6aea77f18a</sum>
        </package>
        <package name="unbound-anchor" arch="aarch64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10.aarch64.rpm</filename>
          <sum type="sha256">14d1fa3f582a7147d99c5cb12741364695fbbf7cee6dd59f0ee34a941f5ae3c6</sum>
        </package>
        <package name="unbound-dracut" arch="aarch64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10.aarch64.rpm</filename>
          <sum type="sha256">d6e19dad8e7884d3b3042305fcb00cdb2a189a63998c93c56bd1d87b96b5dd4a</sum>
        </package>
        <package name="unbound-utils" arch="aarch64" epoch="0" version="1.24.2" release="7.el10" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10.aarch64.rpm</filename>
          <sum type="sha256">b5b2b4c814628c60df84fab085b7ed0a3e7f33fcba975d433e34f209af9acf92</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18326</id>
    <title>Moderate: libvirt security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libvirt.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.

Security Fix(es):

* libvirt: Denial of service in XML parsing (CVE-2025-12748)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12748" id="CVE-2025-12748" type="cve" title="CVE-2025-12748" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2413801" id="2413801" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18326" id="RLSA-2026:18326" type="self" title="RLSA-2026:18326" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libvirt-daemon-driver-network" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-network-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e1fe0896224056865ebc1ff87fc333694b791310dc81eab8ecb0c9a7b50782a1</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-scsi" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-scsi-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0ee6ad5d06ab02b4b20a1138e8d210d8e304809e5d47616cf5ea9a0d66aaf009</sum>
        </package>
        <package name="libvirt-libs" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-libs-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">620a1d279b56555ef961f97c4521239348fb5fe3ed654415e7fea7433098ff4a</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-rbd" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-rbd-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a88e5af4393e79f1500c450399c42b79d322aa2eb269a8ed7b895b1ab60405ed</sum>
        </package>
        <package name="libvirt-daemon-plugin-lockd" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-plugin-lockd-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b9893d5c7813b704e7a3b3fcd3f83c8437d7e2d7c515dbc77ef15c2e4e376b69</sum>
        </package>
        <package name="libvirt-daemon-driver-interface" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-interface-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">80a9e3790b150606807ce35938890dee923c2934eba68ce55e94c72daa6b0cf5</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-disk" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-disk-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c91ebbbcbf9a5a8157fe646e3b2b2e8e14675e06bab6449c8bf97fac8dedba73</sum>
        </package>
        <package name="libvirt" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">054ce285c6c9a7035c1a8214f1f8bc24c359a7c8dbcbb18298a26bbb49d33af5</sum>
        </package>
        <package name="libvirt-client-qemu" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-client-qemu-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">46585dbfdcebeb6dc33f515c16084cbb35f7fed51a7f5472ad088c8bd7524ade</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-mpath" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-mpath-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8f5d0047f4dc8a2a3045d0f26687f9d814ed0cf8c553e1639c35f142e11064be</sum>
        </package>
        <package name="libvirt-daemon-driver-qemu" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-qemu-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a9ac4fc933f5451f46d42e662c3df04e22180b5373c9cb094405f36c345130d9</sum>
        </package>
        <package name="libvirt-daemon-common" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-common-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">efbc9a8b2e559670b6bfff4bf1a686a7309f71a22689ee4533f323c202269bfd</sum>
        </package>
        <package name="libvirt-daemon-driver-storage" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">94bb71c482658892589aeffcdd63bf5ee3054b5e3273c231ae8e845bc2af205c</sum>
        </package>
        <package name="libvirt-daemon" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e20a4672747730381fd5412a3350c3701b12e11316e1a9db0ce3059020df7744</sum>
        </package>
        <package name="libvirt-daemon-log" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-log-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e509c6d1ff8581165150a18cd33d4bbe28dddba49c34b840f166137bfb35d530</sum>
        </package>
        <package name="libvirt-daemon-driver-nwfilter" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-nwfilter-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">767d4736a145ec6c995bcea07c4d32fb7998d64c99958e7ccf1fd320bda78957</sum>
        </package>
        <package name="libvirt-daemon-driver-nodedev" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-nodedev-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6555740cc0e5e1f572437898af31fcb0012f8ff1f34c2f3aa70a042b602520f0</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-core" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-core-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">eb4a2d487774842be62b8ade0c548cc4c59e37de306cc37b58e9db38db8dc261</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-iscsi" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-iscsi-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">5514318a7dee62a864599ca79b07d9d4dbfad351253b8f9a429aefba7ac559c4</sum>
        </package>
        <package name="libvirt-daemon-kvm" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-kvm-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">39c128488df8c5f5607250d02d02b963442de6dd6485d0a91d8e4d5b9d4153b5</sum>
        </package>
        <package name="libvirt-ssh-proxy" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-ssh-proxy-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d9b2d19db56da2da0eed7662963562a4e6502bfce6124ec479166c889efee28a</sum>
        </package>
        <package name="libvirt-daemon-driver-secret" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-secret-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1db592825255799d75d7cd69d3b08176191a86de9e31ff6bed0553b22fd22fac</sum>
        </package>
        <package name="libvirt-daemon-config-network" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-config-network-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d84bffbb620e633c8a95ea53869f025fb600798b0c074a569fad1735cc8697c3</sum>
        </package>
        <package name="libvirt-daemon-config-nwfilter" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-config-nwfilter-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">dc41707b16523278b35c9b26d85643d382cc309a5f364d7cf36fcfc371de851a</sum>
        </package>
        <package name="libvirt-nss" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-nss-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d14708db69675c5eff9881f4b457766609b7765af6f6e0aecbeef719914734e4</sum>
        </package>
        <package name="libvirt-daemon-proxy" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-proxy-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c9000dcf279013b845a09c46dd11598e99789518d2bbb9a965c97a408b29eff9</sum>
        </package>
        <package name="libvirt-daemon-driver-storage-logical" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-driver-storage-logical-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">476efda2a82e064982144b6cb4e5b244251071686c5b208e79bad8626991a09f</sum>
        </package>
        <package name="libvirt-client" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-client-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6af46f37de296f4e7fd3890212b928add2da91c7b287c08892749532eef96e4c</sum>
        </package>
        <package name="libvirt-daemon-lock" arch="aarch64" epoch="0" version="11.10.0" release="12.1.el10_2" src="libvirt-11.10.0-12.1.el10_2.src.rpm">
          <filename>libvirt-daemon-lock-11.10.0-12.1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">67f377a358358af51a20e597e5194fd3cb901a6b5850a3f6144e2d8945211f46</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18479</id>
    <title>Important: qemu-kvm security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for qemu-kvm.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.

Security Fix(es):

* firefox: thunderbird: CSP Bypass and XSS Exposure via Web Compatibility Shims (CVE-2024-11694)

* firefox: thunderbird: Unhandled Exception in Add-on Signature Verification (CVE-2024-11696)

* firefox: thunderbird: Select list elements could be shown over another site (CVE-2024-11692)

* firefox: thunderbird: Memory safety bugs fixed in Firefox 133, Thunderbird 133, Firefox ESR 128.5, and Thunderbird 128.5 (CVE-2024-11699)

* firefox: thunderbird: URL Bar Spoofing via Manipulated Punycode and Whitespace Characters (CVE-2024-11695)

* firefox: thunderbird: Improper Keypress Handling in Executable File Confirmation Dialog (CVE-2024-11697)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11692" id="CVE-2024-11692" type="cve" title="CVE-2024-11692" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11694" id="CVE-2024-11694" type="cve" title="CVE-2024-11694" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11695" id="CVE-2024-11695" type="cve" title="CVE-2024-11695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11696" id="CVE-2024-11696" type="cve" title="CVE-2024-11696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11697" id="CVE-2024-11697" type="cve" title="CVE-2024-11697" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11699" id="CVE-2024-11699" type="cve" title="CVE-2024-11699" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328947" id="2328947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328950" id="2328950" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328946" id="2328946" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328948" id="2328948" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328943" id="2328943" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2328941" id="2328941" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18479" id="RLSA-2026:18479" type="self" title="RLSA-2026:18479" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qemu-kvm-device-display-virtio-gpu" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9428accffc458226b728bc51b02e3b1fa7ba65cbf51f6bfce6dfab92c56da894</sum>
        </package>
        <package name="qemu-pr-helper" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-pr-helper-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0f89d7e033b9226d040777fbf29a68fcf84d7258d91e58a93a748a6fc07f5366</sum>
        </package>
        <package name="qemu-kvm-docs" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-docs-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ce1e0be5e37f94f95d5e9c232a57bf76bb13cfa5ec32485d0ea38cc434457332</sum>
        </package>
        <package name="qemu-kvm-core" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-core-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8ea3453d05ef08d84131efec057326ba34b8571de6fe3a7b99538ead3d9daf73</sum>
        </package>
        <package name="qemu-kvm-device-usb-redirect" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-usb-redirect-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">47c87b1dc95e7a6e39a236fdf92baed177c2b0011103921fa455e4ab7fa3f6cd</sum>
        </package>
        <package name="qemu-kvm-block-rbd" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-block-rbd-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4edb26bda3fd8e7fb31c41306bd23af7c9a16a1a43411070d004dab8001b0a67</sum>
        </package>
        <package name="qemu-kvm-device-usb-host" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-usb-host-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7d42611b7ee67e3efcdccb0f590e9213079e1948ecbcf9c656aed807d10a5570</sum>
        </package>
        <package name="qemu-guest-agent" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-guest-agent-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b410a95e1a1b257993aaa3e7be412b15b5ea67f33565f667e5c1d802e7e7a812</sum>
        </package>
        <package name="qemu-kvm-device-display-virtio-gpu-pci" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-device-display-virtio-gpu-pci-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e0c9697c96d8d521827f93b6c16daafe7a1ae06ed2b62d0b197e4ceb323d4eea</sum>
        </package>
        <package name="qemu-kvm" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a51c43e87b16e001d8f1de536155f27d21cd710524e19ca9f36d8f5a35154d2a</sum>
        </package>
        <package name="qemu-kvm-audio-pa" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-audio-pa-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6f45677ccbdc883df984894c4d94ad391c3094a3e143069432dc2f5d1d330072</sum>
        </package>
        <package name="qemu-kvm-tools" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-tools-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">008a69e6da5f7bae26aa29664e7410574b60b506f8f13b4468af58ee2172d95f</sum>
        </package>
        <package name="qemu-kvm-block-curl" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-block-curl-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d06d4155dce0b505fda019257a4a5a7e2630886fe03b01f4ed75aa19a9e08a58</sum>
        </package>
        <package name="qemu-img" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-img-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">5a136a85c28cc4b14502b337f64a6e7809fc5259ec113b770c2cac3a9483b3e7</sum>
        </package>
        <package name="qemu-kvm-block-blkio" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-block-blkio-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1047026e7a7a60cc08d27df346a824c0ef81f62485abe11cae57285981c69676</sum>
        </package>
        <package name="qemu-kvm-common" arch="aarch64" epoch="8" version="10.1.0" release="16.el10_2" src="qemu-kvm-10.1.0-16.el10_2.src.rpm">
          <filename>qemu-kvm-common-10.1.0-16.el10_2.aarch64.rpm</filename>
          <sum type="sha256">045623e70e535dccb2c9297e4a7b7ca15c4c9cec555490cf0b75c48720dda385</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18537</id>
    <title>Important: tomcat security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Security constraint bypass for CGI scripts (CVE-2025-46701)

* org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve (CVE-2025-55668)

* org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation (CVE-2025-55754)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-46701" id="CVE-2025-46701" type="cve" title="CVE-2025-46701" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55668" id="CVE-2025-55668" type="cve" title="CVE-2025-55668" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-55754" id="CVE-2025-55754" type="cve" title="CVE-2025-55754" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388226" id="2388226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2406590" id="2406590" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369253" id="2369253" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18537" id="RLSA-2026:18537" type="self" title="RLSA-2026:18537" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">130b16b3d6cc72f1196d44b33f8035a8c8ef32d189fedc1f0231adc06f2019e8</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">17866e11495a6e2d4a87717978187a86d3f5a2b3006f7960ba3d1a9551fd8125</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-lib-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">b55fa922868e1421cd14f4ed54f21bc1be43d0bfb3418f4ecc2a8a5e0a012029</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">a62eb9e00702a24823b3680d8cb92c4a5c102310f7c94b8a8244bc09b67837a8</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">3528cce63350ed624344e116de6208c251ed0dca2af72c3bcbd8b83d2f8f443d</sum>
        </package>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">012e48cf92056a36e8a62412279614fcfed9c1425917b827d49b48a3cd7b8daa</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">abf7a773524ec09c45476426470aa5ebc6cbb2cfc056d720aeb11f9ce5c742ee</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">986f2a4e5c9441329b2b337cbcd0d75f5ecac3035643eea080ad8f68b9433050</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18421</id>
    <title>Moderate: luksmeta security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for luksmeta.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in Rocky Linux.

Security Fix(es):

* luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-11568" id="CVE-2025-11568" type="cve" title="CVE-2025-11568" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2404244" id="2404244" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18421" id="RLSA-2026:18421" type="self" title="RLSA-2026:18421" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libluksmeta" arch="aarch64" epoch="0" version="10" release="1.el10" src="luksmeta-10-1.el10.src.rpm">
          <filename>libluksmeta-10-1.el10.aarch64.rpm</filename>
          <sum type="sha256">06fe6316248c2eb5212939d0ff1c91101c13a97969481c5845afe5b5f54c4481</sum>
        </package>
        <package name="luksmeta" arch="aarch64" epoch="0" version="10" release="1.el10" src="luksmeta-10-1.el10.src.rpm">
          <filename>luksmeta-10-1.el10.aarch64.rpm</filename>
          <sum type="sha256">68bcf5542375aa6c1bafb2586dd22e32887f5acc70838ff4a3a3b0be6d6b2d28</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:18465</id>
    <title>Important: edk2 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for edk2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. 

Security Fix(es):

* edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 10 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-2296" id="CVE-2025-2296" type="cve" title="CVE-2025-2296" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2420637" id="2420637" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:18465" id="RLSA-2026:18465" type="self" title="RLSA-2026:18465" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="edk2-ovmf" arch="noarch" epoch="0" version="20251114" release="5.el10" src="edk2-20251114-5.el10.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10.noarch.rpm</filename>
          <sum type="sha256">5359ed95167aff9de81c6fe3303b207124d00363e1155055196a01d548755718</sum>
        </package>
        <package name="edk2-aarch64" arch="noarch" epoch="0" version="20251114" release="5.el10" src="edk2-20251114-5.el10.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10.noarch.rpm</filename>
          <sum type="sha256">5350b11aef80978c27b88d7d7e3ff44caf66d94085b267a77be635777bb33573</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19031</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19031" id="RLSA-2026:19031" type="self" title="RLSA-2026:19031" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="skopeo" arch="aarch64" epoch="2" version="1.22.2" release="1.el10_2" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-1.22.2-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a052bb983e4f6228e5ec9a0340bd8dc77cff93cc90c083009d3c074dfd756991</sum>
        </package>
        <package name="skopeo-tests" arch="aarch64" epoch="2" version="1.22.2" release="1.el10_2" src="skopeo-1.22.2-1.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">afb993f89baad93a347e53389a6e883f246e90c22a4deb93dd3642136cac02b1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19024</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-ugly-free, gstreamer1-plugins-bad-free, gstreamer1-plugins-good, gstreamer1-plugins-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)

* GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)

* GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)

* GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)

* GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)

* GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447496" id="2447496" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447492" id="2447492" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447495" id="2447495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447498" id="2447498" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447503" id="2447503" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447490" id="2447490" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447500" id="2447500" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19024" id="RLSA-2026:19024" type="self" title="RLSA-2026:19024" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gstreamer1-plugins-base-devel" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-devel-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1e3e40673934c9a37c7a126dcbf58b93b1830e78baa7985a2a3f1b62d9108b84</sum>
        </package>
        <package name="gstreamer1-plugins-base" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6a1ccd20d0b8f97f8926c72c7dd352cbba3c65532d5abf0413abf475fb64481e</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">483e93b4ed6d92bd88b73c8b23f0275d713f37f4b7fde3d57948b068afbacaca</sum>
        </package>
        <package name="gstreamer1-plugins-good-gtk" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">66fb059ea2eaca23a4e2520d9e21791cf2fce2612584796d89a5a954671112d7</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-good-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2c56a7afae97dce2e2de6a3a9b1133bfc276b19d445aa857d094a3847bb5b8c8</sum>
        </package>
        <package name="gstreamer1-plugins-ugly-free" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">df452a9e1153eabeb2f3833c2504ff28d4ccd6419c5bdcfb10f668d57abac038</sum>
        </package>
        <package name="gstreamer1-plugins-base-tools" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-base-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-base-tools-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d4a5c60af13138fdb246d719a22bed20f4b173731f4e71f84652eaceb64db858</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">888d58dc4e4eea6e096f8a76de648ce9c15e3812dade7d09d4a9c5a293d43403</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19013</id>
    <title>Moderate: delve security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Denial of Service due to excessive resource consumption via crafted certificate (CVE-2025-61729)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61729" id="CVE-2025-61729" type="cve" title="CVE-2025-61729" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2418462" id="2418462" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19013" id="RLSA-2026:19013" type="self" title="RLSA-2026:19013" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="delve" arch="aarch64" epoch="0" version="1.26.1" release="1.el10_2" src="delve-1.26.1-1.el10_2.src.rpm">
          <filename>delve-1.26.1-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">31a7451843042127148675d7231ca933c0b8153d9e7b4ef19b496c880d1eef94</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19017</id>
    <title>Important: podman security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19017" id="RLSA-2026:19017" type="self" title="RLSA-2026:19017" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.8.2" release="1.el10_2" src="podman-5.8.2-1.el10_2.src.rpm">
          <filename>podman-remote-5.8.2-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">54373bb2202fb4c6232b20102b2ee446fa2899c5a5d3672d723f542f14fc4e1c</sum>
        </package>
        <package name="podman" arch="aarch64" epoch="7" version="5.8.2" release="1.el10_2" src="podman-5.8.2-1.el10_2.src.rpm">
          <filename>podman-5.8.2-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">267728bd2ecf7ee3342bafc35c7f78defc573afda82433e576c134ed03e7d4f1</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="1.el10_2" src="podman-5.8.2-1.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">78a4e72643435d42630cba7b1576eb50435d537ac11546a8c72ae3f5b5c38300</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19042</id>
    <title>Low: python-jwcrypto security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>An update is available for python-jwcrypto.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens (CVE-2026-39373)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39373" id="CVE-2026-39373" type="cve" title="CVE-2026-39373" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456187" id="2456187" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19042" id="RLSA-2026:19042" type="self" title="RLSA-2026:19042" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-jwcrypto" arch="noarch" epoch="0" version="1.5.6" release="5.el10_2" src="python-jwcrypto-1.5.6-5.el10_2.src.rpm">
          <filename>python3-jwcrypto-1.5.6-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">78484611baf47da48010b9798934706734350c5a986e150c820ea8059583e976</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19020</id>
    <title>Moderate: crun security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for crun.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>crun is a OCI runtime

Security Fix(es):

* crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30892" id="CVE-2026-30892" type="cve" title="CVE-2026-30892" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451576" id="2451576" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19020" id="RLSA-2026:19020" type="self" title="RLSA-2026:19020" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="crun" arch="aarch64" epoch="0" version="1.27" release="2.el10_2" src="crun-1.27-2.el10_2.src.rpm">
          <filename>crun-1.27-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2fd2cd0344fc2dcfa439cb35768aed6f56ac776dc7eeb7446ca89766144b0586</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19022</id>
    <title>Important: golang security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19022" id="RLSA-2026:19022" type="self" title="RLSA-2026:19022" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-race-1.26.2-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ffe406e29a5d127738214b1c7471ecee8acd0136b4c3412b66d3419155bb423f</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>go-toolset-1.26.2-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">63fb6303f676a648772ec4becbbbf59db1e410e4ba9ab4e18dffed9bc67ad094</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-src-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">a586737a229c2a9e6d75979830228853d74741a45951c3ea388bde3c7f577996</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-tests-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">5be63adb0380d54c1bb05aeb4182f89325f9cec23b22a4a0b77f3a726749a5bf</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-bin-1.26.2-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f8a55185994e3365ce590222ed4ab5ad791e71f07175b2b07df17fcda9168c43</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-docs-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">7e30150120c2135156d2364875a3a176c856d990acd0b29685648e3ee2635b7e</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-1.26.2-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">df10fb1419189385ba18b2a65877126331fbfc8f204c57c0132ec34bde2ff3d1</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.26.2" release="2.el10_2" src="golang-1.26.2-2.el10_2.src.rpm">
          <filename>golang-misc-1.26.2-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">62336b8ca69aae9f5aac73ab7bf27c2cf1c64cd361080ac3b82c9ec9c6861ae4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19054</id>
    <title>Important: tomcat security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734" id="CVE-2026-24734" type="cve" title="CVE-2026-24734" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440426" id="2440426" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19054" id="RLSA-2026:19054" type="self" title="RLSA-2026:19054" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-lib-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">b55fa922868e1421cd14f4ed54f21bc1be43d0bfb3418f4ecc2a8a5e0a012029</sum>
        </package>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">012e48cf92056a36e8a62412279614fcfed9c1425917b827d49b48a3cd7b8daa</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">abf7a773524ec09c45476426470aa5ebc6cbb2cfc056d720aeb11f9ce5c742ee</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">3528cce63350ed624344e116de6208c251ed0dca2af72c3bcbd8b83d2f8f443d</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">130b16b3d6cc72f1196d44b33f8035a8c8ef32d189fedc1f0231adc06f2019e8</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">986f2a4e5c9441329b2b337cbcd0d75f5ecac3035643eea080ad8f68b9433050</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">a62eb9e00702a24823b3680d8cb92c4a5c102310f7c94b8a8244bc09b67837a8</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.49" release="1.el10_2.1" src="tomcat-10.1.49-1.el10_2.1.src.rpm">
          <filename>tomcat-webapps-10.1.49-1.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">17866e11495a6e2d4a87717978187a86d3f5a2b3006f7960ba3d1a9551fd8125</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19034</id>
    <title>Moderate: python-tornado security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for python-tornado.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)

* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31958" id="CVE-2026-31958" type="cve" title="CVE-2026-31958" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35536" id="CVE-2026-35536" type="cve" title="CVE-2026-35536" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2454716" id="2454716" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446765" id="2446765" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19034" id="RLSA-2026:19034" type="self" title="RLSA-2026:19034" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-tornado" arch="aarch64" epoch="0" version="6.5.5" release="1.el10_1.1" src="python-tornado-6.5.5-1.el10_1.1.src.rpm">
          <filename>python3-tornado-6.5.5-1.el10_1.1.aarch64.rpm</filename>
          <sum type="sha256">ff34b3890351071a77f637c6d5a7652331505a2f57aaad650843658340c4d107</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19009</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql18.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)

* postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)

* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)

* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2007" id="CVE-2026-2007" type="cve" title="CVE-2026-2007" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439326" id="2439326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439324" id="2439324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439320" id="2439320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439322" id="2439322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439325" id="2439325" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19009" id="RLSA-2026:19009" type="self" title="RLSA-2026:19009" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql18-upgrade-devel" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-upgrade-devel-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">e6a0ec285aa5928d4cefaad5277e0b39d61e3ed1dd60653ceb03945d1bc98391</sum>
        </package>
        <package name="postgresql18-upgrade" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-upgrade-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">92df9544d376bf20b6b90aca20b6d2e3f67061959120c1b526fa543977d285f7</sum>
        </package>
        <package name="postgresql18-contrib" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-contrib-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">6b70a23d58bdf7d16b4aa95a2583c9fbc71d1eb4c27ba3c5da11caf3a4ebe52c</sum>
        </package>
        <package name="postgresql18-docs" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-docs-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">5b2caa59b1de5c8f6104ebb143845a954b599afd3eb2a0fb3be97cf58760cb3e</sum>
        </package>
        <package name="postgresql18-plperl" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-plperl-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">818ff427854469fcaab35d55797f6fb41fe9e0300e831b32d7c223a3223cd330</sum>
        </package>
        <package name="postgresql18-private-libs" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-private-libs-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">0443a4fd4e23dcd77efed35831b35f847792e5e5188d2c0f45727a93b44a19b6</sum>
        </package>
        <package name="postgresql18-static" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-static-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">c189a70f72dd2601d0012f7ddace4a3a1af9aa24dfec1f1792721ec0a5e81269</sum>
        </package>
        <package name="postgresql18-plpython3" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-plpython3-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">7775895d299c5c2e8efc44da4bc36a2de3f37e2ee228fa1d87a1ccc595a04e53</sum>
        </package>
        <package name="postgresql18" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">dbab05fd1b71de902bb05f8c95fd72834a0ff1467f2a54e59ced7c673120a2ae</sum>
        </package>
        <package name="postgresql18-test" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-test-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">339f3527efbdf20442fffec7fef6f131bfacdd45188f92551b940104ddd1ad9a</sum>
        </package>
        <package name="postgresql18-server-devel" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-server-devel-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">9ff9ff0ccf09beaff2e87688b6c967d60584d1d22044aedb1bc220a19dc73213</sum>
        </package>
        <package name="postgresql18-server" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-server-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">e22964205128a2c88ed69c3c8cbb968fdf30aadf449d61b3929ecd824d37edcb</sum>
        </package>
        <package name="postgresql18-private-devel" arch="aarch64" epoch="0" version="18.3" release="1.el10" src="postgresql18-18.3-1.el10.src.rpm">
          <filename>postgresql18-private-devel-18.3-1.el10.aarch64.rpm</filename>
          <sum type="sha256">07b6cc437ff5225c78c852228963bb15d58cb5bf2ceeb035a1b89795146f8f8c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19032</id>
    <title>Important: buildah security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19032" id="RLSA-2026:19032" type="self" title="RLSA-2026:19032" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah" arch="aarch64" epoch="2" version="1.43.1" release="1.el10_2" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-1.43.1-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4fe170634b991a9d7537786f054ba3a04fc7d300fd6e375abd179c590089adc1</sum>
        </package>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.43.1" release="1.el10_2" src="buildah-1.43.1-1.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">420fe6996ace8be30e26b7d3ef5baf01ad85a6e88685ae7415014e228382db0c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19010</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)

* postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)

* postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)

* postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439322" id="2439322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439326" id="2439326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439324" id="2439324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439325" id="2439325" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19010" id="RLSA-2026:19010" type="self" title="RLSA-2026:19010" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql-test" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-test-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">17fbdc88026973e87e0d5cb60f0b9c31d5b6dc798d469fe2559197c6397da952</sum>
        </package>
        <package name="postgresql-upgrade" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d265da341b0cb519a3d2e4a6520b63e8677a574388fd2538fe2dd0199ca7df36</sum>
        </package>
        <package name="postgresql-private-devel" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-devel-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">0f26d9a474d6d16a0c04b6a6ae073cf4324b33506bd8f46178a9463a4263645c</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-upgrade-devel-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">3a31766ef382f27e2be14c99e2c7c45d0a917b411c45ccaaa1f1952cf9888a35</sum>
        </package>
        <package name="postgresql-private-libs" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-private-libs-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">fd553e0dae6b71db943f37fb6c8969281491075f8f636810282477e128e4e218</sum>
        </package>
        <package name="postgresql-pltcl" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-pltcl-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">19d44acb10d4e6f094bf962f100cdcbedbf9a39d6f7e6d27b273fd36632deb76</sum>
        </package>
        <package name="postgresql-server-devel" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-devel-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f8b0e7f02f1b2628efa2515d4a3ba949dd2449741cd630baeee6913dfd23e01a</sum>
        </package>
        <package name="postgresql-plpython3" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plpython3-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">d7c1c54015ec1fcdeca475bda78759126cfc0bc999ec987ef7839e4479009594</sum>
        </package>
        <package name="postgresql-static" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-static-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6b902ea005eb1b25c0d494e33dbe1ba498505d3efd8d6c4e3394ff9c752984ed</sum>
        </package>
        <package name="postgresql" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">6e7e8b1105e66494a198975a4361efb5073b2fc29c263e0e7fc5bec564526254</sum>
        </package>
        <package name="postgresql-contrib" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-contrib-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">01398d626bd2aadf5f1443b9560304aa178e31eb785300923280bcdff1a84b93</sum>
        </package>
        <package name="postgresql-plperl" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-plperl-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">f5e6e99649cc96b35b096ae82fcf92f320d4da7ff662e8a4b10d2b2d8a816b1f</sum>
        </package>
        <package name="postgresql-server" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-server-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">203f203510bd18855e2bd3ec7cf5e559a751bbfdc9c7f89b8a5c2170588ee07f</sum>
        </package>
        <package name="postgresql-docs" arch="aarch64" epoch="0" version="16.13" release="1.el10_1" src="postgresql16-16.13-1.el10_1.src.rpm">
          <filename>postgresql-docs-16.13-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">77fb175a2eb11f9769c448e454069f2d6cd6ab6b830753f6b42597fbd6abce8d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19019</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)

* cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)

* cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)

* cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)

* python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)

* python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)

* python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-0865" id="CVE-2026-0865" type="cve" title="CVE-2026-0865" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5713" id="CVE-2026-5713" type="cve" title="CVE-2026-5713" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448181" id="2448181" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448168" id="2448168" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449649" id="2449649" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2444691" id="2444691" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457409" id="2457409" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458049" id="2458049" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458239" id="2458239" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431367" id="2431367" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457932" id="2457932" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19019" id="RLSA-2026:19019" type="self" title="RLSA-2026:19019" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3.14-tkinter" arch="aarch64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.4-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">821375bf760f28ccb8445affe78220adfd07bf91e8461ed36eef096873f8b68f</sum>
        </package>
        <package name="python3.14-devel" arch="aarch64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.4-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">13e2ce32e526cc338bc07f3afa3f72bfb68a80ae76a581ab995c47fecba26c3a</sum>
        </package>
        <package name="python3.14-libs" arch="aarch64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.4-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">bc2e94c7061d077031302245ca27c4f4807728cba51aa7df4a3c3dc366e5f41a</sum>
        </package>
        <package name="python3.14" arch="aarch64" epoch="0" version="3.14.4" release="2.el10_2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-3.14.4-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b3ee103c2bf225e8fa6d1c03e832fe7c89d2849b3f808fa53a47b9d7e7bc5c4f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19053</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freeipmi.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.

Security Fix(es):

* freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450778" id="2450778" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19053" id="RLSA-2026:19053" type="self" title="RLSA-2026:19053" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freeipmi-ipmidetectd" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">9b02a4912cfabb30e86854dff744cf1b0b5a8d83c32b2138347d685f8660ac22</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">2b558dadf95bacb83e5323f467775044d3c62b2feb3117314cec0a1bca689f37</sum>
        </package>
        <package name="freeipmi-ipmiseld" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">7702809ec0f6600d13ed16ba2527f59af95f4d34614ca9908e23d361683e8159</sum>
        </package>
        <package name="freeipmi" arch="aarch64" epoch="0" version="1.6.17" release="1.el10_1" src="freeipmi-1.6.17-1.el10_1.src.rpm">
          <filename>freeipmi-1.6.17-1.el10_1.aarch64.rpm</filename>
          <sum type="sha256">4983f8bbb603294a173e76353a3436e158589f5c2fa6eb729d2fa3365764b294</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19021</id>
    <title>Moderate: galera and mariadb11.8 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mariadb11.8, galera.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* MariaDB: MariaDB: Remote Code Execution or Denial of Service via JSON_SCHEMA_VALID() function vulnerability (CVE-2026-32710)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32710" id="CVE-2026-32710" type="cve" title="CVE-2026-32710" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449711" id="2449711" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19021" id="RLSA-2026:19021" type="self" title="RLSA-2026:19021" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mariadb11.8-client-utils" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-client-utils-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">818c4014e34ab211f5634a1cd33e8d7c2c18e7cad7be2d79c110dbef25aa27ad</sum>
        </package>
        <package name="mariadb11.8-errmsg" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-errmsg-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">fba9d75ce9e6a21ed337fddb5c1a6aa8a34eb0380e7fe299f66e1f6fe224fbbd</sum>
        </package>
        <package name="mariadb11.8-common" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-common-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">4bcb9f412c29f9f64f6e7e3aa54094e5f8ee52398a212ff5b21c1c17422df063</sum>
        </package>
        <package name="mariadb11.8-test" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-test-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">53cd10ea29c76fea8f378144d0721600a372ae7830da88038630ae736320aa13</sum>
        </package>
        <package name="mariadb11.8-embedded" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">02cb431e6fb32739d8d2bde72e12e9d01cf6d1478d9de577e6070f7e620adf8e</sum>
        </package>
        <package name="mariadb11.8-embedded-devel" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-devel-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4fa86f2dcd61c8b84825993eed046c43663b3cd82d7d269d11cee13515b86c9a</sum>
        </package>
        <package name="mariadb11.8-server-utils" arch="noarch" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-server-utils-11.8.6-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">7fd435b14cbc5eabc874af156f7b0d4729778d22677f06a873e22aa402b280d2</sum>
        </package>
        <package name="mariadb11.8-oqgraph-engine" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-oqgraph-engine-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c9d7a9d9034c7f0f17c77fc107b0f7e1999879b2e4c4ad794fe061c787cc5092</sum>
        </package>
        <package name="mariadb11.8-devel" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-devel-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d9caf3c31a9be345ad25d432afcfd7dd7c3021fcd4c2acfb1523fd82bc3d41f0</sum>
        </package>
        <package name="mariadb11.8-pam" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-pam-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cdd8387c64d989f21911d43325b3bd571fe906f33ebc08466ea12f142969a15c</sum>
        </package>
        <package name="mariadb11.8-backup" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-backup-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fc1cbe700035a9a8fa59860cd11a6704d9938a916f9972774a6d7b760e7c8ab2</sum>
        </package>
        <package name="mariadb11.8-server-galera" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-server-galera-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">97fb167d5af8e39ef0c8efc188b07c9f4fb1be13c657aeec2be53ea8835c7f17</sum>
        </package>
        <package name="galera" arch="aarch64" epoch="0" version="26.4.25" release="1.el10_2" src="galera-26.4.25-1.el10_2.src.rpm">
          <filename>galera-26.4.25-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">df0b465c57dc3d3266563212de8579566bb64426ee470a2ccba7a691ba8b7a31</sum>
        </package>
        <package name="mariadb11.8" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">66a6027b38413e4dc316e308ca1c0f5cbb0b0fc310f5f01fe2bb7d6a900ae422</sum>
        </package>
        <package name="mariadb11.8-server" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-server-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">74528c9ad538dea1ebe2e1944ef864a16b09172fde36766fd1e3665181d47e1f</sum>
        </package>
        <package name="mariadb11.8-gssapi-server" arch="aarch64" epoch="3" version="11.8.6" release="2.el10_2" src="mariadb11.8-11.8.6-2.el10_2.src.rpm">
          <filename>mariadb11.8-gssapi-server-11.8.6-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fc2d3792ecf7c3104b03aed778de47dbcb638e17feb3fc3cd3669d08a2b1eec3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19043</id>
    <title>Moderate: corosync security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for corosync.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

* corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)

* corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35091" id="CVE-2026-35091" type="cve" title="CVE-2026-35091" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35092" id="CVE-2026-35092" type="cve" title="CVE-2026-35092" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453814" id="2453814" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453813" id="2453813" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19043" id="RLSA-2026:19043" type="self" title="RLSA-2026:19043" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="corosynclib" arch="aarch64" epoch="0" version="3.1.10" release="1.el10_2.1" src="corosync-3.1.10-1.el10_2.1.src.rpm">
          <filename>corosynclib-3.1.10-1.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">f92642e768d55bedad7ba21e9f0bf019131926e5bd4b7dbdf8f12004b5255ef9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19137</id>
    <title>Important: go-fdo-server security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-fdo-server.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.

Security Fix(es):

* github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability (CVE-2026-33816)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33816" id="CVE-2026-33816" type="cve" title="CVE-2026-33816" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455972" id="2455972" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19137" id="RLSA-2026:19137" type="self" title="RLSA-2026:19137" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="go-fdo-server-rendezvous" arch="noarch" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c12d91cf1a66cecad349cf5cd56929fcaad8b9040c2e3bcd1bcec0e1280da9e</sum>
        </package>
        <package name="go-fdo-server-owner" arch="noarch" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d7b6a4b8e44383771a8b9dcdd5015773c1565d780d2db22f0b840b56fa733fe9</sum>
        </package>
        <package name="go-fdo-server-manufacturer" arch="noarch" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">e96f54ca7abcda1e02fcb3f7c4282cf6748696902730abed8513027ad6218bc7</sum>
        </package>
        <package name="go-fdo-server" arch="aarch64" epoch="0" version="1.0.1" release="1.el10_2" src="go-fdo-server-1.0.1-1.el10_2.src.rpm">
          <filename>go-fdo-server-1.0.1-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b4667b3c0f06b2bb05b6b3d8903cf7bb5e02d41e8a54df43c296ca2b2f54df1f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19139</id>
    <title>Important: go-fdo-client security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for go-fdo-client.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.

Security Fix(es):

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19139" id="RLSA-2026:19139" type="self" title="RLSA-2026:19139" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="go-fdo-client" arch="aarch64" epoch="0" version="1.0.0" release="3.el10_2" src="go-fdo-client-1.0.0-3.el10_2.src.rpm">
          <filename>go-fdo-client-1.0.0-3.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f95cd910bd1ce374e97af26b45499c5d0464cd47ecfdda1735e5ecb2e406fb4e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19135</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449833" id="2449833" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456335" id="2456335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19135" id="RLSA-2026:19135" type="self" title="RLSA-2026:19135" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="aarch64" epoch="0" version="0.144.0" release="2.el10_2" src="opentelemetry-collector-0.144.0-2.el10_2.src.rpm">
          <filename>opentelemetry-collector-0.144.0-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">70ac8500248358a074738976964a36211d6b2f98084d69f4db63be56710a7e31</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19136</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19136" id="RLSA-2026:19136" type="self" title="RLSA-2026:19136" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-pcp" arch="aarch64" epoch="0" version="5.3.0" release="5.el10_2" src="grafana-pcp-5.3.0-5.el10_2.src.rpm">
          <filename>grafana-pcp-5.3.0-5.el10_2.aarch64.rpm</filename>
          <sum type="sha256">36f98f32ca40767ebabb3744357e09515df5c6144749012bcf06650ec46cf761</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19160</id>
    <title>Important: firefox security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Other issue in the WebRTC component (CVE-2026-8094)

* firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092)

* firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8090" id="CVE-2026-8090" type="cve" title="CVE-2026-8090" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8092" id="CVE-2026-8092" type="cve" title="CVE-2026-8092" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8094" id="CVE-2026-8094" type="cve" title="CVE-2026-8094" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467708" id="2467708" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467706" id="2467706" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467709" id="2467709" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19160" id="RLSA-2026:19160" type="self" title="RLSA-2026:19160" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.10.2" release="1.el10_2" src="firefox-140.10.2-1.el10_2.src.rpm">
          <filename>firefox-140.10.2-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">31fd99954f4f52fc24b2c55c121799de7f35e2058e3efa802b2c204454e513a8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19158</id>
    <title>Important: dnsmasq security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dnsmasq.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

Security Fix(es):

* dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

* dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-2291" id="CVE-2026-2291" type="cve" title="CVE-2026-2291" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4890" id="CVE-2026-4890" type="cve" title="CVE-2026-4890" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4891" id="CVE-2026-4891" type="cve" title="CVE-2026-4891" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4892" id="CVE-2026-4892" type="cve" title="CVE-2026-4892" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4893" id="CVE-2026-4893" type="cve" title="CVE-2026-4893" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5172" id="CVE-2026-5172" type="cve" title="CVE-2026-5172" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458517" id="2458517" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2439088" id="2439088" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458521" id="2458521" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458516" id="2458516" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458519" id="2458519" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458518" id="2458518" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19158" id="RLSA-2026:19158" type="self" title="RLSA-2026:19158" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dnsmasq-utils" arch="aarch64" epoch="0" version="2.90" release="7.el10_2" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-utils-2.90-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9c199f6a8ff8d6a2966ee08e39bfec4d644a08b0082b18c80bb2aa57bbc224c8</sum>
        </package>
        <package name="dnsmasq" arch="aarch64" epoch="0" version="2.90" release="7.el10_2" src="dnsmasq-2.90-7.el10_2.src.rpm">
          <filename>dnsmasq-2.90-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">767ea0ef5b247408c332eec2a37f27b0259bde47ee579e431f3619dcd3b60e93</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19128</id>
    <title>Important: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19128" id="RLSA-2026:19128" type="self" title="RLSA-2026:19128" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="aarch64" epoch="0" version="0.2.3" release="6.el10_2" src="yggdrasil-worker-package-manager-0.2.3-6.el10_2.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-6.el10_2.aarch64.rpm</filename>
          <sum type="sha256">80f87a6fe9f227595a0047ada94173aef061e5168114d791366e89933b797b06</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19134</id>
    <title>Important: grafana security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27877" id="CVE-2026-27877" type="cve" title="CVE-2026-27877" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452293" id="2452293" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19134" id="RLSA-2026:19134" type="self" title="RLSA-2026:19134" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="26.el10_2" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-10.2.6-26.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a2f183cca3d248a4eb1082a59cae453dc246d966ef44cd0cb7a47f7be4785bf4</sum>
        </package>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="26.el10_2" src="grafana-10.2.6-26.el10_2.src.rpm">
          <filename>grafana-selinux-10.2.6-26.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7f67730e106e9e3d9e6d81846fa93fab04cade9437d9f7aff3fccaef9be6a33b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19125</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)

* xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)

* xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451106" id="2451106" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451109" id="2451109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451113" id="2451113" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19125" id="RLSA-2026:19125" type="self" title="RLSA-2026:19125" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="aarch64" epoch="0" version="24.1.9" release="4.el10_2" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.9-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">3b9baa98bc72357080f1d20fd5c5d67a9945613a54bdb31cc238915107ade750</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19126" id="RLSA-2026:19126" type="self" title="RLSA-2026:19126" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil" arch="aarch64" epoch="0" version="0.4.9" release="4.el10_2" src="yggdrasil-0.4.9-4.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8c7da4c4334b7462b4c89a6b0577c458968e710f09627a58688e7e934f1340cd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19141</id>
    <title>Important: PackageKit security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for PackageKit.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.

Security Fix(es):

* PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41651" id="CVE-2026-41651" type="cve" title="CVE-2026-41651" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460604" id="2460604" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19141" id="RLSA-2026:19141" type="self" title="RLSA-2026:19141" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="PackageKit-gstreamer-plugin" arch="aarch64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-gstreamer-plugin-1.2.8-8.el10.aarch64.rpm</filename>
          <sum type="sha256">69fd4b095f9ca849878ef829824b7e3116b9de2cb3328b7d2017ea425fe43739</sum>
        </package>
        <package name="PackageKit-glib" arch="aarch64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-glib-1.2.8-8.el10.aarch64.rpm</filename>
          <sum type="sha256">d3e3c5900d637f44fb48df55ac71fb4d96ade038696b46dcc3e27861829ff875</sum>
        </package>
        <package name="PackageKit-gtk3-module" arch="aarch64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-gtk3-module-1.2.8-8.el10.aarch64.rpm</filename>
          <sum type="sha256">c15016674ef0c7c4006ceccf135471fe3d98432e2b5581b85014ffd32698ca17</sum>
        </package>
        <package name="PackageKit" arch="aarch64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-1.2.8-8.el10.aarch64.rpm</filename>
          <sum type="sha256">016fc142e16bc452c042c9d4737b5e67b7b760f092bc9369ac97e2ff0b89122e</sum>
        </package>
        <package name="PackageKit-command-not-found" arch="aarch64" epoch="0" version="1.2.8" release="8.el10" src="PackageKit-1.2.8-8.el10.src.rpm">
          <filename>PackageKit-command-not-found-1.2.8-8.el10.aarch64.rpm</filename>
          <sum type="sha256">57b5ce53cc931b4086aa4cd3d7b7f2963c8ace9a2be7b530fdf56f713a85de7e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19149</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dovecot.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. 

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452175" id="2452175" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452179" id="2452179" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2452172" id="2452172" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19149" id="RLSA-2026:19149" type="self" title="RLSA-2026:19149" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dovecot" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-2.3.21-19.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7ed641d11fba0d3441ae50668597a7143acf60db61bad837ddfae349504d8300</sum>
        </package>
        <package name="dovecot-pgsql" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pgsql-2.3.21-19.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6a64825c6d7edc5c6c7d0f27006dffa53b66a6618cfb0c4689d28e5bc4d995ed</sum>
        </package>
        <package name="dovecot-pigeonhole" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-19.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8f7364801b0b26c287b5ee56ec21df3703626560c735a137ca1677fc79fd5084</sum>
        </package>
        <package name="dovecot-mysql" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-mysql-2.3.21-19.el10_2.aarch64.rpm</filename>
          <sum type="sha256">28e6651af5c05aa71ff75ef4e90d447cc46847854c095f2e7f46226c8969d162</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19144</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33810" id="CVE-2026-33810" type="cve" title="CVE-2026-33810" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456335" id="2456335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19144" id="RLSA-2026:19144" type="self" title="RLSA-2026:19144" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipp-usb" arch="aarch64" epoch="0" version="0.9.27" release="7.el10_2" src="golang-github-openprinting-ipp-usb-0.9.27-7.el10_2.src.rpm">
          <filename>ipp-usb-0.9.27-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cfece3ff370fdfc86512f449077e4eb0b0fb9e5553d3168aef246f9fe5f2af0e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19133</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19133" id="RLSA-2026:19133" type="self" title="RLSA-2026:19133" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git-lfs" arch="aarch64" epoch="0" version="3.7.1" release="4.el10_2" src="git-lfs-3.7.1-4.el10_2.src.rpm">
          <filename>git-lfs-3.7.1-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d4d241fa8182600c6a4215731704032ee7877a7ce5521fe0531deeffeb99ca0d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19159</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477116" id="2477116" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19159" id="RLSA-2026:19159" type="self" title="RLSA-2026:19159" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nginx-mod-http-perl" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">32b74ce193bc81417c9c090710aa3742f8959e6a922e320dd59d192f6cdf1453</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">65ab29b117b1588897fed88450a0860462b1413e90399737ac0236c43277dae5</sum>
        </package>
        <package name="nginx" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">91fedc96b521ee0eff06e623e63cc40bcbb6e88cc2fad4fa533d44c5a388382d</sum>
        </package>
        <package name="nginx-core" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">34654f629fc960cee2e806b05cd253c7ca8a97f16ba75b6f1b1e497318a38014</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">f602181b6e34477f7e533d4ff0e116070138275ac8bdb1746c01e7768ea188bd</sum>
        </package>
        <package name="nginx-mod-stream" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">f9c07e8e6c806103475c266701765526928af655b3e54bb05f8ff787a9e31965</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">d1518dceb4603016ead01c97ad7c608bb12b7ebffc536db748331623ef529601</sum>
        </package>
        <package name="nginx-mod-mail" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">766bddc7132f14ab9eb67d6d796735e8290edc5ec3e9766ede3405f4bb4d47bd</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.3" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.3.noarch.rpm</filename>
          <sum type="sha256">9f55e111b0ab84ca6b9651a282d88c4ecaaa74197e0539f87d4e52786530abc1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19146</id>
    <title>Important: openexr security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file (CVE-2026-34588)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34588" id="CVE-2026-34588" type="cve" title="CVE-2026-34588" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455408" id="2455408" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19146" id="RLSA-2026:19146" type="self" title="RLSA-2026:19146" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="openexr-libs" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_2.2" src="openexr-3.1.10-8.el10_2.2.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">5d128f64a5d2dbf410cf2f6c6297ddecc68f1996a5d329023673dcbaf7155c00</sum>
        </package>
        <package name="openexr" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_2.2" src="openexr-3.1.10-8.el10_2.2.src.rpm">
          <filename>openexr-3.1.10-8.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">1c2f6291a47a1c913cb0d391f92f6ebf7268952e5454b3f28781bbf3c4ee2438</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19142</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Denial of service via heap use-after-free during auto-reconnect (CVE-2026-25997)

* freerdp: FreeRDP: Denial of service due to use-after-free vulnerability (CVE-2026-25952)

* freerdp: FreeRDP: Denial of Service via double free vulnerability during disconnect (CVE-2026-26986)

* freerdp: FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId (CVE-2026-29775)

* freerdp: FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks (CVE-2026-31885)

* freerdp: FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0 (CVE-2026-31884)

* freerdp: FreeRDP: Denial of Service via crafted audio data in RDP (CVE-2026-31883)

* FreeRDP: FreeRDP: Information disclosure via heap memory out of bounds read (CVE-2026-33985)

* FreeRDP: FreeRDP: Information disclosure and denial of service via heap-buffer-overflow read (CVE-2026-33982)

* FreeRDP: FreeRDP: Memory corruption vulnerability allows denial of service or arbitrary code execution (CVE-2026-33987)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25952" id="CVE-2026-25952" type="cve" title="CVE-2026-25952" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25997" id="CVE-2026-25997" type="cve" title="CVE-2026-25997" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26986" id="CVE-2026-26986" type="cve" title="CVE-2026-26986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29775" id="CVE-2026-29775" type="cve" title="CVE-2026-29775" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31883" id="CVE-2026-31883" type="cve" title="CVE-2026-31883" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31884" id="CVE-2026-31884" type="cve" title="CVE-2026-31884" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31885" id="CVE-2026-31885" type="cve" title="CVE-2026-31885" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33982" id="CVE-2026-33982" type="cve" title="CVE-2026-33982" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33985" id="CVE-2026-33985" type="cve" title="CVE-2026-33985" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33987" id="CVE-2026-33987" type="cve" title="CVE-2026-33987" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442782" id="2442782" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442768" id="2442768" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453226" id="2453226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447383" id="2447383" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2442764" id="2442764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453217" id="2453217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447386" id="2447386" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447385" id="2447385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447379" id="2447379" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453218" id="2453218" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19142" id="RLSA-2026:19142" type="self" title="RLSA-2026:19142" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="12.el10_2.5" src="freerdp-3.10.3-12.el10_2.5.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">14a90322d19fd29dcd7d026384d1fea4406dda91392c9c884ec64ec14ec9cd3a</sum>
        </package>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="12.el10_2.5" src="freerdp-3.10.3-12.el10_2.5.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">46817e7571ada7fe7c742feaa125c1fd163bcdf29f29009f75c0a096f447c845</sum>
        </package>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="12.el10_2.5" src="freerdp-3.10.3-12.el10_2.5.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">0dae11ca4ab408c91b440a8d321102d7e297f06daffc75335f51bcd91a90d94c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19138</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* pyjwt: PyJWT accepts unknown `crit` header extensions (RFC 7515 ?4.1.11 MUST violation) (CVE-2026-32597)

* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-30922" id="CVE-2026-30922" type="cve" title="CVE-2026-30922" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32597" id="CVE-2026-32597" type="cve" title="CVE-2026-32597" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448553" id="2448553" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2447194" id="2447194" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19138" id="RLSA-2026:19138" type="self" title="RLSA-2026:19138" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e313ae76fb6cca6044434a05c706606664e2d6c4f1de77db499fc7d76f490b04</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">eb71027624d94c6d4e9035a77cf79591a237785ac7c92e6a368eeb0fb84e50dd</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">eb417f3f391c9f5819c3c544fc829f18f2c9db5192f1709a49c0d259acef4d1c</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">cf8e151e7383dedfed17e855b7b3127c7a501f86c55a952bf476eb241793def7</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8dd59bb28a870bc7cf2538ba05b0218e009bd791cb8cfe8f99c12f0fb8fc659f</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8e4fa97fe5d874c338208294d8fa1048ab001800de29771a3c2cabcccfa594ff</sum>
        </package>
        <package name="fence-agents-kdump" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-kdump-4.16.0-21.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">5578da04210394c60fccc70e840f418d57e2bfa3a8dfc8fc94346b49bc2df273</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">f18807196e8d5904ea18f6fe1f18db55ca016ade12f9e391c08e8732d3fe6e97</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-21.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">4f730a90fd7e94b6e267154169c6ee94824062d14dabe071498accc29e1bd11f</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">e6623dfaf57cddcfe844180fd57ebd8b47e62191adbd6ee2665541ee127dc77e</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6f1579857dae4eef545f855dabb98bb4a6d67f7267581daac3c580fd902a85e8</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6b2026aebecd13fd7563ec67616f51d7452bd4443663172ddcc76d103b9a3c0d</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">087f1f81fcb50f1de534ff6308dfd11f67104ded8de1f847075163061b1c3cf4</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">93dd4f6c42a5163d0b0ab3e9c7f0efa3908bc448cada2cc2aa65553722425533</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">09803b5e0f4a072a8570b994fe778463d20191f9652abd3609662e21d564b448</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">97dade5d762a9a66c52c8b27296d4c72a656f3b1e4c6ca966a0de3277a17d27e</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6c40740e4b3302416d7331fdce5a2967412d6a8d72bae94501faed33b61f6245</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">0f0042a54c972ff0c5098925a8b21dc3ae863a569b2e640d83da14095a0eab86</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7b09b8e17314d5e0f86ca83535057a0e66ec708e0f51fb4afe90d0467470096f</sum>
        </package>
        <package name="fence-agents-all" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-all-4.16.0-21.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">ae44ba9083b1911ff8d9c9fe9db3fcef3dd68f5e15ca7a08ccfb3e38c145b9a0</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">5d59b9a4a44d559842ae1e8603da2059c2c009a20074177a8bc9caa5a6d61ca0</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">97f7504c710ee2a7167a655bd952fd34ed4620a0d859b3d7fc0f057fc934a3ac</sum>
        </package>
        <package name="fence-agents-redfish" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-redfish-4.16.0-21.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">17eecc55890617bd5683865c4d819e985b31a6ff51a1634198cf6c407c823d87</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">435b24d9fc09de1029567e5332592e7843d73ecc779c4401804769b304a57edf</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6a665963f998e86c6de70eb27f84f4e0df0eba68ef8274533172559c0c435b79</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">0405b53d9c8814aa1a7e4e2c10d7ffa723bff98f47bfbf22780b7e8bed8afd87</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7290f1a1b3add3d5cd6d87bdc403e8124bff5f53384e4106e1f81c2b72427587</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">85d369f63f858e394f14ac9ffd86ab7612bb11793c2738c6c10760dad380f3f8</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7f77d3f655424098372cde5f06c753389f79b3b49cadb8da10feb9a1380b80f5</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6c5aa019be07f43d9930f3175bfc84b0d9e6b47c00e037b74454decaa0b4e38f</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">5d4dee6a654eaca81c146a27aa22564a256570027f9f92cd4d8d4b8a4ee4382c</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8aa2e8862cda55e507a8f04bafea483e8915fa857e68984a9c5e0ede6aba2653</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">472ab4e4f241fefa16ed42e8502cbc3a84dbf71b20650dda2a29ef4cbb11808b</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">dfed46d93e17ce7bb3982962e3cf70117ed35da32ef02b3c35c8faa6449291c2</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">22b7b0b4d7da4260c8ccc3047be464f596ee83a02e9d6c610661c20401adaabe</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">7e891ac7bb4361a3c733157c9bacba0d4c5c26eae6346df10b017c3b4ebfaa2c</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">74cc0b85b794d1dd22ad67291d073cfbb0bcebe1708fd6dbc1cd8a9f8de632da</sum>
        </package>
        <package name="fence-agents-common" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-common-4.16.0-21.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">fc347604a6f02224a79e37593edae56b1e616dad16b82ed6b3cde6484b3e819e</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">6f23c4a2f8affb83ab9877768d5b75244949eee12184e209ed0d14e398e73853</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">2467d6ee4c601d1d7e5e02b3bdea56d95ec3c8ad414cbb58d7da81333502e9c1</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.1" src="fence-agents-4.16.0-21.el10_2.1.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">13707c8f341986d0ec1deabfdd9d7afc0a62152a547f15cd18de19b2772fb06e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19153</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.10.1 and Firefox 150.0.1 (CVE-2026-7323)

* firefox: thunderbird: Information disclosure due to incorrect boundary conditions in the Audio/Video component (CVE-2026-7320)

* firefox: thunderbird: Memory safety bugs fixed in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1 (CVE-2026-7322)

* firefox: thunderbird: webrtc: Sandbox escape due to incorrect boundary conditions in the WebRTC: Networking component (CVE-2026-7321)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7320" id="CVE-2026-7320" type="cve" title="CVE-2026-7320" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7321" id="CVE-2026-7321" type="cve" title="CVE-2026-7321" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7322" id="CVE-2026-7322" type="cve" title="CVE-2026-7322" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7323" id="CVE-2026-7323" type="cve" title="CVE-2026-7323" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463485" id="2463485" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463484" id="2463484" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463483" id="2463483" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463481" id="2463481" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19153" id="RLSA-2026:19153" type="self" title="RLSA-2026:19153" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.10.1" release="1.el10_2" src="thunderbird-140.10.1-1.el10_2.src.rpm">
          <filename>thunderbird-140.10.1-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f9725baebb685f48f2f1dd6fd65c31a4f969db57316eabe0f0cf0cc21005dd52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19127</id>
    <title>Important: gdk-pixbuf2 security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk-pixbuf: gdk-pixbuf: Denial of Service via heap-based buffer overflow when processing a specially crafted JPEG image (CVE-2026-5201)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5201" id="CVE-2026-5201" type="cve" title="CVE-2026-5201" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453291" id="2453291" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19127" id="RLSA-2026:19127" type="self" title="RLSA-2026:19127" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gdk-pixbuf2-devel" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">66f0ddb3a8e7a81cd8744737a3669dd9fc916cdd47544693448d89a5e6f62700</sum>
        </package>
        <package name="gdk-pixbuf2-modules" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">930072744e52e81c5e3401ad09af1375b4c520b0298914a764a2eb8f196bd5f9</sum>
        </package>
        <package name="gdk-pixbuf2" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_1.5" src="gdk-pixbuf2-2.42.12-4.el10_1.5.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_1.5.aarch64.rpm</filename>
          <sum type="sha256">d4ca9bca3a7b77219790cf0eb4177bb688fc983f568d7f0816f789c33e83fe96</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19154</id>
    <title>Important: giflib security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for giflib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>giflib is a library for reading and writing gif images.

Security Fix(es):

* giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2446207" id="2446207" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19154" id="RLSA-2026:19154" type="self" title="RLSA-2026:19154" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="giflib" arch="aarch64" epoch="0" version="5.2.1" release="24.el10_2" src="giflib-5.2.1-24.el10_2.src.rpm">
          <filename>giflib-5.2.1-24.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8eb16649aa0b5bf0ec03714f426812f69d4074dba104c9f6af3efa0535b4e172</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19150</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2450768" id="2450768" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19150" id="RLSA-2026:19150" type="self" title="RLSA-2026:19150" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libtiff-devel" arch="aarch64" epoch="0" version="4.6.0" release="8.el10_2.1" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-devel-4.6.0-8.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">ed248712719c1eb17041283b88955e2129d472267de70852e6d4bf9d3c983320</sum>
        </package>
        <package name="libtiff" arch="aarch64" epoch="0" version="4.6.0" release="8.el10_2.1" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-4.6.0-8.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">847e3e52f1ca8b8378ba03c3905eb3c8e9c7b71ea3f0472471c77610251cb363</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:19560</id>
    <title>Important: libsndfile security update</title>
    <issued date="2026-05-29 16:03:24" />
    <updated date="2026-06-12 12:06:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsndfile.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. 

Security Fix(es):

* libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37555" id="CVE-2026-37555" type="cve" title="CVE-2026-37555" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463856" id="2463856" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:19560" id="RLSA-2026:19560" type="self" title="RLSA-2026:19560" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsndfile-utils" arch="aarch64" epoch="0" version="1.2.2" release="6.el10_2.1" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-utils-1.2.2-6.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">9c30c4671bff704d5f4e7ca160fb43debd1ab1158d8dbcae3c80ea939e186ba0</sum>
        </package>
        <package name="libsndfile" arch="aarch64" epoch="0" version="1.2.2" release="6.el10_2.1" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-1.2.2-6.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">ea9e1b6172e30672833086078b310d301af51b3ec157937204881531f12a14d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:20693</id>
    <title>Moderate: mysql8.4 security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-22004)

* mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22001)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34271)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22009)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35237)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-21998)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22005)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35238)

* mysql: DML unspecified vulnerability (CPU Apr 2026) (CVE-2026-35239)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22002)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-35236)

* mysql: JSON unspecified vulnerability (CPU Apr 2026) (CVE-2026-34308)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-34303)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-35240)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2026) (CVE-2026-22017)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2026) (CVE-2026-34304)

* mysql: Information Schema unspecified vulnerability (CPU Apr 2026) (CVE-2026-22015)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34276)

* mysql: Group Replication Plugin unspecified vulnerability (CPU Apr 2026) (CVE-2026-34270)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-21998" id="CVE-2026-21998" type="cve" title="CVE-2026-21998" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22001" id="CVE-2026-22001" type="cve" title="CVE-2026-22001" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22002" id="CVE-2026-22002" type="cve" title="CVE-2026-22002" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22004" id="CVE-2026-22004" type="cve" title="CVE-2026-22004" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22005" id="CVE-2026-22005" type="cve" title="CVE-2026-22005" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22009" id="CVE-2026-22009" type="cve" title="CVE-2026-22009" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22015" id="CVE-2026-22015" type="cve" title="CVE-2026-22015" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-22017" id="CVE-2026-22017" type="cve" title="CVE-2026-22017" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34270" id="CVE-2026-34270" type="cve" title="CVE-2026-34270" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34271" id="CVE-2026-34271" type="cve" title="CVE-2026-34271" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34276" id="CVE-2026-34276" type="cve" title="CVE-2026-34276" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34303" id="CVE-2026-34303" type="cve" title="CVE-2026-34303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34304" id="CVE-2026-34304" type="cve" title="CVE-2026-34304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34308" id="CVE-2026-34308" type="cve" title="CVE-2026-34308" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35236" id="CVE-2026-35236" type="cve" title="CVE-2026-35236" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35237" id="CVE-2026-35237" type="cve" title="CVE-2026-35237" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35238" id="CVE-2026-35238" type="cve" title="CVE-2026-35238" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35239" id="CVE-2026-35239" type="cve" title="CVE-2026-35239" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35240" id="CVE-2026-35240" type="cve" title="CVE-2026-35240" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460348" id="2460348" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460275" id="2460275" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460326" id="2460326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460324" id="2460324" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460325" id="2460325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460279" id="2460279" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460329" id="2460329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460316" id="2460316" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460274" id="2460274" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460358" id="2460358" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460312" id="2460312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460315" id="2460315" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460342" id="2460342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460276" id="2460276" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460323" id="2460323" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460295" id="2460295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460344" id="2460344" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460356" id="2460356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460335" id="2460335" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:20693" id="RLSA-2026:20693" type="self" title="RLSA-2026:20693" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.9" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.9-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-common-8.4.9-1.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">49a7cb60b8643ac1320705e9aaeb27ec457b20b459fd26e15a56a7ba8367cfa8</sum>
        </package>
        <package name="mysql8.4-server" arch="aarch64" epoch="0" version="8.4.9" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.9-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-server-8.4.9-1.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">3d2396a360c967a2ef88222d8648b85f16181df167d1229c20442b1162693344</sum>
        </package>
        <package name="mysql8.4" arch="aarch64" epoch="0" version="8.4.9" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.9-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-8.4.9-1.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">788c4c69163c73658c47d52beb3ea20d4d9e485824e200b92233324d83c675b0</sum>
        </package>
        <package name="mysql8.4-libs" arch="aarch64" epoch="0" version="8.4.9" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.9-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-libs-8.4.9-1.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">1bdb65d912e545d215588f0b0a37fc44f3c41852815efabcef4b116491a0b207</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.9" release="1.el10_2.rocky.0.1" src="mysql8.4-8.4.9-1.el10_2.rocky.0.1.src.rpm">
          <filename>mysql8.4-errmsg-8.4.9-1.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">c81dc1ecc70ef153aa6533294a7cb062200cf6cac283deedcdb243c69fd63e6d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21286</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.127 and .NET Runtime 8.0.27.Security Fix(es):

* serialize-javascript: serialize-javascript: Denial of Service via specially crafted array-like object serialization (CVE-2026-34043)

* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34043" id="CVE-2026-34043" type="cve" title="CVE-2026-34043" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453284" id="2453284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476605" id="2476605" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21286" id="RLSA-2026:21286" type="self" title="RLSA-2026:21286" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">732df22c33c8419e59e42a26b7224c02d388518d109dd422f98a9f890d675e3f</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.127" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.127-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c21becff6a075a6837f95c16863512aaff18a19e830590caaa6ad9a995c02615</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ce1a4dd4877863a087ad3a902d5df11af7ef2d3986170fa9b518536311438808</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4dcea3515d14f9dd90ce6bf6164eee3e8cfe3b0a9805d02da4ed69a6854b8ef9</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a04311c0a3da8e418f8b0baa87d59036f4cafe1a3c04236959826f23344a7a3b</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">99068c8da9a2b2af65e8bac1e05fb3a2b80923f5b47b4f802c41e4556a68a1b6</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.127" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.127-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">621c23eda64ae0b9a20e56d7eb0d2ba4ed339bb9ace8e21c014e901b4c1b2907</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.127" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.127-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2b76238c8398ff78217a6ebc87bef25f2ef8c94aa3621facbfb3758cb3128e28</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9693e3b0779db554b5805eade0c055d0b3b7df0177c1b0da6f478fac07405ce6</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ef48797b30317cae624960d37f9c1b1ac511e6ed5bced49122d80728a2d37756</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.27" release="1.el10_2" src="dotnet8.0-8.0.127-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fe726f090f138c784adefef66297702455d2e0d8fa463ed4ba46f80659b13115</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21380</id>
    <title>Important: firefox security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

* firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

* firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

* firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

* firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)

* firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

* firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)

* firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

* firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)

* firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

* firefox: Privilege escalation in the Security component (CVE-2026-8970)

* firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

* firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

* firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

* firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)

* firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8388" id="CVE-2026-8388" type="cve" title="CVE-2026-8388" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8391" id="CVE-2026-8391" type="cve" title="CVE-2026-8391" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8401" id="CVE-2026-8401" type="cve" title="CVE-2026-8401" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8946" id="CVE-2026-8946" type="cve" title="CVE-2026-8946" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8947" id="CVE-2026-8947" type="cve" title="CVE-2026-8947" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8950" id="CVE-2026-8950" type="cve" title="CVE-2026-8950" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8953" id="CVE-2026-8953" type="cve" title="CVE-2026-8953" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8954" id="CVE-2026-8954" type="cve" title="CVE-2026-8954" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8955" id="CVE-2026-8955" type="cve" title="CVE-2026-8955" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8956" id="CVE-2026-8956" type="cve" title="CVE-2026-8956" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8957" id="CVE-2026-8957" type="cve" title="CVE-2026-8957" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8958" id="CVE-2026-8958" type="cve" title="CVE-2026-8958" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8961" id="CVE-2026-8961" type="cve" title="CVE-2026-8961" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8962" id="CVE-2026-8962" type="cve" title="CVE-2026-8962" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8968" id="CVE-2026-8968" type="cve" title="CVE-2026-8968" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8970" id="CVE-2026-8970" type="cve" title="CVE-2026-8970" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8974" id="CVE-2026-8974" type="cve" title="CVE-2026-8974" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8975" id="CVE-2026-8975" type="cve" title="CVE-2026-8975" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479873" id="2479873" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479876" id="2479876" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479842" id="2479842" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476469" id="2476469" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479846" id="2479846" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479871" id="2479871" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479853" id="2479853" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479839" id="2479839" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476475" id="2476475" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479855" id="2479855" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479860" id="2479860" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479852" id="2479852" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479880" id="2479880" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479849" id="2479849" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479847" id="2479847" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479848" id="2479848" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479840" id="2479840" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476492" id="2476492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21380" id="RLSA-2026:21380" type="self" title="RLSA-2026:21380" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.11.0" release="1.el10_2" src="firefox-140.11.0-1.el10_2.src.rpm">
          <filename>firefox-140.11.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">419ccba7a08234f08375dd9a10df2d21ebf70c0dd3ec72d1feda1b6948fc0975</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21433</id>
    <title>Important: httpd security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059)

* httpd: mod_proxy_ajp: heap-based buffer over-read due to missing null-termination check (CVE-2026-34032)

* httpd: mod_proxy_ajp: off-by-one out-of-bounds reads in AJP getter functions (CVE-2026-33857)

* httpd: mod_authn_socache: NULL pointer dereference can cause a child process crash (CVE-2026-33007)

* Apache HTTP Server: mod_proxy_ajp: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28780" id="CVE-2026-28780" type="cve" title="CVE-2026-28780" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33007" id="CVE-2026-33007" type="cve" title="CVE-2026-33007" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33857" id="CVE-2026-33857" type="cve" title="CVE-2026-33857" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34032" id="CVE-2026-34032" type="cve" title="CVE-2026-34032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34059" id="CVE-2026-34059" type="cve" title="CVE-2026-34059" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464940" id="2464940" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464953" id="2464953" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466913" id="2466913" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464952" id="2464952" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2465299" id="2465299" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21433" id="RLSA-2026:21433" type="self" title="RLSA-2026:21433" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_lua" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">cd0e0bc19b7aae313dc2b8ba9007ac9bd6fd76002bd8c8ecc9e2ba60c36681d7</sum>
        </package>
        <package name="mod_proxy_html" arch="aarch64" epoch="1" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">f68167020c910d475f8cda5927608da15651e44cdc28a327b570a673cd4f4f9c</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">12f3d622e66025e8b1f93324994cf9d6f15b9ef297208d7299b58c2c25d70d84</sum>
        </package>
        <package name="mod_ldap" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">2c53de681eaf34fd3eef103851cbc36b34c566df441fb68dc38efe8e91624310</sum>
        </package>
        <package name="httpd" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">3ff9663d3c306aac47ff7400ceb8c19dfb41a717be8cd0bbb43395d2802a7bda</sum>
        </package>
        <package name="mod_ssl" arch="aarch64" epoch="1" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">6052f30ac7aac9e252559d54b629011d37d49e77fafb63b06438d5ff51f3e643</sum>
        </package>
        <package name="httpd-tools" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">76a2807ebaa45620f17e8127a2edec66ee82c47e3b6ca71ffc7d647ba8f17aae</sum>
        </package>
        <package name="httpd-core" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">80b0212635ba4e62bbad9cd80b6113ac533c3c58d70327eedf8ec66a832373b3</sum>
        </package>
        <package name="mod_session" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">f2ae28b49d981450be6e2e5b18ba29d30980f6e560ce803ddef04b3574f8e4ff</sum>
        </package>
        <package name="httpd-devel" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">ef5939eaf5b3894970cb36d371e9ce47597dfe15ff0ebaeb98335ce889c46408</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.1" src="httpd-2.4.63-13.el10_2.1.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">720cb79416a3b763521c882b2e5c36923f8e9d8a05fbf06354abaa376556ba4a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21754</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.117 and .NET Runtime 9.0.16.Security Fix(es):

* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476605" id="2476605" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21754" id="RLSA-2026:21754" type="self" title="RLSA-2026:21754" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.117-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7730dad7b04f28daa9be378c0e2f4e42d02a41e5ec28213c3eea463308b777ca</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.117-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f7602eecc2b7876e82e55588caf9103458afd66f1394d2c7825195a7970e8c58</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.117-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1f4526338234949e667b4c16b0a7736328db296a9c975856d6c8b46c3694a839</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">87882999498dbc01021865727bdcef71a91f8436e82f667f087d935330c2232c</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">43fe1374e33effeb07a2727b6e8fdee32e8523d5e2d77be09c1574d6ce1e46b5</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8b2d8a84488ecdc3b8511f3781752e5e76bf8c832b061d8a906e629f485abae9</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b8c1c1f8972efd1ff17fa4de2491ee37e1a03fdc46253a7fe80a6afe8bb45976</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9d5baea6dc8a041f8f11d2b347a0d99dea63395368e55e4400f24098a81a37f1</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">63450342a6c5da1c9dc3f1cab050bfa2e6ecebef2d74ab82e53d26878356a5b3</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d2168d057ed3a0c69497c70639f1f7df64396c39a7dd4cbb8ebcf0ad8bae2495</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.16" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.16-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d66d84ebf1308cd45f9d61d47ff12e4d8906aaf904c3e1f161c0a32ca032e923</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.117-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2ae4225978cf6a8450fc28f357af6af0d264b0f15d84dfc743c1bc824eee7f6f</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.117" release="1.el10_2" src="dotnet9.0-9.0.117-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.117-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">75a19f68a55d12e8b23c430ef1a3a9f88322bdb4c87ba079ca239fb5651588ce</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:21757</id>
    <title>Important: flatpak security update</title>
    <issued date="2026-06-04 12:04:37" />
    <updated date="2026-06-18 12:06:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for flatpak.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux.

Security Fix(es):

* flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078)

* flatpak: Flatpak: Arbitrary file deletion on host via improper cache file path validation (CVE-2026-34079)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34078" id="CVE-2026-34078" type="cve" title="CVE-2026-34078" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34079" id="CVE-2026-34079" type="cve" title="CVE-2026-34079" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456284" id="2456284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456276" id="2456276" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:21757" id="RLSA-2026:21757" type="self" title="RLSA-2026:21757" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="flatpak-selinux" arch="noarch" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-selinux-1.16.0-9.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">8e8051ccca5bc1ed0f8e0434a9279d799f68b5537c3c0a924f91bac9f4b1896e</sum>
        </package>
        <package name="flatpak" arch="aarch64" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-1.16.0-9.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">e8123fa1cdb3bbc79dac72edb1a311aaed5c3a935b225bc56e72d900b47b933b</sum>
        </package>
        <package name="flatpak-libs" arch="aarch64" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-libs-1.16.0-9.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">83733e45b4587cffc52c7c27ba7d6be16e565dcd4885ec7ca6a83a5688938610</sum>
        </package>
        <package name="flatpak-session-helper" arch="aarch64" epoch="0" version="1.16.0" release="9.el10_2.1" src="flatpak-1.16.0-9.el10_2.1.src.rpm">
          <filename>flatpak-session-helper-1.16.0-9.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">730956f7ed4c2e676f94342992e7ac21da4b654499c64957de689d397469229a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22141</id>
    <title>Moderate: go-fdo-client and go-fdo-server security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for go-fdo-server, go-fdo-client.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This package provides a server-side implementation of the FIDO Device Onboard (FDO) specification, written in Go. FDO is an open standard for the late binding of device credentials, allowing for automated and secure on-boarding of devices when they are first powered on in their final location.

Security Fix(es):

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22141" id="RLSA-2026:22141" type="self" title="RLSA-2026:22141" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="go-fdo-client" arch="aarch64" epoch="0" version="1.0.0" release="4.el10_2" src="go-fdo-client-1.0.0-4.el10_2.src.rpm">
          <filename>go-fdo-client-1.0.0-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">92b910d4f2d815e987aa41a8280e0b83467850c0decbbcd3231079b0a9dc5c3e</sum>
        </package>
        <package name="go-fdo-server-manufacturer" arch="noarch" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-manufacturer-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">5ccda77fae009861babf98ed74294b8b0972a70e6e0137b7cbfcbe98a9a33d71</sum>
        </package>
        <package name="go-fdo-server" arch="aarch64" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-1.0.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">305b006f0892da968f49fe5331a6e1046b1cd1c4ff32d4483b294bd4f8b7fc82</sum>
        </package>
        <package name="go-fdo-server-rendezvous" arch="noarch" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-rendezvous-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">0de29160e7a14baffc3b6c08b83ec8bdc85d745f0739374ea66ae9cff5630789</sum>
        </package>
        <package name="go-fdo-server-owner" arch="noarch" epoch="0" version="1.0.1" release="2.el10_2" src="go-fdo-server-1.0.1-2.el10_2.src.rpm">
          <filename>go-fdo-server-owner-1.0.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">5a79bbadc989598ed366bad7891eaac725b61f2de54f5892714727c3b480f6c0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22145</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.108 and .NET Runtime 10.0.8.Security Fix(es):

* dotnet: .NET: infinite loop allows an attacker to cause a denial of service (CVE-2026-42899)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42899" id="CVE-2026-42899" type="cve" title="CVE-2026-42899" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476605" id="2476605" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22145" id="RLSA-2026:22145" type="self" title="RLSA-2026:22145" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">716d495cf3de1c0444c470068808b089b92070d87e0d2684074cacc5dd338b20</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b0107674bff08cd744e6b0be4fdf6f5c1968144f9eca7cb5e169096cb546596d</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="aarch64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.108-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">29ace814376e0df5bb00892bca7973a9eb33b5c9afa3749cc20ce19badc0ed6b</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="aarch64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.108-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">eed3faa7c9e73a6aa0bdc8e75674d926b3450421db3e90bc9181320ab7f29fb1</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1ff7f27acfddc082d12937254211f7aa41904e8f4df4b6d2161c6e9a2c458270</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e26066c98035a516624b9ab06434be66d27e4d997c9693c70323fcd1a93040ba</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="aarch64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.108-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">159740465fc3b66b646e12e621f87d29a44e25400a94265ef17daf772c9d8f2a</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a6b77d2623a484a9034de44acefe720a6ceea8ab370d54da5de56adacf8c662a</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">12a6bf0832d6016a176ee2fc5deeea5c5ed61d5764127f4021645fa7dd490c3f</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" arch="aarch64" epoch="0" version="10.0.108" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.108-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b2937c8e3fbc440ea85db68c061b703e3d7f5e47cc6e458a8cfb362595374e77</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">85176ff3d8f0a0e9523d34998160a667fc464da4d8f9659f035a78257edd5355</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">52063a6ad42fe3fd6fb3d875eff01966d59e232db6ed16ec33d3c5d020003bbd</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.8" release="1.el10_2" src="dotnet10.0-10.0.108-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">03c07f679db103238664f8db5059827534a172e61b436c6287b16aa947fcfeed</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22325</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388)

* firefox: Other issue in the JavaScript Engine component (CVE-2026-8391)

* firefox: Sandbox escape in the Profile Backup component (CVE-2026-8401)

* firefox: Integer overflow in the Networking: JAR component (CVE-2026-8956)

* firefox: Memory safety bugs fixed in Firefox ESR 115.36, Firefox ESR 140.11 and Firefox 151 (CVE-2026-8975)

* firefox: Privilege escalation in the DOM: Workers component (CVE-2026-8955)

* firefox: Denial-of-service due to invalid pointer in the Audio/Video: Web Codecs component (CVE-2026-8968)

* firefox: Incorrect boundary conditions, integer overflow in the Audio/Video component (CVE-2026-8954)

* firefox: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-8958)

* firefox: Incorrect boundary conditions in the Audio/Video: Web Codecs component (CVE-2026-8946)

* firefox: Privilege escalation in the Security component (CVE-2026-8970)

* firefox: Same-origin policy bypass in the Networking: HTTP component (CVE-2026-8950)

* firefox: Memory safety bugs fixed in Firefox ESR 140.11 and Firefox 151 (CVE-2026-8974)

* firefox: Sandbox escape due to use-after-free in the Disability Access APIs component (CVE-2026-8953)

* firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component (CVE-2026-8959)

* firefox: Spoofing issue in the Form Autofill component (CVE-2026-8961)

* firefox: Use-after-free in the DOM: Bindings (WebIDL) component (CVE-2026-8947)

* firefox: Mitigation bypass in the DOM: Security component (CVE-2026-8962)

* firefox: Privilege escalation in the Enterprise Policies component (CVE-2026-8957)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8388" id="CVE-2026-8388" type="cve" title="CVE-2026-8388" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8391" id="CVE-2026-8391" type="cve" title="CVE-2026-8391" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8401" id="CVE-2026-8401" type="cve" title="CVE-2026-8401" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8946" id="CVE-2026-8946" type="cve" title="CVE-2026-8946" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8947" id="CVE-2026-8947" type="cve" title="CVE-2026-8947" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8950" id="CVE-2026-8950" type="cve" title="CVE-2026-8950" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8953" id="CVE-2026-8953" type="cve" title="CVE-2026-8953" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8954" id="CVE-2026-8954" type="cve" title="CVE-2026-8954" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8955" id="CVE-2026-8955" type="cve" title="CVE-2026-8955" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8956" id="CVE-2026-8956" type="cve" title="CVE-2026-8956" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8957" id="CVE-2026-8957" type="cve" title="CVE-2026-8957" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8958" id="CVE-2026-8958" type="cve" title="CVE-2026-8958" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8959" id="CVE-2026-8959" type="cve" title="CVE-2026-8959" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8961" id="CVE-2026-8961" type="cve" title="CVE-2026-8961" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8962" id="CVE-2026-8962" type="cve" title="CVE-2026-8962" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8968" id="CVE-2026-8968" type="cve" title="CVE-2026-8968" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8970" id="CVE-2026-8970" type="cve" title="CVE-2026-8970" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8974" id="CVE-2026-8974" type="cve" title="CVE-2026-8974" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8975" id="CVE-2026-8975" type="cve" title="CVE-2026-8975" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479873" id="2479873" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479876" id="2479876" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479842" id="2479842" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476469" id="2476469" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479846" id="2479846" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479871" id="2479871" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479853" id="2479853" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479839" id="2479839" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476475" id="2476475" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479855" id="2479855" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479860" id="2479860" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479852" id="2479852" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479880" id="2479880" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479849" id="2479849" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479861" id="2479861" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479847" id="2479847" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479848" id="2479848" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479840" id="2479840" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476492" id="2476492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22325" id="RLSA-2026:22325" type="self" title="RLSA-2026:22325" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.11.0" release="1.el10_2" src="thunderbird-140.11.0-1.el10_2.src.rpm">
          <filename>thunderbird-140.11.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">912871c5e7d4ad0f0c21991a45bd49d0d3ce518a4959ab11264d6bb6cec0ed99</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22450</id>
    <title>Important: osbuild-composer security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for osbuild-composer.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud.  It is compatible with composer-cli and cockpit-composer clients.

Security Fix(es):

* golang: archive/zip: Excessive CPU consumption when building archive index in archive/zip (CVE-2025-61728)

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* github.com/jackc/pgproto3: pgproto3: Denial of Service via negative field length in DataRow message (CVE-2026-4427,GHSA-jqcq-xjh3-6g23)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/jackc/pgproto3/v2: github.com/jackc/pgproto3/v2: Denial of Service via malicious PostgreSQL server (CVE-2026-32286)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61728" id="CVE-2025-61728" type="cve" title="CVE-2025-61728" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32286" id="CVE-2026-32286" type="cve" title="CVE-2026-32286" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4427" id="CVE-2026-4427" type="cve" title="CVE-2026-4427" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434431" id="2434431" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449833" id="2449833" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451847" id="2451847" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22450" id="RLSA-2026:22450" type="self" title="RLSA-2026:22450" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="osbuild-composer-worker" arch="aarch64" epoch="0" version="165.1" release="2.el10_2.rocky.0.1" src="osbuild-composer-165.1-2.el10_2.rocky.0.1.src.rpm">
          <filename>osbuild-composer-worker-165.1-2.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">a1c7ef508f7d9ecf7c5b0e3e5caf3777c4409114201684d3c3151d5d7e2c2a7d</sum>
        </package>
        <package name="osbuild-composer" arch="aarch64" epoch="0" version="165.1" release="2.el10_2.rocky.0.1" src="osbuild-composer-165.1-2.el10_2.rocky.0.1.src.rpm">
          <filename>osbuild-composer-165.1-2.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">c30121c6c4bfe63aa7595291a57e11863d3d76b312cc15c91405900a1a6813ec</sum>
        </package>
        <package name="osbuild-composer-core" arch="aarch64" epoch="0" version="165.1" release="2.el10_2.rocky.0.1" src="osbuild-composer-165.1-2.el10_2.rocky.0.1.src.rpm">
          <filename>osbuild-composer-core-165.1-2.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">250604745665a5881e69ec3abd809c0561fd8c0e4059bba398847f573d2c46fa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22649</id>
    <title>Important: php8.4 security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php8.4.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a database-enabled webpage with PHP is fairly simple. The most common use of PHP coding is probably as a replacement for CGI scripts.

Security Fix(es):

* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)

* PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

* php: NULL pointer dereference in SOAP apache:Map decoder with missing &lt;value&gt; (CVE-2026-7262)

* php: signed integer overflow in metaphone() (CVE-2026-7568)

* php: denial of service via DOMNode::C14N() (CVE-2026-7263)

* php: global buffer over-read in mb_convert_encoding() with attacker-supplied encoding (CVE-2026-6104)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6104" id="CVE-2026-6104" type="cve" title="CVE-2026-6104" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6735" id="CVE-2026-6735" type="cve" title="CVE-2026-6735" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7258" id="CVE-2026-7258" type="cve" title="CVE-2026-7258" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7262" id="CVE-2026-7262" type="cve" title="CVE-2026-7262" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7263" id="CVE-2026-7263" type="cve" title="CVE-2026-7263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7568" id="CVE-2026-7568" type="cve" title="CVE-2026-7568" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468561" id="2468561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468566" id="2468566" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468562" id="2468562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468573" id="2468573" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468572" id="2468572" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468565" id="2468565" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22649" id="RLSA-2026:22649" type="self" title="RLSA-2026:22649" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="php8.4-bcmath" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-bcmath-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e25ff153af234663e573af2297071970197a88fa629ce7f180ead1c77278f0bf</sum>
        </package>
        <package name="php8.4-xml" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-xml-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">efd8c30f368ddd82828cd41cd3089b4f91dc075222068eea1797e5b151971ffe</sum>
        </package>
        <package name="php8.4-embedded" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-embedded-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c05d8352010fd8ddb5cc45c504da4f2ca2d3ce8065c28e000b7fc632ae119ca7</sum>
        </package>
        <package name="php8.4-pgsql" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-pgsql-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fbf10f13e5c99711dad9ea28fe4b1e33a0e6c258794c354334a14bab1f916fc5</sum>
        </package>
        <package name="php8.4-dbg" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-dbg-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">bb0b5c75a331cb9decfe0c34f71658d7401c16b5c87f814b78367ba08d4ed144</sum>
        </package>
        <package name="php8.4-devel" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-devel-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">bdc4cb0b7cc6fd7463f812b3c2299cb6e75ded64002783f64d294a1d5a1be5e2</sum>
        </package>
        <package name="php8.4-opcache" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-opcache-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1f67bbba97096d29a32012e92c9c6171a2fb32902f0c7b16c9bc07a64bf70b14</sum>
        </package>
        <package name="php8.4-fpm" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-fpm-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6c9c1a850696877aacb9d128d08d303722205f255e094f30e3918881ae82a14c</sum>
        </package>
        <package name="php8.4-pdo" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-pdo-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4f708dcafeb7a012acdd39b8e5faf7d8fbe85e4f9dd1d880cfa9c49728d688d6</sum>
        </package>
        <package name="php8.4-mysqlnd" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-mysqlnd-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2afe4118875cbcc2f29e8f39973d40bfb59269c43b0414431e864428d83b5399</sum>
        </package>
        <package name="php8.4-gmp" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-gmp-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2a5997101c4a918fa84d5d2b0f6c5309febc03624c09bbed24dc7485e8216714</sum>
        </package>
        <package name="php8.4-snmp" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-snmp-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">780f0c5109bbfb1ea0c9ab59ac6767be850f5bcd07ddaf5360e2bd3319be0dae</sum>
        </package>
        <package name="php8.4-process" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-process-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a9e84829fa368e44f27b17e8a6c6b90cd504068cb4d6ed8ebc1adbbc7b3424be</sum>
        </package>
        <package name="php8.4-enchant" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-enchant-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">362ede3ac67adcb9349024df4146357b3c3c8def4cd86880ada3f5b1911ab441</sum>
        </package>
        <package name="php8.4-ffi" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-ffi-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">62577ae2d47f0465a49f03fc12d3fc665919d9c89f5b171067ae3064937e4e00</sum>
        </package>
        <package name="php8.4-ldap" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-ldap-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f33edd235951b9d7f923975dba5ed5a5c4b03905accae0a3889075631bc171c2</sum>
        </package>
        <package name="php8.4-mbstring" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-mbstring-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a0c6ff064d888085ea45e871b743bce0c5e623cea79361054f04f7198c86828e</sum>
        </package>
        <package name="php8.4-intl" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-intl-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ad5ca54f52f6c3526965175044041d50ca4974b09df0bfb63c41c841e6dacf93</sum>
        </package>
        <package name="php8.4" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ca1d8ef471745a12a3c246747733db1a76db0c4c1f56787376fb5b92ce409213</sum>
        </package>
        <package name="php8.4-gd" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-gd-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7563ad62e3cfa78de8495646043cb31b72fd175c87232ca702391dd1590ad2eb</sum>
        </package>
        <package name="php8.4-cli" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-cli-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4e4eee876e29d449a25ab3ae4c2feff01c3a4716425eb3917337ce6fc5958212</sum>
        </package>
        <package name="php8.4-common" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-common-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">bda8cab65d75e2282b0112769d5b99be366c3969c73d4993ab7f22d41270fa07</sum>
        </package>
        <package name="php8.4-odbc" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-odbc-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1e27bfcc2c4386285765308a49c2b1990db1af859ef3dbab85f4cf37e99dd071</sum>
        </package>
        <package name="php8.4-dba" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-dba-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e401dd32929cc08748acbf23b0f6e28e333b5557932ab194a7e2042ffeeaaf84</sum>
        </package>
        <package name="php8.4-soap" arch="aarch64" epoch="0" version="8.4.21" release="1.el10_2" src="php8.4-8.4.21-1.el10_2.src.rpm">
          <filename>php8.4-soap-8.4.21-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">44b43cf790029b22f90dae53fd69db829ae0b36220b6b4be862559a1ecbd5f0e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22528</id>
    <title>Moderate: mod_http2 security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53020" id="CVE-2025-53020" type="cve" title="CVE-2025-53020" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379343" id="2379343" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22528" id="RLSA-2026:22528" type="self" title="RLSA-2026:22528" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_http2" arch="aarch64" epoch="0" version="2.0.29" release="4.el10_2" src="mod_http2-2.0.29-4.el10_2.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b34342f3cf07c3728b6e81d605f5536aa60fc79f875c0679f168149e21799fbb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22529</id>
    <title>Moderate: libexif security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libexif.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libexif packages provide a library for extracting extra information from image files.

Security Fix(es):

* libexif: libexif: Denial of Service and information disclosure via integer underflow in MakerNote decoding (CVE-2026-40386)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40386" id="CVE-2026-40386" type="cve" title="CVE-2026-40386" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457689" id="2457689" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22529" id="RLSA-2026:22529" type="self" title="RLSA-2026:22529" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libexif" arch="aarch64" epoch="0" version="0.6.24" release="9.el10_2.1" src="libexif-0.6.24-9.el10_2.1.src.rpm">
          <filename>libexif-0.6.24-9.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">07e496cc2999b7f77fdd81ab2780d92ecc17708855e04eb3812371709f4fcf41</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:22937</id>
    <title>Important: image-builder security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.

Security Fix(es):

* golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726)

* crypto/tls: Unexpected session resumption in crypto/tls (CVE-2025-68121)

* crypto/x509: Incorrect enforcement of email constraints in crypto/x509 (CVE-2026-27137)

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-61726" id="CVE-2025-61726" type="cve" title="CVE-2025-61726" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-68121" id="CVE-2025-68121" type="cve" title="CVE-2025-68121" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27137" id="CVE-2026-27137" type="cve" title="CVE-2026-27137" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33186" id="CVE-2026-33186" type="cve" title="CVE-2026-33186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2434432" id="2434432" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2449833" id="2449833" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2455470" id="2455470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445345" id="2445345" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2437111" id="2437111" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:22937" id="RLSA-2026:22937" type="self" title="RLSA-2026:22937" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="image-builder" arch="aarch64" epoch="0" version="52.1" release="1.el10_2.rocky.0.1" src="image-builder-52.1-1.el10_2.rocky.0.1.src.rpm">
          <filename>image-builder-52.1-1.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">51ca5917e1496ab9e4cf19f2744335780fc1d7642e5b999a628d1776c27b9f43</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:23102</id>
    <title>Important: delve security update</title>
    <issued date="2026-06-05 12:04:50" />
    <updated date="2026-06-19 12:06:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:23102" id="RLSA-2026:23102" type="self" title="RLSA-2026:23102" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="delve" arch="aarch64" epoch="0" version="1.26.1" release="2.el10_2" src="delve-1.26.1-2.el10_2.src.rpm">
          <filename>delve-1.26.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">50a31ce101a65e07359377feb8cc3604f8d3eda522c8e89defe33a5fcc35697d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:23231</id>
    <title>Important: unbound security update</title>
    <issued date="2026-06-06 12:04:50" />
    <updated date="2026-06-20 12:05:47" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944)

* unbound: Unbound DNSSEC Validator Denial of Service via Incorrect Write Offset Counter in Chase-Reply Messages (CVE-2026-42959)

* unbound: Unbound DNSSEC Validator Use-After-Free via Deep Copy Pointer Overwrite Leading to DoS and Possible Remote Code Execution (CVE-2026-33278)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33278" id="CVE-2026-33278" type="cve" title="CVE-2026-33278" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42944" id="CVE-2026-42944" type="cve" title="CVE-2026-42944" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42959" id="CVE-2026-42959" type="cve" title="CVE-2026-42959" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479808" id="2479808" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479806" id="2479806" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479774" id="2479774" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:23231" id="RLSA-2026:23231" type="self" title="RLSA-2026:23231" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="unbound-libs" arch="aarch64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-libs-1.24.2-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">174e87a737587b8c785197bea9746129f12498a591c8b35cf972fb1d20f32937</sum>
        </package>
        <package name="python3-unbound" arch="aarch64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>python3-unbound-1.24.2-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">7e8e200fb11e43bfbb9f0835162b7a8747257e2d3b340400a3bace8577c2bcd8</sum>
        </package>
        <package name="unbound" arch="aarch64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-1.24.2-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">957a98758d5ffefc2b8a70b60ed73990a695794a4657fb94da512c14bad83592</sum>
        </package>
        <package name="unbound-anchor" arch="aarch64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-anchor-1.24.2-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">1a0fc0d949ce4e1565ccce860cc1820df4401a0c4c44ec4a0fd91a623c65863f</sum>
        </package>
        <package name="unbound-dracut" arch="aarch64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-dracut-1.24.2-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">05cc31c34a5a3eb0b1f5ea1baf16106475bc2261ebadfcf2576a5eb135493ff8</sum>
        </package>
        <package name="unbound-utils" arch="aarch64" epoch="0" version="1.24.2" release="7.el10_2.1" src="unbound-1.24.2-7.el10_2.1.src.rpm">
          <filename>unbound-utils-1.24.2-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">f86ab0bf701ef42a1f9d48b958a1e5e28d0e347625b894ac7b7d12c019961b4b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:23388</id>
    <title>Important: php security update</title>
    <issued date="2026-06-06 12:04:50" />
    <updated date="2026-06-20 12:05:47" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258)

* PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting vulnerability via improper URL sanitation (CVE-2026-6735)

* php: NULL pointer dereference in php_mb_check_encoding() via mb_ereg_search_init() (CVE-2026-7259)

* php: NULL pointer dereference in SOAP apache:Map decoder with missing &lt;value&gt; (CVE-2026-7262)

* php: signed integer overflow in metaphone() (CVE-2026-7568)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6735" id="CVE-2026-6735" type="cve" title="CVE-2026-6735" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7258" id="CVE-2026-7258" type="cve" title="CVE-2026-7258" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7259" id="CVE-2026-7259" type="cve" title="CVE-2026-7259" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7262" id="CVE-2026-7262" type="cve" title="CVE-2026-7262" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-7568" id="CVE-2026-7568" type="cve" title="CVE-2026-7568" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468564" id="2468564" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468561" id="2468561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468566" id="2468566" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468562" id="2468562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468565" id="2468565" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:23388" id="RLSA-2026:23388" type="self" title="RLSA-2026:23388" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="php-pgsql" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pgsql-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">538dca4315812bd704f92ea62bd994a58a50767d9c673b1e4829b6b560a6ee28</sum>
        </package>
        <package name="php-bcmath" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-bcmath-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">278ac571542e65d30af3c3cbb8b86836f8d14aa39189d06f2d852f7a2e7f5483</sum>
        </package>
        <package name="php-dba" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dba-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">3df25407b0c40f3147824813fe4ffd62af02bb57fcedb92359bc20afc361658e</sum>
        </package>
        <package name="php-cli" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-cli-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">71a588744152a1fbd15dbc4805b9df1a8e278592d2724e547ae72a312a5b68c6</sum>
        </package>
        <package name="php-common" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-common-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">14404b86b02e13c6f59da5a573f27bd1c6523fdacec89c52d53b3608853ea2c7</sum>
        </package>
        <package name="php-enchant" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-enchant-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d782ac48898551f64afdac75a478d8d71164e83d669dda4890e3211dd2049d95</sum>
        </package>
        <package name="php-process" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-process-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e95a8b4675574da8a41736636be6637116d032ad43c0b4a73d1366bf7bba6fd1</sum>
        </package>
        <package name="php-gd" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gd-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">3fc8cd0e93e9b23536bea9398831c4e811305dfdabd0f2ac62caaaa8268ce0f1</sum>
        </package>
        <package name="php-fpm" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-fpm-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cf957f6e17c200de5b5150c48e84ef0cf35a74fea4ae75a718fef3ea0b42d893</sum>
        </package>
        <package name="php-dbg" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-dbg-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cdc4bc5de24ee06ec58e856ecf772a130020d22f874c86f1974aa5fd67b9ea8c</sum>
        </package>
        <package name="php-devel" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-devel-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4cf412ca51999d30c0398fd17bd172c8dda5945b18f5b01f766a08b35fd0f726</sum>
        </package>
        <package name="php-ldap" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ldap-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">11b3c5c196b4ca471f9805dd630dba8f2ad45d4e4ab82ed1ff7c06ace2f0c19e</sum>
        </package>
        <package name="php-intl" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-intl-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">905eb46d882fdf252325974fe140d1033e72c48ae56605444c41f905f675ec5c</sum>
        </package>
        <package name="php-pdo" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-pdo-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">56a8163c390a71c6cd85cdc378392003ac62b59771dc9479d2855e58ca0fceb1</sum>
        </package>
        <package name="php-ffi" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-ffi-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f44533cb821e91aa52861c2459093b047239d32249887f6787b2814194b055bf</sum>
        </package>
        <package name="php-mysqlnd" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mysqlnd-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">64a05e148ff8d600a487ccc2c7f16d96f8a994cee6b634fe06c8a3d6ef39617f</sum>
        </package>
        <package name="php-opcache" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-opcache-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">287815a4fd2f7b9eb253c36e9cae11e79e11912a129b776ea6e7fd2950f20373</sum>
        </package>
        <package name="php-embedded" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-embedded-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4c134d273d01498405fb8682253e22cc7ed3f201d8354f8c160b5e464fae27cd</sum>
        </package>
        <package name="php-gmp" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-gmp-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">69a0999ce2f593d570b8f525739480a02770ac00d302de301cb7b1e6cdf88fea</sum>
        </package>
        <package name="php-mbstring" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-mbstring-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6ddd95a1a10364af917066e62fce7765d25d565529a62f45b7ca358082127097</sum>
        </package>
        <package name="php" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2eb2baa29a1887afedcde09d1c7dbaf483f6ec15dc87d77078aa0283a47b195f</sum>
        </package>
        <package name="php-snmp" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-snmp-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">755f83befd6ba507d11cc13d5f229e7539febd13c5b589d6e6da516462ae7955</sum>
        </package>
        <package name="php-soap" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-soap-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d638ae113128044433d4f9b697e80f534b13c82382c9264933f5615a947e68f7</sum>
        </package>
        <package name="php-xml" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-xml-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">007e6c25f34c48d3157517ff770188a323f6bf8ac4695c404af99ba3721bcbcc</sum>
        </package>
        <package name="php-odbc" arch="aarch64" epoch="0" version="8.3.31" release="1.el10_2" src="php-8.3.31-1.el10_2.src.rpm">
          <filename>php-odbc-8.3.31-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">931d198eeeeb717e27303a87c74e059abdb500f78b414e243a565d8f7afc717e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24331</id>
    <title>Important: cockpit-image-builder security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for cockpit-image-builder.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The image-builder-frontend generates custom images suitable for deploying systems or uploading to the cloud. It integrates into Cockpit as a frontend for osbuild.

Security Fix(es):

* lodash: prototype pollution in _.unset and _.omit functions (CVE-2025-13465)

* lodash: lodash: Arbitrary code execution via untrusted input in template imports (CVE-2026-4800)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-13465" id="CVE-2025-13465" type="cve" title="CVE-2025-13465" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4800" id="CVE-2026-4800" type="cve" title="CVE-2026-4800" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2453496" id="2453496" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2431740" id="2431740" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24331" id="RLSA-2026:24331" type="self" title="RLSA-2026:24331" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="cockpit-image-builder" arch="noarch" epoch="0" version="94.3" release="1.el10_2" src="cockpit-image-builder-94.3-1.el10_2.src.rpm">
          <filename>cockpit-image-builder-94.3-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">86763aada9ca1c83e778b94f0cce0ae1fa27943d9b665aee57ba4b6e4bc6cc2b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24348</id>
    <title>Important: postgresql-jdbc security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql-jdbc.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database.

Security Fix(es):

* jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42198" id="CVE-2026-42198" type="cve" title="CVE-2026-42198" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2463857" id="2463857" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24348" id="RLSA-2026:24348" type="self" title="RLSA-2026:24348" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql-jdbc" arch="noarch" epoch="0" version="42.7.2" release="1.el10_2.2" src="postgresql-jdbc-42.7.2-1.el10_2.2.src.rpm">
          <filename>postgresql-jdbc-42.7.2-1.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">af4e552d6254c3a538384d48748435e2125ec3f92721df5c02774d08ef68520c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24338</id>
    <title>Important: bind security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for bind.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.

Security Fix(es):

* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)

* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-3039" id="CVE-2026-3039" type="cve" title="CVE-2026-3039" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-5946" id="CVE-2026-5946" type="cve" title="CVE-2026-5946" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479767" id="2479767" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2479771" id="2479771" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24338" id="RLSA-2026:24338" type="self" title="RLSA-2026:24338" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="bind-dnssec-utils" arch="aarch64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-dnssec-utils-9.18.33-15.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">31d7e6e214fd2fd98bbe0d47e36e9a2c6c68c0ecf17d858cbde6342edc6998e5</sum>
        </package>
        <package name="bind-libs" arch="aarch64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-libs-9.18.33-15.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">661780d76d5494f06a8793785d40bb417c04ec450debf41df1f4d58026701ee0</sum>
        </package>
        <package name="bind" arch="aarch64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-9.18.33-15.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">232809a0b882679c1ea1af6adf8a7d5e920b0b223be841e38c76dc3266f9050b</sum>
        </package>
        <package name="bind-utils" arch="aarch64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-utils-9.18.33-15.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">f39d33d1d1d909b86dbb69b9189fdef3d9bb5a5ab7214f6081d6222d9c7f95e9</sum>
        </package>
        <package name="bind-license" arch="noarch" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-license-9.18.33-15.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">fed371a3681da536e0778643a4b6d9543a2ca15b218fa97d11c331074e4f2c1a</sum>
        </package>
        <package name="bind-chroot" arch="aarch64" epoch="2" version="9.18.33" release="15.el10_2.2" src="bind-9.18.33-15.el10_2.2.src.rpm">
          <filename>bind-chroot-9.18.33-15.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">0dad91de0aa198a3650815dcaf37bdabf0904036a6d6f60c19e0edefa52d9dd1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24347</id>
    <title>Important: frr security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for frr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FRRouting is free software that manages TCP/IP based routing protocols. It supports BGP4, OSPFv2, OSPFv3, ISIS, RIP, RIPng, PIM, NHRP, PBR, EIGRP and BFD. 

Security Fix(es):

* frr: denial of service via crafted FlowSpec component (CVE-2026-37457)

* frr: denial of service via crafted BGP UPDATE message (CVE-2026-37459)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37457" id="CVE-2026-37457" type="cve" title="CVE-2026-37457" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-37459" id="CVE-2026-37459" type="cve" title="CVE-2026-37459" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466513" id="2466513" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464548" id="2464548" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24347" id="RLSA-2026:24347" type="self" title="RLSA-2026:24347" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="frr" arch="aarch64" epoch="0" version="10.4.4" release="1.el10_2" src="frr-10.4.4-1.el10_2.src.rpm">
          <filename>frr-10.4.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f9df0c11d5b4007eac445870183984d63d0c408da03836116d1c9c2c2185db90</sum>
        </package>
        <package name="frr-selinux" arch="noarch" epoch="0" version="10.4.4" release="1.el10_2" src="frr-10.4.4-1.el10_2.src.rpm">
          <filename>frr-selinux-10.4.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b787323105ab7c24a5a87d996c9103f26f4321085d417a7035849de80a23ece2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24470</id>
    <title>Important: podman security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24470" id="RLSA-2026:24470" type="self" title="RLSA-2026:24470" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.8.2" release="3.el10_2" src="podman-5.8.2-3.el10_2.src.rpm">
          <filename>podman-remote-5.8.2-3.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d54c57a65d05e0fde6267e687d919400ed9d1b4c17eeffa0e1290249fae1a863</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="3.el10_2" src="podman-5.8.2-3.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">f56c07b3706ad63e75cce22ab620bf56342117cfd3903bc90bf5a52d06a6bc30</sum>
        </package>
        <package name="podman" arch="aarch64" epoch="7" version="5.8.2" release="3.el10_2" src="podman-5.8.2-3.el10_2.src.rpm">
          <filename>podman-5.8.2-3.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4ee4c89e732256c50499ff33d2e71c50bbcf21da41079c20e8d8f17fc5c8c4cd</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24716</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24716" id="RLSA-2026:24716" type="self" title="RLSA-2026:24716" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil" arch="aarch64" epoch="0" version="0.4.9" release="5.el10_2" src="yggdrasil-0.4.9-5.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9-5.el10_2.aarch64.rpm</filename>
          <sum type="sha256">afa1ff15022e6f1d09d60167d245551fa54e3c9d1b998304fd7c11a091f1ab76</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24758</id>
    <title>Important: libyang security update</title>
    <issued date="2026-06-11 12:05:12" />
    <updated date="2026-06-25 12:06:39" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libyang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libyang is YANG data modeling language parser and toolkit written (and providing API) in C.

Security Fix(es):

* libyang: libyang: Denial of Service or arbitrary code execution via maliciously crafted LYB binary blob (CVE-2026-44673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44673" id="CVE-2026-44673" type="cve" title="CVE-2026-44673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477617" id="2477617" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24758" id="RLSA-2026:24758" type="self" title="RLSA-2026:24758" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libyang" arch="aarch64" epoch="0" version="2.1.148" release="4.el10_2" src="libyang-2.1.148-4.el10_2.src.rpm">
          <filename>libyang-2.1.148-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">68c45d8760f1cfd5837457ecbe1930e8be643f9618e9a62dcda3c4415cd3a507</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:24985</id>
    <title>Important: poppler security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for poppler.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Poppler is a Portable Document Format (PDF) rendering library, used by applications such as Evince.

Security Fix(es):

* poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication (CVE-2026-10118)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10118" id="CVE-2026-10118" type="cve" title="CVE-2026-10118" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460428" id="2460428" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:24985" id="RLSA-2026:24985" type="self" title="RLSA-2026:24985" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="poppler" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-24.02.0-7.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">1823d159e70ed52bea9510de860a6f77fd5629ebb2700f84f7c587fb7db57cae</sum>
        </package>
        <package name="poppler-utils" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-utils-24.02.0-7.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">86192908dbe4c0412ce9727f449bd9938ffc36c92919eeb3ae6702077c06b1dd</sum>
        </package>
        <package name="poppler-glib" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-glib-24.02.0-7.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">bebab81023210da4007213b257afb77976184c82d96c91b7ccb0694c3af40217</sum>
        </package>
        <package name="poppler-qt6" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-qt6-24.02.0-7.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">c57cbde012e3508b602c199d85d1309edf806a0c08330be39ca1a9cb14960048</sum>
        </package>
        <package name="poppler-cpp" arch="aarch64" epoch="0" version="24.02.0" release="7.el10_2.2" src="poppler-24.02.0-7.el10_2.2.src.rpm">
          <filename>poppler-cpp-24.02.0-7.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">0178f4681b30c954fc561cf6e90812da488afa09ddbd0a710ad9675d38f17007</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25111</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.128 and .NET Runtime 8.0.28.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487164" id="2487164" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487224" id="2487224" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25111" id="RLSA-2026:25111" type="self" title="RLSA-2026:25111" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.128" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.128-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">460440059e4bf34ffbda83d0130eea19b79470681d46a311a3f50e4f35d0bda6</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.128" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.128-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">21e702c1e1d95566cc243fd71ac85925fea1963798d78278a1c1ca3e101c0473</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1e87a020835140409940b72ead70fda30c4aa81759cbd93e7a3845f293497369</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cfb74c5c737e6fdbc4ce12f27b11702114098a34a8c728b378671e3c252b1608</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1236d4dbd9f385178dcbebdc43c278a83cbf45d63e68988d6adc603125bf18a5</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d97cec490e421c12a41a66dd9248d18481e21c86ef1a502b9b98d17a99ada1eb</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7038652c88adc87f979fe638306ec34a11f3bc39c88c67fa34304c4c1b89fdf5</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1aa3db8b98ea00d96c764928e8e4ffef09b2da3c7cb9dcc36434fb86182cfddc</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e5dc21a09d6da7d7607047380b763105a5faaa02897d49cd3bf5eb8098da28af</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.128" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.128-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0a1ed57bc096923afe9c7f26fead7822e916751fe36f2b50c24e046c99077127</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.28" release="1.el10_2" src="dotnet8.0-8.0.128-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.28-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">38b59e8dfe17cd4a2f447945c3e65f5dad859c6ff876ea0979438ebaf0017c10</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25112</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.118 and .NET Runtime 9.0.17.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487164" id="2487164" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487224" id="2487224" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25112" id="RLSA-2026:25112" type="self" title="RLSA-2026:25112" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cddeb83d5dc151a83c9844ed68d2d5b6082d303c986600f23c389e050ae890da</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.118-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b50b6464587065be402d58949ab5499eaf748b178396cf874e69de0bfb30e9f8</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ceeff263e4c27bab860bec17e4830341e4364da16e7bd0c0c1b43cb9ee83042d</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.118-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d8ea5a8db8a805e32b99f27aca344b94c9c74a72c8c9bdf5d71dd626d2864879</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f7a1587fbaa428ea8673ad9a1b6bc067018b7b362b5beab461a0db798d25722d</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8d4ed039a97bcda5558a43f43414d36b349899463c3b25e4de410ae5fb2f9da3</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">91aab2aff9de102d79e5332ce0abe82f771c20ec1b05501a02d6420734c30865</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.118-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">38a7508f2955c1306cb3373dffb74635b8566dc2762dc2003702a7b2fc122734</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c0c9475f3a43afe8bfb4762b353ad81a0d7aefac96035622459d7739c17400fa</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.118-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fcf2dfbf79d22cc7ba96f600b972cc10972c1ceecb3203cabd0ebccd06c4c008</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f458ccdbfff5eec7351fd6c9e5dd4276c400723eb75c01325d33471a665be0e9</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.118" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.118-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4563d7452fa2ef15db3ce315d0d154ed68352939d5ad3211e1bb1f614e3baca0</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.17" release="1.el10_2" src="dotnet9.0-9.0.118-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.17-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2e93bd3a11b6d21df065c831ef7f79ac7e054f2f6c23d8008db2259f599d85a6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25115</id>
    <title>Important: .NET 10.0 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.109 and .NET Runtime 10.0.9.Security Fix(es):

* dotnet: .NET: Local file tampering via link following vulnerability (CVE-2026-45491)

* dotnet: ASP.NET Core: Denial of Service via uncontrolled resource consumption (CVE-2026-45591)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45491" id="CVE-2026-45491" type="cve" title="CVE-2026-45491" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45591" id="CVE-2026-45591" type="cve" title="CVE-2026-45591" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487164" id="2487164" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487224" id="2487224" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25115" id="RLSA-2026:25115" type="self" title="RLSA-2026:25115" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-sdk-dbg-10.0" arch="aarch64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.109-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">436b8889619bb6c4dba1f327fff2bf806a40711ee279ff60664b4dc43d78ff5f</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">723c12fea95738dd152e32bc774a2b1f6a5040fc2779afc72265025046248d47</sum>
        </package>
        <package name="aspnetcore-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6f1b16c83d958e5c873c3018a7a395d6b9571b5524793b27d0db763d56ed5232</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8591bed9ebb8d047308a92e57c899ab32c5898d620d6eb3c9482c1b80fdd1e7f</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="aarch64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.109-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">33a9343cad16c4d62914988573d2f3f669f43d7f340cec51db04e6276a243e82</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7771d9ca0401b5a466802015dca55c4ae0de73fa7b784906ad912e4078122db7</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">23b6dd15988c339e0bc2f021231d95e5c020d5ea6da8ffe9d8a3101d853b9dff</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="aarch64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.109-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0728163cb5c4866b7b9c34320ce6a7d18d2ff7cba28809d1ef86205568288e6b</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4528a7c46de95f3ce75fa8b494019f5bc964eb3c0b2d6596b682bedb2b83ea95</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1d94216858d33fb135ed8443c0709abab84425a90385c5acaedee8d8359165e4</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="aarch64" epoch="0" version="10.0.109" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.109-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">edf69c5b759dc3fd235615bdcd50a046d74cba1c6a11229a4a4b9c6161ea17ef</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ee54cd5fa16544284876ef4a6034cd98a0bde3857c5fb70ac75ef7440b008f7e</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="aarch64" epoch="0" version="10.0.9" release="1.el10_2" src="dotnet10.0-10.0.109-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">057a66ac6b53e8f88f74b9bb40e1962f78efe2712b1e7d27fbcb99a902be969a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25216</id>
    <title>Important: valkey security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: use-after-free in unblock client flow may allow remote code execution (CVE-2026-23479)

* redis: Remote code execution via use-after-free in Lua scripting (CVE-2026-23631)

* redis: RESTORE invalid memory access may allow remote code execution (CVE-2026-25243)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23479" id="CVE-2026-23479" type="cve" title="CVE-2026-23479" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23631" id="CVE-2026-23631" type="cve" title="CVE-2026-23631" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25243" id="CVE-2026-25243" type="cve" title="CVE-2026-25243" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466828" id="2466828" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466788" id="2466788" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466780" id="2466780" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25216" id="RLSA-2026:25216" type="self" title="RLSA-2026:25216" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="valkey" arch="aarch64" epoch="0" version="8.0.9" release="1.el10_2" src="valkey-8.0.9-1.el10_2.src.rpm">
          <filename>valkey-8.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cd8dbd1d4824b3dbe929fc96f64eb4eb0ca9966c92dc023a9298907395e5ab44</sum>
        </package>
        <package name="valkey-devel" arch="aarch64" epoch="0" version="8.0.9" release="1.el10_2" src="valkey-8.0.9-1.el10_2.src.rpm">
          <filename>valkey-devel-8.0.9-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">48805cb4541f24b1f2ffcc498b528cc1bfe4cfe38585f5ce3fcc8a02427cddf1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25225</id>
    <title>Important: mod_http2 security update</title>
    <issued date="2026-06-13 00:05:06" />
    <updated date="2026-06-27 00:06:22" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49975" id="CVE-2026-49975" type="cve" title="CVE-2026-49975" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485371" id="2485371" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25225" id="RLSA-2026:25225" type="self" title="RLSA-2026:25225" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_http2" arch="aarch64" epoch="0" version="2.0.29" release="4.el10_2.1" src="mod_http2-2.0.29-4.el10_2.1.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">df55a466bffe264746ad7984b8aac4fba74f0cecca6843bb109fe8ad7bf53c1c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25902</id>
    <title>Important: fence-agents security update</title>
    <issued date="2026-06-16 12:04:59" />
    <updated date="2026-06-30 12:06:23" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for fence-agents.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. 

Security Fix(es):

* python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48526" id="CVE-2026-48526" type="cve" title="CVE-2026-48526" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2482734" id="2482734" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25902" id="RLSA-2026:25902" type="self" title="RLSA-2026:25902" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="fence-agents-common" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-common-4.16.0-21.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">79e64f9a6b0da2b4571a811b6e4881da269c271b2fa183b2759d3778a22dc5b2</sum>
        </package>
        <package name="fence-agents-mpath" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-mpath-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">96f9b2808b4760790a08847f2d155df84e343eba0c23b7f30e0c5a5aaaef7812</sum>
        </package>
        <package name="fence-agents-nutanix-ahv" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-nutanix-ahv-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">0f83a2b48daf607f9ae0a98244e082a4326304570575b2dd4a295ef6e12ad3f4</sum>
        </package>
        <package name="fence-agents-redfish" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-redfish-4.16.0-21.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">eda93e3b455ab19ab8ad558a33a7329db2267a0bcd0f3bd19cb7f4d3bca5e4d2</sum>
        </package>
        <package name="fence-agents-virsh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-virsh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">befa344470325ca7f137105af90beab96c1750caafbf11dba82eab4ce58f8a44</sum>
        </package>
        <package name="fence-agents-cisco-mds" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-mds-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b0d5a890be78eb8b4f6810a9b24e7e272fc78f8a9d5907ef7366aa838879422f</sum>
        </package>
        <package name="fence-agents-lpar" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-lpar-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3a7d74165230f672d9c30b4ad5660ed2208619b7be122ded1b3fe00d31eef084</sum>
        </package>
        <package name="fence-agents-ilo-ssh" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-ssh-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">90166bf1834f577fa8084ffbc36b178df7fca43562b1b66a009eb106b7a2d580</sum>
        </package>
        <package name="fence-agents-ipmilan" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipmilan-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3601e643dc546a384f3fe041da330d5a0a54191af5d7bea51881e578f2c55e24</sum>
        </package>
        <package name="fence-agents-vmware-rest" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-rest-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">397a7c742aafd02b74abdfc2c2060801722fcb0bae789428680d01c82c72033c</sum>
        </package>
        <package name="fence-agents-brocade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-brocade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">39f0479ac0e928033d5dbc2eca282d249e08b362247b4a928e91ecdf852f21c9</sum>
        </package>
        <package name="fence-agents-ilo-mp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-mp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4df4cbbf79926440db1efec7cb11b57c4e63c02f4d371bc4babb219ae6b27297</sum>
        </package>
        <package name="fence-agents-ilo2" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo2-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">08a768531d320b46fe7824096bfd9a98b255bf71d6abb9ecb52fd77e72ad5e76</sum>
        </package>
        <package name="fence-agents-intelmodular" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-intelmodular-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">dbd04405803d021d3e60fcec2f4178d36eb02641ea256627a4e7b94363d3f210</sum>
        </package>
        <package name="fence-agents-ibm-vpc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-vpc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">650c8554bd516b004d54879cfc798768219732e816eb47465757ccfd13189747</sum>
        </package>
        <package name="fence-agents-kdump" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-kdump-4.16.0-21.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">e9b82e73501c749835dcb324c134a9f37ec7ec439ab67ae79647368cff30552d</sum>
        </package>
        <package name="fence-agents-apc" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">42e7496f98820e0a66d492a28be45b616d29c1909c52417e9f11cd5c9bc23067</sum>
        </package>
        <package name="fence-agents-scsi" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-scsi-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">fe2f6e28bdfb367287a4a91b0d956100d8ff4124cd56aed94dcf149d47af5011</sum>
        </package>
        <package name="fence-agents-heuristics-ping" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-heuristics-ping-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">7280a79ab531d3bf1d907246bcfbbea84c19979bb8c25d0a06263bf88e6da99c</sum>
        </package>
        <package name="fence-agents-ilo-moonshot" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ilo-moonshot-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">7fde0ae738b52e154be0dbc0e8a0312c4d1fdd6c04be23f824f330ae366115d2</sum>
        </package>
        <package name="fence-agents-rsa" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsa-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">df9ad371fd8f15e87b4b643e99d6475e00bbeb92aea69bad5b29d75ea3e39883</sum>
        </package>
        <package name="fence-agents-eaton-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eaton-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b4594a24614a58065a1e66e5551f3ab8e44483ddd38a4930a00b99e976444b2f</sum>
        </package>
        <package name="fence-agents-bladecenter" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-bladecenter-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5cabf3e5fd13f792fa90931aacaed7815f8af215def824ce8489c7b290950346</sum>
        </package>
        <package name="fence-agents-eps" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-eps-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ec40d40ccd7f96facd18c9ab3b0c405f608b3532eb170e0be7bf7ef93ffcb65b</sum>
        </package>
        <package name="fence-agents-kubevirt" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-kubevirt-4.16.0-21.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">ee2df2d68285883b13bbda5bf55e9a278bcf75bb2cafd3b082026952d006cc38</sum>
        </package>
        <package name="fence-agents-sbd" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-sbd-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">d8652b7c8757c69601c9bc91ac33e822d425aefc22cea2c4cca0e60652650523</sum>
        </package>
        <package name="fence-agents-cisco-ucs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-cisco-ucs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ce7ecc02ad1cebebad855d3ead182d11f7c5b52122e4b33355d13b5138168434</sum>
        </package>
        <package name="fence-agents-emerson" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-emerson-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3faf24842c258c8e308549157712d21e1f03cc04c96d11f412ab2adc27d21720</sum>
        </package>
        <package name="fence-agents-drac5" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-drac5-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4d3eb3ce101fa985f24b37cf3e2c4205d6ac8ceb67a2e1223a029f052f11a64c</sum>
        </package>
        <package name="fence-agents-wti" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-wti-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">32665580179857637d1e19142389549af5a6dc17e6eb9e5a86681085d40fe21b</sum>
        </package>
        <package name="fence-agents-vmware-soap" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-vmware-soap-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">5e19ee27e91a51d6393d86248c78df1128061c8366c8a22791653b9ea5976313</sum>
        </package>
        <package name="fence-agents-rhevm" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rhevm-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">90b61f4b4425d2b96a9c0e47fd39536c86318cb9f4e757bec383966a867e0f31</sum>
        </package>
        <package name="fence-agents-hpblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-hpblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">6461f8ea3e4fa542446901f04688ded33d95b056a82fda36a35135cf54783eb2</sum>
        </package>
        <package name="fence-agents-ipdu" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ipdu-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4f44d7f5137dd8912b12fd3948465f9b1427a4cedc6e5565e125a38fbc066477</sum>
        </package>
        <package name="fence-agents-all" arch="aarch64" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-all-4.16.0-21.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">cc3b50086d78d262363106d6153735dfc8e5267e7f19e80c0748f9da8f9525d9</sum>
        </package>
        <package name="fence-agents-ibm-powervs" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibm-powervs-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">3e56a0b2beb70886d5d5dcdc01a59d314ca81f71bad6ba8892dcf7c6db254abc</sum>
        </package>
        <package name="fence-agents-amt-ws" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-amt-ws-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">9f5b7e37d1a66a11f43dcb2002a0b5fdcae06aa5c24385fd4193f96b5005c7a8</sum>
        </package>
        <package name="fence-agents-ibmblade" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ibmblade-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">ac6c086f9d9631aaf77e904c57ebfeef17dad8e9c7c6db089e4d8f85de67e462</sum>
        </package>
        <package name="fence-agents-apc-snmp" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-apc-snmp-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">9fe456f72e690050b8acd2ce9d792a0589a36847221a5e14129946a3c5c91b6d</sum>
        </package>
        <package name="fence-agents-rsb" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-rsb-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">b18b6d6fcb015c929d5ea263729eb13ec3651da16c486eaa42a0b8770a5ccc75</sum>
        </package>
        <package name="fence-agents-ifmib" arch="noarch" epoch="0" version="4.16.0" release="21.el10_2.2" src="fence-agents-4.16.0-21.el10_2.2.src.rpm">
          <filename>fence-agents-ifmib-4.16.0-21.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">866aa56aa02a41eb21a9ad02831745b0fc69f6baa56c35bb737ace02cf9748e4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25930</id>
    <title>Important: postfix security update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postfix.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The postfix packages provide a Mail Transport Agent (MTA), which supports protocols like LDAP, SMTP AUTH (SASL), and TLS.

Security Fix(es):

* postfix: buffer over-read via malformed enhanced status code (CVE-2026-43964)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43964" id="CVE-2026-43964" type="cve" title="CVE-2026-43964" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466488" id="2466488" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25930" id="RLSA-2026:25930" type="self" title="RLSA-2026:25930" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postfix-ldap" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-ldap-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a114f6df4cd9180e0eac279957fb2a29156c855b9e23622d33dba36c7d0c607e</sum>
        </package>
        <package name="postfix-pcre" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pcre-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c063ab0b4d6051b00b11cece016beba73e3896964c892badbe31357fb8690479</sum>
        </package>
        <package name="postfix-lmdb" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-lmdb-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">56c50c1031af691096c215255d301eb53a8a136b54d16be9452d916d524897fa</sum>
        </package>
        <package name="postfix-mysql" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-mysql-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">95d3f3a318c6dce515113fad85a1c06fb7a3234f0825346f5355cb3e4df3a777</sum>
        </package>
        <package name="postfix-cdb" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-cdb-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">976c56877c953a4a5567ab63f27f76e602c073c468ddc3dfa65b38e098908c10</sum>
        </package>
        <package name="postfix" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">523a838be5569e4b75220a3bf270612845bd203d2c3b264c5eb2523f5fe1c7ed</sum>
        </package>
        <package name="postfix-pgsql" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-pgsql-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">208714c0970868452da53f6f421335fb125375c8b08cc39dc289a47cb7af0603</sum>
        </package>
        <package name="postfix-perl-scripts" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-perl-scripts-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2e27ee2dfc2b4f758fcab6665c2f1df24599e807f8c3190ff14da04dba65b6cd</sum>
        </package>
        <package name="postfix-sqlite" arch="aarch64" epoch="2" version="3.8.5" release="10.el10_2" src="postfix-3.8.5-10.el10_2.src.rpm">
          <filename>postfix-sqlite-3.8.5-10.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c6216a86d154ec8e688fcc34cb632fb11fb4628c4b6d06de83bb544ce1e0279f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:25999</id>
    <title>Moderate: yggdrasil-worker-package-manager security update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for yggdrasil-worker-package-manager.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32282" id="CVE-2026-32282" type="cve" title="CVE-2026-32282" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456336" id="2456336" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:25999" id="RLSA-2026:25999" type="self" title="RLSA-2026:25999" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil-worker-package-manager" arch="aarch64" epoch="0" version="0.2.3" release="7.el10_2" src="yggdrasil-worker-package-manager-0.2.3-7.el10_2.src.rpm">
          <filename>yggdrasil-worker-package-manager-0.2.3-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a271f08421138df6154e893068c82b88957d4ec4d32512494e97fbce61834297</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:26228</id>
    <title>Important: hplip security update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for hplip.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

* HPLIP: HPLIP: Privilege escalation and arbitrary code execution via operating system command injection (CVE-2026-8632)

* HPLIP: HPLIP: Arbitrary code execution and privilege escalation via integer overflow in hpcups (CVE-2026-8631)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8631" id="CVE-2026-8631" type="cve" title="CVE-2026-8631" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8632" id="CVE-2026-8632" type="cve" title="CVE-2026-8632" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480300" id="2480300" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480297" id="2480297" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:26228" id="RLSA-2026:26228" type="self" title="RLSA-2026:26228" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="hplip-libs" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>hplip-libs-3.23.12-10.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">8fb8408c18d85a562482edc0a1f868bcbfdc6ebb8d8609c8ca10714140542509</sum>
        </package>
        <package name="libsane-hpaio" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>libsane-hpaio-3.23.12-10.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">323e9b2cff787163f8a2f0e222d1b457898fccef8ee2ce3c3d72a555e8002994</sum>
        </package>
        <package name="hplip-common" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>hplip-common-3.23.12-10.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">72f40bb28c258113d687e826f454cae7bbfd0b1efc3e8798673d9223d3265b2d</sum>
        </package>
        <package name="hplip" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.4" src="hplip-3.23.12-10.el10_2.4.src.rpm">
          <filename>hplip-3.23.12-10.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">8e71a5a501fe217c0c9055507059af9009fb89389e9f3adda1c4670cb8ff3448</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:26456</id>
    <title>Important: 389-ds-base security, bug fix, and enhancement update</title>
    <issued date="2026-06-19 06:04:41" />
    <updated date="2026-07-03 06:06:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) (CVE-2026-9064)

Bug Fix(es) and Enhancement(s):

* DS 12 does not handle escape char in bind user [rhel-10.2.z] (JIRA:Rocky Linux-170271)

* dnaSharedConfig: "dnaPortNum: 0" [rhel-10.2.z] (JIRA:Rocky Linux-170276)

* Memory leaks in syncrepl plugin during persistent search operations [rhel-10.2.z] (JIRA:Rocky Linux-170281)

* access log - suspicious wtime  optime negative and large values in internal op [rhel-10.2.z] (JIRA:Rocky Linux-170363)

* An online reinitialization with LMDB is terminating the receiving server [rhel-10.2.z] (JIRA:Rocky Linux-170478)

* dsctl healthcheck DSMOLE0001 inaccurate recommendations when there is more than 1 LDAP backend [rhel-10.2.z] (JIRA:Rocky Linux-170481)

* Possible memory leak when using the Retro Changelog plugin. [rhel-10.2.z] (JIRA:Rocky Linux-170515)

* [RFE] Add OS-level thread names to all server threads [rhel-10.2.z] (JIRA:Rocky Linux-174526)

* Online export is failing when using the option "-s" [rhel-10.2.z] (JIRA:Rocky Linux-180718)

* Server shutdown during online reindex may lead to data loss [rhel-10.2.z] (JIRA:Rocky Linux-183897)

* Error: NssSsl.add_cert() got an unexpected keyword argument 'input_file' [rhel-10.2.z] (JIRA:Rocky Linux-183898)

* Replication errors in logs [rhel-10.2.z] (JIRA:Rocky Linux-183899)

* Substring index produces empty results and can crash when non-default nsSubStrBegin/nsSubStrEnd lengths are configured [rhel-10.2.z] (JIRA:Rocky Linux-183900)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9064" id="CVE-2026-9064" type="cve" title="CVE-2026-9064" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480093" id="2480093" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:26456" id="RLSA-2026:26456" type="self" title="RLSA-2026:26456" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="389-ds-base" arch="aarch64" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>389-ds-base-3.2.0-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9b63ee19d0f771868ba02cbd7d42336ba7b8ca78be076fbc6c7cd9d03e88f128</sum>
        </package>
        <package name="389-ds-base-libs" arch="aarch64" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>389-ds-base-libs-3.2.0-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c8dad41256c9798c6d7f5413d16e208b8af115f4f9d1a5d1cb2ec96037c8d31d</sum>
        </package>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-7.el10_2.noarch.rpm</filename>
          <sum type="sha256">38e619ce2126d28966d16ad2c0a64dc3aff8d52f9462bd2c2df42d2ce990f83d</sum>
        </package>
        <package name="389-ds-base-snmp" arch="aarch64" epoch="0" version="3.2.0" release="7.el10_2" src="389-ds-base-3.2.0-7.el10_2.src.rpm">
          <filename>389-ds-base-snmp-3.2.0-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0d9b961e70d170f34e0f8b222be37e86654faba9f47f289c46bf0b5637f34700</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:26566</id>
    <title>Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update</title>
    <issued date="2026-06-24 12:05:09" />
    <updated date="2026-07-08 12:08:27" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch (CVE-2026-50256)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence() (CVE-2026-50257)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB key types due to unchecked shift levels (CVE-2026-50258)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing (CVE-2026-50259)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in FreeCounter() (CVE-2026-50260)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter() (CVE-2026-50261)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes (CVE-2026-50262)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow() (CVE-2026-50263)

* xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat (CVE-2026-50264)

Bug Fix(es) and Enhancement(s):

* [xwayland] Backport other security fixes without a CVE assigned [rhel-10.2.z] (JIRA:Rocky Linux-184290)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50256" id="CVE-2026-50256" type="cve" title="CVE-2026-50256" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50257" id="CVE-2026-50257" type="cve" title="CVE-2026-50257" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50258" id="CVE-2026-50258" type="cve" title="CVE-2026-50258" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50259" id="CVE-2026-50259" type="cve" title="CVE-2026-50259" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50260" id="CVE-2026-50260" type="cve" title="CVE-2026-50260" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50261" id="CVE-2026-50261" type="cve" title="CVE-2026-50261" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50262" id="CVE-2026-50262" type="cve" title="CVE-2026-50262" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50263" id="CVE-2026-50263" type="cve" title="CVE-2026-50263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50264" id="CVE-2026-50264" type="cve" title="CVE-2026-50264" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485385" id="2485385" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485386" id="2485386" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485388" id="2485388" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485384" id="2485384" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485380" id="2485380" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485387" id="2485387" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485389" id="2485389" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485383" id="2485383" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485382" id="2485382" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:26566" id="RLSA-2026:26566" type="self" title="RLSA-2026:26566" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="aarch64" epoch="0" version="24.1.9" release="4.el10_2.2" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.9-4.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">3733bad36ed6495a7d22323feed4b5d260aa06eaac186a602ad7e28098fee8b0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:27733</id>
    <title>Important: firefox security update</title>
    <issued date="2026-06-24 12:05:09" />
    <updated date="2026-07-08 12:08:27" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)

* firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)

* firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)

* firefox: thunderbird: JIT miscompilation in the DOM: Core &amp; HTML component (CVE-2026-12299)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)

* firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)

* firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)

* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)

* firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305)

* firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324)

* firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304)

* firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291)

* firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12289" id="CVE-2026-12289" type="cve" title="CVE-2026-12289" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12290" id="CVE-2026-12290" type="cve" title="CVE-2026-12290" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12291" id="CVE-2026-12291" type="cve" title="CVE-2026-12291" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12292" id="CVE-2026-12292" type="cve" title="CVE-2026-12292" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12294" id="CVE-2026-12294" type="cve" title="CVE-2026-12294" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12295" id="CVE-2026-12295" type="cve" title="CVE-2026-12295" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12296" id="CVE-2026-12296" type="cve" title="CVE-2026-12296" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12297" id="CVE-2026-12297" type="cve" title="CVE-2026-12297" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12298" id="CVE-2026-12298" type="cve" title="CVE-2026-12298" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12299" id="CVE-2026-12299" type="cve" title="CVE-2026-12299" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12302" id="CVE-2026-12302" type="cve" title="CVE-2026-12302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12304" id="CVE-2026-12304" type="cve" title="CVE-2026-12304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12305" id="CVE-2026-12305" type="cve" title="CVE-2026-12305" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12306" id="CVE-2026-12306" type="cve" title="CVE-2026-12306" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12307" id="CVE-2026-12307" type="cve" title="CVE-2026-12307" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12308" id="CVE-2026-12308" type="cve" title="CVE-2026-12308" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12309" id="CVE-2026-12309" type="cve" title="CVE-2026-12309" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12310" id="CVE-2026-12310" type="cve" title="CVE-2026-12310" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12311" id="CVE-2026-12311" type="cve" title="CVE-2026-12311" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12312" id="CVE-2026-12312" type="cve" title="CVE-2026-12312" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12313" id="CVE-2026-12313" type="cve" title="CVE-2026-12313" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12314" id="CVE-2026-12314" type="cve" title="CVE-2026-12314" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12315" id="CVE-2026-12315" type="cve" title="CVE-2026-12315" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12324" id="CVE-2026-12324" type="cve" title="CVE-2026-12324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12325" id="CVE-2026-12325" type="cve" title="CVE-2026-12325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12327" id="CVE-2026-12327" type="cve" title="CVE-2026-12327" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12328" id="CVE-2026-12328" type="cve" title="CVE-2026-12328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12329" id="CVE-2026-12329" type="cve" title="CVE-2026-12329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12330" id="CVE-2026-12330" type="cve" title="CVE-2026-12330" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489232" id="2489232" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489234" id="2489234" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489226" id="2489226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489221" id="2489221" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489224" id="2489224" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489244" id="2489244" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489236" id="2489236" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489209" id="2489209" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489207" id="2489207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489215" id="2489215" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489229" id="2489229" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489233" id="2489233" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489217" id="2489217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489208" id="2489208" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489223" id="2489223" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489235" id="2489235" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489220" id="2489220" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489239" id="2489239" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489248" id="2489248" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489237" id="2489237" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489211" id="2489211" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489214" id="2489214" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489225" id="2489225" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489231" id="2489231" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489212" id="2489212" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489240" id="2489240" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489218" id="2489218" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489243" id="2489243" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489210" id="2489210" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:27733" id="RLSA-2026:27733" type="self" title="RLSA-2026:27733" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.12.0" release="1.el10_2" src="firefox-140.12.0-1.el10_2.src.rpm">
          <filename>firefox-140.12.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">569969cb1cdd5a19542fa19dfdc4fdea2f0505c984a716eaa4ba6d345e6bfe4d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:27740</id>
    <title>Moderate: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-06-24 12:05:09" />
    <updated date="2026-07-08 12:08:27" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:27740" id="RLSA-2026:27740" type="self" title="RLSA-2026:27740" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipp-usb" arch="aarch64" epoch="0" version="0.9.27" release="7.el10_2.1" src="golang-github-openprinting-ipp-usb-0.9.27-7.el10_2.1.src.rpm">
          <filename>ipp-usb-0.9.27-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">aa8cd7b025868ff75e80e79629ab9b74966e63bed0a9ad69cdf094f9f6594033</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:27743</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-06-24 12:05:09" />
    <updated date="2026-07-08 12:08:27" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)

* postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)

* postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)

* postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6473" id="CVE-2026-6473" type="cve" title="CVE-2026-6473" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6475" id="CVE-2026-6475" type="cve" title="CVE-2026-6475" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6477" id="CVE-2026-6477" type="cve" title="CVE-2026-6477" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6478" id="CVE-2026-6478" type="cve" title="CVE-2026-6478" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477442" id="2477442" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477447" id="2477447" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477448" id="2477448" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477439" id="2477439" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:27743" id="RLSA-2026:27743" type="self" title="RLSA-2026:27743" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql-plperl" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-plperl-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e998196ae8ffcfbc1e384f6a080986fb42ff905b23fd67a4a49674b77d6d9ca4</sum>
        </package>
        <package name="postgresql-server-devel" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-server-devel-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">715e2ffd55d2db9807de04c1a95536da0a58f40f8e754ffdc57f78d939d4b175</sum>
        </package>
        <package name="postgresql-plpython3" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-plpython3-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ecb0a65baaa11bf7f8df5068482c45ffd052f27cc270f138b98914fb1c957437</sum>
        </package>
        <package name="postgresql-private-devel" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-private-devel-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">3b8ced70655d6f31e63f019f11d6de441f0260cd746311d7a31510a1e7edc918</sum>
        </package>
        <package name="postgresql" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">687008416fcf1e268607e0a3315f667d8f8dc3987a7f551b6d87cb3d50f69e8c</sum>
        </package>
        <package name="postgresql-contrib" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-contrib-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">bb717c688826edfd6467084624c08953b1777e4624e7e81445f4b94bb712dfb5</sum>
        </package>
        <package name="postgresql-private-libs" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-private-libs-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">dc231df613238135b371a4a0300dd74ab663289de4d17f503d0f70a5209cc696</sum>
        </package>
        <package name="postgresql-test" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-test-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">74d30d811eed5414916ecdc592c4758c91d1b2273b3040efadeab04bc3efa35b</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-devel-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f9c16045d6ca26e9aa401108d0c130e97d1b526ba2ec8e0500cfaa548ce390cd</sum>
        </package>
        <package name="postgresql-docs" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-docs-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">53f8d24a042e12015f2ec3fd1b1bc5aab9611762a5f8d4839eb7deee36114911</sum>
        </package>
        <package name="postgresql-upgrade" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-upgrade-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9d6199e46bb1d684f400d4932b9e871c01c8bcb61d3eb6cf8038a6edbbe77dae</sum>
        </package>
        <package name="postgresql-server" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-server-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">240da75729da8a2418db44811058fca87ae9d991da8582e4a9ba4dba33f2c96d</sum>
        </package>
        <package name="postgresql-static" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-static-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">491ba6b14c388b291beb1f4ae009390dd2c25e5a3c51794c6d63e114a32a2cba</sum>
        </package>
        <package name="postgresql-pltcl" arch="aarch64" epoch="0" version="16.14" release="1.el10_2" src="postgresql16-16.14-1.el10_2.src.rpm">
          <filename>postgresql-pltcl-16.14-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">72d33b4f235dbca8895e38fc08855cad4fe86ec4143c28679c70e0b8ff0a3a32</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:27742</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-06-24 12:05:09" />
    <updated date="2026-07-08 12:08:27" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql18.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL: Operating system account hijack via symlink following in pg_basebackup and pg_rewind (CVE-2026-6475)

* postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory (CVE-2026-6477)

* postgresql: PostgreSQL: Credential recovery via covert timing channel in MD5 password comparison (CVE-2026-6478)

* postgresql: integer overflow can cause an undersized allocation and an out-of-bounds write (CVE-2026-6473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6473" id="CVE-2026-6473" type="cve" title="CVE-2026-6473" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6475" id="CVE-2026-6475" type="cve" title="CVE-2026-6475" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6477" id="CVE-2026-6477" type="cve" title="CVE-2026-6477" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6478" id="CVE-2026-6478" type="cve" title="CVE-2026-6478" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477442" id="2477442" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477447" id="2477447" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477448" id="2477448" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477439" id="2477439" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:27742" id="RLSA-2026:27742" type="self" title="RLSA-2026:27742" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql18-docs" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-docs-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b56ca4fc0bd58d551d9214bfa0164718515dc58ede109beb0fbab6bbb5f2b08a</sum>
        </package>
        <package name="postgresql18-private-libs" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-private-libs-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f048f057e68e98d07e0e17caaa1858dad3f09968bc6cd374b014594d39ff7bb2</sum>
        </package>
        <package name="postgresql18-plpython3" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-plpython3-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">356918d7e86e92c80a7cbac5dec8346ace431645cb811265dbc2529f9736a890</sum>
        </package>
        <package name="postgresql18-server" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-server-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">54595c5e4fd3ec8252f01dd8230ae37ce234147422fb325345c2564f4775caf7</sum>
        </package>
        <package name="postgresql18-static" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-static-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">36f2b7decdc7f233e3dea872b5e20da8a9a26b39470b20db7053ad828c8366f1</sum>
        </package>
        <package name="postgresql18-upgrade-devel" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-devel-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d948d38fef98eea2d2481db90045e64e6459aeca4adb163928c6310f2ba356a7</sum>
        </package>
        <package name="postgresql18" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fc4181e5b025242db3d510a9edcc2a1158f1eae576b6e774dd2575b357ea88e2</sum>
        </package>
        <package name="postgresql18-private-devel" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-private-devel-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8b6eed835b08a3f54a3222c1e9c117790e8848b7a0530ed9c57f06f69c9889a4</sum>
        </package>
        <package name="postgresql18-plperl" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-plperl-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b0602d95a048d313283c005ffee5332f4b249e8a63007df0dddb63ca54570e8b</sum>
        </package>
        <package name="postgresql18-upgrade" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-upgrade-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c0956f94294546441b66b67612187418bca5fca515b500cae11ee221dfde9eb0</sum>
        </package>
        <package name="postgresql18-contrib" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-contrib-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">00fe788388dc2200989bc7af5cffd38bc24b3ace569d8d8f73c5e4d4b6e6e61c</sum>
        </package>
        <package name="postgresql18-test" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-test-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e2fc8aa5ce63c8e1694739d58590d3ce1e74fc89b7d3e09bf89cc233e2109c2c</sum>
        </package>
        <package name="postgresql18-server-devel" arch="aarch64" epoch="0" version="18.4" release="1.el10_2" src="postgresql18-18.4-1.el10_2.src.rpm">
          <filename>postgresql18-server-devel-18.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">676f75a726025e68ac89856ba9fb263d1ee8cb3eaf05e9c89924e6a01e08bc82</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:27842</id>
    <title>Important: memcached security update</title>
    <issued date="2026-06-24 12:05:09" />
    <updated date="2026-07-08 12:08:27" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for memcached.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>memcached is a high-performance, distributed memory object caching system, generic in nature, but intended for use in speeding up dynamic web applications by alleviating database load. 

Security Fix(es):

* memcached: memcached: Username enumeration via timing side channel (CVE-2026-47783)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47783" id="CVE-2026-47783" type="cve" title="CVE-2026-47783" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480089" id="2480089" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:27842" id="RLSA-2026:27842" type="self" title="RLSA-2026:27842" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="memcached" arch="aarch64" epoch="0" version="1.6.23" release="7.el10_2.1" src="memcached-1.6.23-7.el10_2.1.src.rpm">
          <filename>memcached-1.6.23-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">5d0244ea00585503963b5d65835a1d3cb71dae5058b6aceac853026a8e725961</sum>
        </package>
        <package name="memcached-selinux" arch="aarch64" epoch="0" version="1.6.23" release="7.el10_2.1" src="memcached-1.6.23-7.el10_2.1.src.rpm">
          <filename>memcached-selinux-1.6.23-7.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">1f67e6c6c4869920d0ca0f5a9d19106836d37fc5e853f5cac10220b6b3b02e53</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:27929</id>
    <title>Important: python3.14-urllib3 security update</title>
    <issued date="2026-06-24 12:05:09" />
    <updated date="2026-07-08 12:08:28" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14-urllib3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* urllib3: urllib3: Denial of Service due to excessive HTTP response decompression (CVE-2026-44432)

* urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers (CVE-2026-44431)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44431" id="CVE-2026-44431" type="cve" title="CVE-2026-44431" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44432" id="CVE-2026-44432" type="cve" title="CVE-2026-44432" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477154" id="2477154" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2477167" id="2477167" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:27929" id="RLSA-2026:27929" type="self" title="RLSA-2026:27929" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3.14-urllib3" arch="noarch" epoch="0" version="2.6.3" release="2.el10_2" src="python3.14-urllib3-2.6.3-2.el10_2.src.rpm">
          <filename>python3.14-urllib3-2.6.3-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">2cc1812fa75b97ca9cd8c82ce826c382e3ef3ab1da5bf146bb0c05834902ad0f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:37436</id>
    <title>Important: golang security, bug fix, and enhancement update</title>
    <issued date="2026-07-13 00:05:40" />
    <updated date="2026-07-27 00:08:18" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

Bug Fix(es) and Enhancement(s):

* Update Go to version 1.26.5+1 [rhel-10.2.z] (JIRA:Rocky Linux-193473)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498152" id="2498152" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:37436" id="RLSA-2026:37436" type="self" title="RLSA-2026:37436" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>go-toolset-1.26.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">05800e9e6647e1177c01ea765f3c995b99292ef2291f137186339821529eb5fe</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-docs-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">7d56c4705f41f8059b8525e5e10532b7577793818d96eba3ba9c7a4c2fb42bc8</sum>
        </package>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-race-1.26.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">674e93d6b492316eebacb3b9a133f8a7ffe8318c5e0511fc94b7f82979115395</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-misc-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">82bc692b6e16e8b7b28594c167a923d1e43ae243e17ffa884f4e79dce6ba07eb</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-tests-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">03bd96c9c35146d54fce39675a2984a11d3f60d11ddc5677d5c0caa292c7a802</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-bin-1.26.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8faca7952cd58f79ab07aa464e754951e31554bdf76ca0820cdce13b99f45e24</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-src-1.26.5-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">b3bfb3baac45cbf187f91e77ed16fa051677bf158c828d9185978236579d0f5c</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.26.5" release="1.el10_2" src="golang-1.26.5-1.el10_2.src.rpm">
          <filename>golang-1.26.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fc08e917a83f465d362c57c18f8c76ba6f686352c87333572f74fa6b35d7aa43</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:28582</id>
    <title>Moderate: keylime security update</title>
    <issued date="2026-06-25 12:05:27" />
    <updated date="2026-07-09 12:06:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for keylime.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Keylime is a TPM based highly scalable remote boot attestation and runtime integrity measurement solution.

Security Fix(es):

* keylime: Keylime: Security bypass due to hardcoded TPM quote nonce (CVE-2026-6420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6420" id="CVE-2026-6420" type="cve" title="CVE-2026-6420" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458889" id="2458889" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:28582" id="RLSA-2026:28582" type="self" title="RLSA-2026:28582" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="keylime-base" arch="aarch64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-base-7.14.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">09b934468bbbb8baf69796f87f05bfaa1e1318001682e3104c78acbcf6c8ec2e</sum>
        </package>
        <package name="keylime-verifier" arch="aarch64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-verifier-7.14.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">56a39b96d0d375e93f3efae0d4e8fce324a83abd11e2081366a6c169117dd222</sum>
        </package>
        <package name="keylime-tools" arch="aarch64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-tools-7.14.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">7a8c8f2cfe11631641da674ae94e194d2ac7d834c78f742d42079a9d63d0250c</sum>
        </package>
        <package name="keylime-registrar" arch="aarch64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-registrar-7.14.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">2ef04fe3057c4ecc1cd0843eed676c70c8f7b90d82535a7b3c6070119faf8cc5</sum>
        </package>
        <package name="keylime" arch="aarch64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-7.14.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">25d3ae01e0b7fbf9dc2d3b422cb98720b6c176d2159d9d4ba8508fdea81ecd13</sum>
        </package>
        <package name="keylime-tenant" arch="aarch64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-tenant-7.14.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">3ee476be3b13c544e43eb5c3cb65a2c2f541e98b030a3748c734271a14a98618</sum>
        </package>
        <package name="keylime-selinux" arch="noarch" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>keylime-selinux-7.14.1-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">dcd20951fcfa048f3adf49d51eea2041e6fce414a3e3d27632e42bce0af96f4a</sum>
        </package>
        <package name="python3-keylime" arch="aarch64" epoch="0" version="7.14.1" release="5.el10_2.1" src="keylime-7.14.1-5.el10_2.1.src.rpm">
          <filename>python3-keylime-7.14.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">6f33643f1e94679951cf1d966f66fda29c671730d4da675a3eb5b2511cc13e2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:28584</id>
    <title>Moderate: libxslt security update</title>
    <issued date="2026-06-25 12:05:27" />
    <updated date="2026-07-09 12:06:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libxslt.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. 

Security Fix(es):

* libxslt: use-after-free with key data stored cross-RVT (CVE-2025-10911)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10911" id="CVE-2025-10911" type="cve" title="CVE-2025-10911" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2397838" id="2397838" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:28584" id="RLSA-2026:28584" type="self" title="RLSA-2026:28584" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libxslt" arch="aarch64" epoch="0" version="1.1.39" release="8.el10_2.1" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-1.1.39-8.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">64f8aa10d1c1cb3a0f7ccfa0618d461bd8f573e8b3b4cb038b37f3814f32044c</sum>
        </package>
        <package name="libxslt-devel" arch="aarch64" epoch="0" version="1.1.39" release="8.el10_2.1" src="libxslt-1.1.39-8.el10_2.1.src.rpm">
          <filename>libxslt-devel-1.1.39-8.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">3685a3033bc6572bc30d45642491989dcce5b51168a6af53db4c1d882cd8f531</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:29035</id>
    <title>Important: skopeo security update</title>
    <issued date="2026-06-25 12:05:27" />
    <updated date="2026-07-09 12:06:50" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:29035" id="RLSA-2026:29035" type="self" title="RLSA-2026:29035" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="skopeo-tests" arch="aarch64" epoch="2" version="1.22.2" release="2.el10_2" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-tests-1.22.2-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ee48841ecb637c98c35c3576d8d28d85db4760f0a9f9c04bc7b0326622f22f9a</sum>
        </package>
        <package name="skopeo" arch="aarch64" epoch="2" version="1.22.2" release="2.el10_2" src="skopeo-1.22.2-2.el10_2.src.rpm">
          <filename>skopeo-1.22.2-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c50c701a0b4c9addeca90ecf09600b9ea82b380856d357eaf56412f6e3572a61</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:29195</id>
    <title>Important: buildah security update</title>
    <issued date="2026-06-26 12:05:00" />
    <updated date="2026-07-10 12:07:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32280" id="CVE-2026-32280" type="cve" title="CVE-2026-32280" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32281" id="CVE-2026-32281" type="cve" title="CVE-2026-32281" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2445356" id="2445356" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456339" id="2456339" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456333" id="2456333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456338" id="2456338" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:29195" id="RLSA-2026:29195" type="self" title="RLSA-2026:29195" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.43.1" release="2.el10_2" src="buildah-1.43.1-2.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6b76f6c55fe9040e0f7c849426055852553171d20969423ff2db3f205d5783c6</sum>
        </package>
        <package name="buildah" arch="aarch64" epoch="2" version="1.43.1" release="2.el10_2" src="buildah-1.43.1-2.el10_2.src.rpm">
          <filename>buildah-1.43.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9f689c274780591cdfcfc4389fde1a735b50b93752abe50f18577fba1e48bcfa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:29874</id>
    <title>Important: nginx security update</title>
    <issued date="2026-06-26 12:05:00" />
    <updated date="2026-07-10 12:07:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: ngx_http_rewrite_module: code execution and denial of service (CVE-2026-9256)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9256" id="CVE-2026-9256" type="cve" title="CVE-2026-9256" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480746" id="2480746" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:29874" id="RLSA-2026:29874" type="self" title="RLSA-2026:29874" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nginx-mod-mail" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">59940f40232fb2c2ff3d6c581739a4f8800a37b16fa3e54c5365fca6f2262c8f</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">257aae33a8348286b69ea9a26aa46bb49f0d0383a076f12501ef8656cbd82a41</sum>
        </package>
        <package name="nginx" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">b47c658516d17053247e68b081b3db364d56caf10e59e7bd95a5905586ac3558</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">090df6e6f4aac19bd460cf4f6803ace6aa68d0bc23d481f3cf8761e462f29aca</sum>
        </package>
        <package name="nginx-mod-http-perl" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">3abaa941fb7c1880595830a0405f3fdcdc4b887fae176853403ec40d1a733f1f</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">cf92ec8bbc4391bbb2ee96dc2926476146bd87753e70ef1bcca21fb6e2f4bef1</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">c9689aa476772bcde333780aa2a156b6ec526c6a5d33047395824e209621a02a</sum>
        </package>
        <package name="nginx-core" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">f32627027056487b96dd56c87fd275e4a6c4bf2f6f68a564b92c73492dbb6303</sum>
        </package>
        <package name="nginx-mod-stream" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.4" src="nginx-1.26.3-6.el10_2.4.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">4298a6ae04f7391d679e5706f594a8b092152a5a1afdfafe400cf1699fa2bc73</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:29980</id>
    <title>Moderate: golang security, bug fix, and enhancement update</title>
    <issued date="2026-06-26 12:05:00" />
    <updated date="2026-07-10 12:07:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/textproto: golang: Golang net/textproto: Misleading error messages via input injection (CVE-2026-42507)

Bug Fix(es) and Enhancement(s):

* Update Go to version 1.26.4+1 [rhel-10.2.z] (JIRA:Rocky Linux-183347)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42507" id="CVE-2026-42507" type="cve" title="CVE-2026-42507" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484205" id="2484205" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:29980" id="RLSA-2026:29980" type="self" title="RLSA-2026:29980" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-race-1.26.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">72655cb33998c04c63977272d4cec1733c3161c6bc3d775e418a0667fb8a6c1a</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>go-toolset-1.26.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0d513f7679ceb8993d72cf07ec545706f10c7ea1f2cfee77960482417d07488a</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-misc-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">5d408d5055e58997f7813b82104cc826daf5b1e3ac7e46d0dd58c4e13b6aa41c</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-docs-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">6cfeb977b32a146facd7a47b0b6167099e6683169d11d8749b0c868d8b1fb406</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-bin-1.26.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b87821c300dd0c11dbbe9245d85d91ab7539ed6c77db4fa8046d7b143c2c0dd4</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-1.26.4-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6e68c2ab27cc596b2211d980c4097fbbe0d3811b35032a01bb43827b83ba8f05</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-tests-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">a8847313447ef5a94ea6f8a08caf0d330e0ddd4a3157f4f98c72728b30face69</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.26.4" release="1.el10_2" src="golang-1.26.4-1.el10_2.src.rpm">
          <filename>golang-src-1.26.4-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">c6c199afd97140748f0c99c1ad6f048f5fa41f602f09ee7c5487cfd1c6cc6466</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:28581</id>
    <title>Important: python3.14 security, bug fix, and enhancement update</title>
    <issued date="2026-06-27 06:04:25" />
    <updated date="2026-07-11 06:04:49" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)

* python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module (CVE-2026-6019)

Bug Fix(es) and Enhancement(s):

* [10.2.z]Update python3.14 to 3.14.5 for the incremental GC changes (JIRA:Rocky Linux-176147)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6019" id="CVE-2026-6019" type="cve" title="CVE-2026-6019" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460869" id="2460869" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2458049" id="2458049" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:28581" id="RLSA-2026:28581" type="self" title="RLSA-2026:28581" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3.14" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-3.14.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c2c6f005266ddae9db4c9781ab63e523f632c1bb5a89e858e4a30e04568a0a0c</sum>
        </package>
        <package name="python3.14-tkinter" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-tkinter-3.14.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">70e831b8a78b1fa0caea0aad073e5dbeda84da0f2ec93dba9ec33918b2ed5574</sum>
        </package>
        <package name="python3.14-libs" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-libs-3.14.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c8029b996dc8e3ec2ba5cdf568db42633e3fead341e645b7c79b9f0e5334780e</sum>
        </package>
        <package name="python3.14-devel" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2" src="python3.14-3.14.5-1.el10_2.src.rpm">
          <filename>python3.14-devel-3.14.5-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ed0e02cbbeceb499e2b85347aac09977553f6958b234e62440ee8744947766c1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:30860</id>
    <title>Important: perl-IO-Compress security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:28" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-IO-Compress.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This distribution provides a Perl interface to allow reading and writing of compressed data created with the zlib and bzip2 libraries.  IO-Compress supports reading and writing of bzip2, RFC 1950, RFC 1951, RFC 1952 (i.e. gzip) and zip files/buffers.  The following modules used to be distributed separately, but are now included with the IO-Compress distribution:
* Compress-Zlib
* IO-Compress-Zlib
* IO-Compress-Bzip2
* IO-Compress-Base

Security Fix(es):

* perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob (CVE-2026-48962)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48962" id="CVE-2026-48962" type="cve" title="CVE-2026-48962" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481767" id="2481767" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:30860" id="RLSA-2026:30860" type="self" title="RLSA-2026:30860" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl-IO-Compress" arch="noarch" epoch="0" version="2.212" release="512.el10_2.1" src="perl-IO-Compress-2.212-512.el10_2.1.src.rpm">
          <filename>perl-IO-Compress-2.212-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">b059ac10cc0fcc90f882a530ae1a53380607e1817d38ceaaf4d3544824a10b03</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:30857</id>
    <title>Important: perl-Archive-Tar security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-Archive-Tar.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Archive::Tar provides an object oriented mechanism for handling tar files.  It provides class methods for quick and easy files handling while also allowing for the creation of tar file objects for custom manipulation.  If you have the IO::Zlib module installed, Archive::Tar will also support compressed or gzipped tar files.

Security Fix(es):

* perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access (CVE-2026-42496)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42496" id="CVE-2026-42496" type="cve" title="CVE-2026-42496" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481314" id="2481314" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:30857" id="RLSA-2026:30857" type="self" title="RLSA-2026:30857" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl-Archive-Tar" arch="noarch" epoch="0" version="3.02" release="512.el10_2.1" src="perl-Archive-Tar-3.02-512.el10_2.1.src.rpm">
          <filename>perl-Archive-Tar-3.02-512.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">def235214b96ac1753ba263eea2241b5563e0010c7070bc858179956c3b829da</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:30855</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:30855" id="RLSA-2026:30855" type="self" title="RLSA-2026:30855" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git-lfs" arch="aarch64" epoch="0" version="3.7.1" release="5.el10_2.5" src="git-lfs-3.7.1-5.el10_2.5.src.rpm">
          <filename>git-lfs-3.7.1-5.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">2e919ad98091ddc255e99c99e69ea9036eea37c0a3f5f05eb6aae706700b242b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:30845</id>
    <title>Moderate: mod_md security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_md.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module manages common properties of domains for one or more virtual hosts. Specifically it can use the ACME protocol to automate certificate provisioning.  Certificates will be configured for managed domains and their virtual hosts automatically, including at renewal.

Security Fix(es):

* httpd: mod_md: unrestricted OCSP response leads to resource exhaustion (CVE-2026-29168)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29168" id="CVE-2026-29168" type="cve" title="CVE-2026-29168" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466753" id="2466753" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:30845" id="RLSA-2026:30845" type="self" title="RLSA-2026:30845" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_md" arch="aarch64" epoch="1" version="2.4.26" release="5.el10_2.1" src="mod_md-2.4.26-5.el10_2.1.src.rpm">
          <filename>mod_md-2.4.26-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">19d5995c7e6bdd3cb22a0ac31b6fd593ff3cc329fc115fbc6f0661d70cfce6ff</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:30846</id>
    <title>Important: thunderbird security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Sandbox escape in the DOM: Workers component (CVE-2026-12294)

* firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12313)

* firefox: thunderbird: Information disclosure, sandbox escape in the Security: Process Sandboxing component (CVE-2026-12311)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12290)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12327)

* firefox: thunderbird: JIT miscompilation in the DOM: Core &amp; HTML component (CVE-2026-12299)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12329)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12312)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12302)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.37, Firefox ESR 140.12, Thunderbird ESR 140.12, Firefox 152 and Thunderbird 152 (CVE-2026-12328)

* firefox: thunderbird: Incorrect boundary conditions in the Internationalization component (CVE-2026-12330)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12314)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12309)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12310)

* firefox: thunderbird: Denial-of-service in the Graphics: ImageLib component (CVE-2026-12325)

* firefox: thunderbird: Sandbox escape in the DOM: Navigation component (CVE-2026-12295)

* firefox: thunderbird: Privilege escalation in the Graphics: WebRender component (CVE-2026-12289)

* firefox: thunderbird: Mitigation bypass in the DOM: Security component (CVE-2026-12315)

* firefox: thunderbird: Sandbox escape in the Security: Process Sandboxing component (CVE-2026-12296)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12306)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12307)

* firefox: thunderbird: Sandbox escape due to incorrect boundary conditions in the Networking component (CVE-2026-12297)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12305)

* firefox: thunderbird: Incorrect boundary conditions in the Web Audio component (CVE-2026-12292)

* firefox: thunderbird: Memory safety bug fixed in Thunderbird ESR 140.12 (CVE-2026-12308)

* firefox: thunderbird: Incorrect boundary conditions in the Graphics: CanvasWebGL component (CVE-2026-12324)

* firefox: thunderbird: Same-origin policy bypass in the Networking: Cookies component (CVE-2026-12304)

* firefox: thunderbird: Use-after-free in the Networking: HTTP component (CVE-2026-12291)

* firefox: thunderbird: Memory safety bug fixed in Firefox ESR 140.12 (CVE-2026-12298)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12289" id="CVE-2026-12289" type="cve" title="CVE-2026-12289" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12290" id="CVE-2026-12290" type="cve" title="CVE-2026-12290" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12291" id="CVE-2026-12291" type="cve" title="CVE-2026-12291" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12292" id="CVE-2026-12292" type="cve" title="CVE-2026-12292" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12294" id="CVE-2026-12294" type="cve" title="CVE-2026-12294" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12295" id="CVE-2026-12295" type="cve" title="CVE-2026-12295" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12296" id="CVE-2026-12296" type="cve" title="CVE-2026-12296" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12297" id="CVE-2026-12297" type="cve" title="CVE-2026-12297" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12298" id="CVE-2026-12298" type="cve" title="CVE-2026-12298" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12299" id="CVE-2026-12299" type="cve" title="CVE-2026-12299" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12302" id="CVE-2026-12302" type="cve" title="CVE-2026-12302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12304" id="CVE-2026-12304" type="cve" title="CVE-2026-12304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12305" id="CVE-2026-12305" type="cve" title="CVE-2026-12305" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12306" id="CVE-2026-12306" type="cve" title="CVE-2026-12306" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12307" id="CVE-2026-12307" type="cve" title="CVE-2026-12307" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12308" id="CVE-2026-12308" type="cve" title="CVE-2026-12308" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12309" id="CVE-2026-12309" type="cve" title="CVE-2026-12309" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12310" id="CVE-2026-12310" type="cve" title="CVE-2026-12310" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12311" id="CVE-2026-12311" type="cve" title="CVE-2026-12311" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12312" id="CVE-2026-12312" type="cve" title="CVE-2026-12312" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12313" id="CVE-2026-12313" type="cve" title="CVE-2026-12313" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12314" id="CVE-2026-12314" type="cve" title="CVE-2026-12314" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12315" id="CVE-2026-12315" type="cve" title="CVE-2026-12315" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12324" id="CVE-2026-12324" type="cve" title="CVE-2026-12324" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12325" id="CVE-2026-12325" type="cve" title="CVE-2026-12325" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12327" id="CVE-2026-12327" type="cve" title="CVE-2026-12327" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12328" id="CVE-2026-12328" type="cve" title="CVE-2026-12328" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12329" id="CVE-2026-12329" type="cve" title="CVE-2026-12329" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12330" id="CVE-2026-12330" type="cve" title="CVE-2026-12330" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489232" id="2489232" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489234" id="2489234" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489226" id="2489226" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489221" id="2489221" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489224" id="2489224" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489244" id="2489244" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489236" id="2489236" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489209" id="2489209" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489207" id="2489207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489215" id="2489215" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489229" id="2489229" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489233" id="2489233" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489217" id="2489217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489208" id="2489208" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489223" id="2489223" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489235" id="2489235" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489220" id="2489220" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489239" id="2489239" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489248" id="2489248" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489237" id="2489237" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489211" id="2489211" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489214" id="2489214" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489225" id="2489225" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489231" id="2489231" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489212" id="2489212" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489240" id="2489240" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489218" id="2489218" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489243" id="2489243" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489210" id="2489210" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:30846" id="RLSA-2026:30846" type="self" title="RLSA-2026:30846" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.12.0" release="1.el10_2" src="thunderbird-140.12.0-1.el10_2.src.rpm">
          <filename>thunderbird-140.12.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">1b1e21ffed254da9d6e95132bcdc69b1c6b238c6637b41fd61175ad7b8e982a6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33093</id>
    <title>Important: mariadb10.11 security, bug fix, and enhancement update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mariadb10.11.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 10.11 to 10.11.18 in Rocky Linux10 (JIRA:Rocky Linux-183086)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44168" id="CVE-2026-44168" type="cve" title="CVE-2026-44168" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44170" id="CVE-2026-44170" type="cve" title="CVE-2026-44170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44171" id="CVE-2026-44171" type="cve" title="CVE-2026-44171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44173" id="CVE-2026-44173" type="cve" title="CVE-2026-44173" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48163" id="CVE-2026-48163" type="cve" title="CVE-2026-48163" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48165" id="CVE-2026-48165" type="cve" title="CVE-2026-48165" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487957" id="2487957" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488450" id="2488450" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488453" id="2488453" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488458" id="2488458" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488451" id="2488451" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488460" id="2488460" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488454" id="2488454" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33093" id="RLSA-2026:33093" type="self" title="RLSA-2026:33093" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mariadb-client-utils" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-client-utils-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">01275add382730bb8fc9388922d00e48da9fd6caf34bf08d1586054a3e374fd0</sum>
        </package>
        <package name="mariadb" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">06cb5c32ff953b184bd0995ff1b0c6734dae888b1c96b69a2de1c636ab467a57</sum>
        </package>
        <package name="mariadb-common" arch="noarch" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-common-10.11.18-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">3cd74e44e796f07186f75a393865c312bb1d3f6ef70b615efa0d85cf9cced829</sum>
        </package>
        <package name="mariadb-server" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-server-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">44242bbeed896479c8fc54c1369268bb00ca14c0e98372dd92b2bbdf91d9a678</sum>
        </package>
        <package name="mariadb-embedded" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-embedded-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">dd5cde3dbbe5e9c1edcb3f3052d85e58a48e56e1c0c729acf46c3c01892d03fa</sum>
        </package>
        <package name="mariadb-gssapi-server" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-gssapi-server-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8528552d2eafd6fde509880377559d05d9223816af404fad61c3619b1acebc70</sum>
        </package>
        <package name="mariadb-devel" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-devel-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8e890495091ed4b0873595183d9d0c0c5d744e45e7d2af0f04eea290528a94f0</sum>
        </package>
        <package name="mariadb-test" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-test-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">942fd9c39d5ef76624c863e8d3fc968ff2982fa053753566922041951f76820d</sum>
        </package>
        <package name="mariadb-backup" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-backup-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">096f38e53816c86790ce604fca44af40fe86f064d8feec2ac820b10804b8f657</sum>
        </package>
        <package name="mariadb-pam" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-pam-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">952f80d3cc1015011b4dbc1001f51c7794398abd431472be3fc39824b78df35d</sum>
        </package>
        <package name="mariadb-server-galera" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-server-galera-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0d22f7a382ea94414000d421a465721583f0baae32f71204b0232d49c314a822</sum>
        </package>
        <package name="mariadb-oqgraph-engine" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-oqgraph-engine-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">3274a0f5bcc97ad11998eb36a3b7cbd15fb4ffb998a7e90d4266b148ca992b44</sum>
        </package>
        <package name="mariadb-server-utils" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-server-utils-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a95b2deeddb3f7ee7699522b58da21de78a02ee5fb8b0c1ce24fd262d76a4627</sum>
        </package>
        <package name="mariadb-embedded-devel" arch="aarch64" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-embedded-devel-10.11.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e4597e06c799329d060671bc2f5c6e476d743719e339a6ab83a2bfe1427e7205</sum>
        </package>
        <package name="mariadb-errmsg" arch="noarch" epoch="3" version="10.11.18" release="1.el10_2" src="mariadb10.11-10.11.18-1.el10_2.src.rpm">
          <filename>mariadb-errmsg-10.11.18-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">24478e435c3192ce142367475151c6ac8066ae9239eed0b5be804a8b8a61cc7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33412</id>
    <title>Important: galera and mariadb11.8 security, bug fix, and enhancement update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mariadb11.8, galera.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MariaDB is a community developed fork from MySQL - a multi-user, multi-threaded SQL database server. It is a client/server implementation consisting of a server daemon (mariadbd) and many different client programs and libraries. The base package contains the standard MariaDB/MySQL client programs and utilities.

Security Fix(es):

* mariadb: MariaDB Server: Arbitrary code execution via wsrep_notify_cmd (CVE-2026-49261)

Bug Fix(es) and Enhancement(s):

* Rebase MariaDB 11.8 to 11.8.8 in Rocky Linux10 (JIRA:Rocky Linux-183084)

* Rebase Galera to 26.4.27 in Rocky Linux10 (JIRA:Rocky Linux-183259)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44168" id="CVE-2026-44168" type="cve" title="CVE-2026-44168" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44169" id="CVE-2026-44169" type="cve" title="CVE-2026-44169" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44170" id="CVE-2026-44170" type="cve" title="CVE-2026-44170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44171" id="CVE-2026-44171" type="cve" title="CVE-2026-44171" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44173" id="CVE-2026-44173" type="cve" title="CVE-2026-44173" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48163" id="CVE-2026-48163" type="cve" title="CVE-2026-48163" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48165" id="CVE-2026-48165" type="cve" title="CVE-2026-48165" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-49261" id="CVE-2026-49261" type="cve" title="CVE-2026-49261" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488450" id="2488450" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488453" id="2488453" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488458" id="2488458" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488451" id="2488451" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488460" id="2488460" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488467" id="2488467" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2488454" id="2488454" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487957" id="2487957" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33412" id="RLSA-2026:33412" type="self" title="RLSA-2026:33412" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="galera" arch="aarch64" epoch="0" version="26.4.27" release="1.el10_2" src="galera-26.4.27-1.el10_2.src.rpm">
          <filename>galera-26.4.27-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d8c4dd5371c02bf1fc23f06b762c25e5f0ec21ed5515b972c75fee203fb04193</sum>
        </package>
        <package name="mariadb11.8-pam" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-pam-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">af21541b363ed8d3bef8e5f66e1d8afb894170892e004b5dd7a3dc9013f8d43a</sum>
        </package>
        <package name="mariadb11.8-backup" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-backup-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f3aea8280f789e1d2d4c5874afdc58f751dc63e215ca3f73d3b896e26f2b57b1</sum>
        </package>
        <package name="mariadb11.8-server-galera" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-galera-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f318fa59e2987df6954c1f4cce2b43e3b203e96d0fd67e8a022f57fcf6ac42bd</sum>
        </package>
        <package name="mariadb11.8-embedded-devel" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-devel-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a7b2fc38f5eba9fa7e4e3debb2aeb7db2c931b4c481df9e35fbd191a03742111</sum>
        </package>
        <package name="mariadb11.8-client-utils" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-client-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">bdf085f9b32027a04faf1936121294f4e125cbbaa4d25d41790a24c0ad470748</sum>
        </package>
        <package name="mariadb11.8-gssapi-server" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-gssapi-server-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2f9a2f5d7d1574b86794fd82add7b38fe493b950938a04e6337e1659056c99ca</sum>
        </package>
        <package name="mariadb11.8-devel" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-devel-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e19e58064e199bdb816cc57d12816922982c065345b2cc8de2e6955a547aadf7</sum>
        </package>
        <package name="mariadb11.8-oqgraph-engine" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-oqgraph-engine-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6ebd880c8cefbe055cc75eff3be97039d97121ba0d080584b7d5088e04acfbc0</sum>
        </package>
        <package name="mariadb11.8" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8293303d0c7060ec06d814e786c6b588b5a3d04b049a61341e8151026c92ba58</sum>
        </package>
        <package name="mariadb11.8-common" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-common-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">27b7c1c52b97aa63466127b63183d7f1383218b9a5e76c82725d30a90ea56f6d</sum>
        </package>
        <package name="mariadb11.8-server-utils" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-utils-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">67adcf01931ae0f0f1af0de602946a94f403b211d441e3dc1db0c3878db9d7c3</sum>
        </package>
        <package name="mariadb11.8-embedded" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-embedded-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">5c95abf0bea302668e6b85ced1616301119ad0ccb241b2c3fff96f36dff32439</sum>
        </package>
        <package name="mariadb11.8-server" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-server-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">bd0790e5d02e25bc24607f87ab17f3cbc32802e0cce57923ccf46b6741fada55</sum>
        </package>
        <package name="mariadb11.8-test" arch="aarch64" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-test-11.8.8-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4346bebe91ad93ce03a40484f973bd375bf718b2fed0e421199f4ae937d1f4fe</sum>
        </package>
        <package name="mariadb11.8-errmsg" arch="noarch" epoch="3" version="11.8.8" release="1.el10_2" src="mariadb11.8-11.8.8-1.el10_2.src.rpm">
          <filename>mariadb11.8-errmsg-11.8.8-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">1c2e025220336444a26355b1c6fd8c3674cf71a426b239bf27040ce11a51899f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33540</id>
    <title>Important: ruby4.0 security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ruby4.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is the interpreted scripting language for quick and easy object-oriented programming.  It has many features to process text files and to do system management tasks (as in Perl).  It is simple, straight-forward, and extensible.

Security Fix(es):

* ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)

* ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)

* net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468495" id="2468495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468499" id="2468499" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468498" id="2468498" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33540" id="RLSA-2026:33540" type="self" title="RLSA-2026:33540" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ruby4.0-rubygem-pg" arch="aarch64" epoch="0" version="1.6.3" release="35.el10_2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-pg-1.6.3-35.el10_2.aarch64.rpm</filename>
          <sum type="sha256">628ae3f2e5da9a40c84563122e610187113c24703811ee723a3493f856b64f20</sum>
        </package>
        <package name="ruby4.0-rubygem-mysql2" arch="aarch64" epoch="0" version="0.5.7" release="35.el10_2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-rubygem-mysql2-0.5.7-35.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ecc8b037d6d621041f92997f8ab826c1c9a533ca572973296c9534ec29c23e84</sum>
        </package>
        <package name="ruby4.0" arch="aarch64" epoch="0" version="4.0.3" release="35.el10_2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-4.0.3-35.el10_2.aarch64.rpm</filename>
          <sum type="sha256">684c73396e75a073c5f8f91e8d45d872bd71aea6bd87d34f74a7f7f307b7df44</sum>
        </package>
        <package name="ruby4.0-devel" arch="aarch64" epoch="0" version="4.0.3" release="35.el10_2" src="ruby4.0-4.0.3-35.el10_2.src.rpm">
          <filename>ruby4.0-devel-4.0.3-35.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e43e55cabac197dfda2f87621107e2d245b72f828b33e4e2a4c1150a898dc452</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33565</id>
    <title>Important: ruby security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* ruby: net-imap: Net::IMAP: Denial of Service via crafted IMAP responses (CVE-2026-42245)

* ruby/net-imap: ruby: Net::IMAP: IMAP Command Injection via Symbol Arguments (CVE-2026-42258)

* net-imap: ruby: Net::IMAP: Information disclosure via man-in-the-middle attack bypassing TLS (CVE-2026-42246)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42245" id="CVE-2026-42245" type="cve" title="CVE-2026-42245" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42246" id="CVE-2026-42246" type="cve" title="CVE-2026-42246" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42258" id="CVE-2026-42258" type="cve" title="CVE-2026-42258" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468495" id="2468495" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468499" id="2468499" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468498" id="2468498" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33565" id="RLSA-2026:33565" type="self" title="RLSA-2026:33565" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-irb-1.13.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">28cf1c820c847698d85c6c93c4c5e956fd32cad37b2c37fe0bad1cc2733b1129</sum>
        </package>
        <package name="rubygem-io-console" arch="aarch64" epoch="0" version="0.7.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-io-console-0.7.1-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e5ee055ee64388026ebbc358ad4f8b92cda690ec39bcd31b80d3ed18a715451d</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rake-13.1.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">fb0899a3b9b46f54db49b28696bdd96743cb35f8893bc3277f0a9b4afae47fe6</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-devel-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">b03f3b4b8e82aa8edc66fe5450c64e40fa5077192b659b0732597d5d021b5d11</sum>
        </package>
        <package name="rubygem-json" arch="aarch64" epoch="0" version="2.7.2" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-json-2.7.2-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">35f71368d87c1b2d0dde6afda7090fd543206630d517f79bcdbe916ab0455a95</sum>
        </package>
        <package name="ruby-libs" arch="aarch64" epoch="0" version="3.3.10" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-libs-3.3.10-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">41d1e54befdf03fdb2cb349b67f521147eaa1d33e9deb87948111a2ae73212de</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.4.4" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rexml-3.4.4-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">8517f1665690b67e89de21483e07ff58235570b5eb05563d6aa2d72a9158f42d</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygems-3.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">e2a37f258c1711d598ec2925881e5d03d8f911b3fd7be75ac29f6360b377ec1f</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-test-unit-3.6.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">89baaea436528e59b988d3bf472121fc65f3cfdd3c0ce79634de4b2fd08c8242</sum>
        </package>
        <package name="rubygem-rbs" arch="aarch64" epoch="0" version="3.4.0" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rbs-3.4.0-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">11c052de29a006ebc073cd2787924eb83b35d480324d10207896b72ec69fc84d</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-typeprof-0.21.9-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">5280386d092bc331ac552910b710f8bdaa37fb619f97d5e21601adbf85f7c784</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.10" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-default-gems-3.3.10-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">c59c666c2cfc7c70462f8eff4842c02f2344b6c51cbe3b543af9c429db9060bc</sum>
        </package>
        <package name="ruby-devel" arch="aarch64" epoch="0" version="3.3.10" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-devel-3.3.10-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ec8d889b8b0e8d0a91833a3723a0f12748a439cefcb7e6376d92eb8f35a0e9da</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="aarch64" epoch="0" version="3.1.5" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b873a2e691bff0d014b9edab2e26563f8cd740052a3780254cf70005941ce328</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-minitest-5.20.0-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">833fc9fc88e6368f005ccec5994cdb15e408050c12dd96772a47a07f3b69bdec</sum>
        </package>
        <package name="ruby-bundled-gems" arch="aarch64" epoch="0" version="3.3.10" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-bundled-gems-3.3.10-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">eb5220ced52e476908118e882fe4a1967fa89394ac512120c06f36efd95591ed</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">06a507e0c3f82ef923f820ceaf33ef9e0a87543304ff4548999c361be1dee061</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-power_assert-2.0.3-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">67513e1e30b7a65f258843366aba5ce0c270f13ada04afa6df9be8639abc79fb</sum>
        </package>
        <package name="ruby" arch="aarch64" epoch="0" version="3.3.10" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>ruby-3.3.10-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b5ae371e6b50d024316c8db5e72ac614ec41722d435a4e938a641db9ae7d716d</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-rss-0.3.1-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">0b178d6ce03da5bf79edb2506a13da5511fcdc939a9f328662bf96e5d851db1d</sum>
        </package>
        <package name="rubygem-psych" arch="aarch64" epoch="0" version="5.1.2" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-psych-5.1.2-13.el10_2.aarch64.rpm</filename>
          <sum type="sha256">84ea47c9dd3731fb79cfd1d86d2bfba63e52d326ae68accc4d0d66a2800ae89d</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="13.el10_2" src="ruby-3.3.10-13.el10_2.src.rpm">
          <filename>rubygem-bundler-2.5.22-13.el10_2.noarch.rpm</filename>
          <sum type="sha256">e59464032348e22159892eb4aa81e8d2bc6dbb44bb43b3a45d7921e0f7691463</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33502</id>
    <title>Important: giflib security update</title>
    <issued date="2026-07-05 12:05:09" />
    <updated date="2026-07-19 12:07:29" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for giflib.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>giflib is a library for reading and writing gif images.

Security Fix(es):

* giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension (CVE-2026-26740)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-26740" id="CVE-2026-26740" type="cve" title="CVE-2026-26740" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2448747" id="2448747" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33502" id="RLSA-2026:33502" type="self" title="RLSA-2026:33502" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="giflib" arch="aarch64" epoch="0" version="5.2.1" release="25.el10_2" src="giflib-5.2.1-25.el10_2.src.rpm">
          <filename>giflib-5.2.1-25.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8c100883b097b968ec3e55598a9ef3ea799953f1ad6e2449ff32880d285236a0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35841</id>
    <title>Important: nodejs24 security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs24.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* undici: undici: Man-in-the-Middle attack via ignored TLS options with SOCKS5 proxy (CVE-2026-9697)

* undici: undici: Information disclosure and data integrity issues due to incorrect Socks5ProxyAgent connection routing (CVE-2026-6734)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

* nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:Rocky Linux-186582)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6734" id="CVE-2026-6734" type="cve" title="CVE-2026-6734" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9697" id="CVE-2026-9697" type="cve" title="CVE-2026-9697" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490006" id="2490006" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476810" id="2476810" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490008" id="2490008" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490024" id="2490024" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493333" id="2493333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493329" id="2493329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493335" id="2493335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493331" id="2493331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489980" id="2489980" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493332" id="2493332" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490000" id="2490000" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493326" id="2493326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490018" id="2490018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493325" id="2493325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493337" id="2493337" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35841" id="RLSA-2026:35841" type="self" title="RLSA-2026:35841" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nodejs24-devel" arch="aarch64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-devel-24.18.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6d009912fc922f788bfcb56a9fb48bede77bcfce031f3939026bb1cabf83e945</sum>
        </package>
        <package name="nodejs24-docs" arch="noarch" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-docs-24.18.0-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">98dfc8543e2bda18ce07381220e682a38f99a487f4e472426103a224f872c145</sum>
        </package>
        <package name="nodejs24-libs" arch="aarch64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-libs-24.18.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">64bcae72b059cbfd144d433c2956b04a4622fdff441fc85c49b49f7a1f3ccf7d</sum>
        </package>
        <package name="nodejs24-npm" arch="noarch" epoch="1" version="11.16.0" release="1.24.18.0.1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-npm-11.16.0-1.24.18.0.1.el10_2.noarch.rpm</filename>
          <sum type="sha256">f302925c9bee672aeef0da7db54c016811b40b05f7dcc16a87141d301e30d126</sum>
        </package>
        <package name="nodejs24-full-i18n" arch="aarch64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-full-i18n-24.18.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">796d3521e5183952d314b888a6fb27388ac7da86887a723591781de44430d322</sum>
        </package>
        <package name="nodejs24" arch="aarch64" epoch="1" version="24.18.0" release="1.el10_2" src="nodejs24-24.18.0-1.el10_2.src.rpm">
          <filename>nodejs24-24.18.0-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">37314323e54d38b553455023180e4698b5b513a103ebbc0cb0d89675bbcb27e8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36673</id>
    <title>Moderate: gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gstreamer1-plugins-ugly-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework, based on graphs of elements which operate on media data.  This package contains plug-ins whose license is not fully compatible with LGPL.

Security Fix(es):

* gstreamer1-plugins-ugly-free: GStreamer: Out-of-bounds read in RealMedia demuxer audio stream header parser (CVE-2026-53703)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53703" id="CVE-2026-53703" type="cve" title="CVE-2026-53703" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487613" id="2487613" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36673" id="RLSA-2026:36673" type="self" title="RLSA-2026:36673" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gstreamer1-plugins-ugly-free" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-ugly-free-1.26.7-2.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">f4db93551da909fdc8d2d6f1d65747463cdfa4d2dc2735f4cd42d909418ae175</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36675</id>
    <title>Important: gstreamer1-plugins-good security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-good.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.

Security Fix(es):

* gstreamer1-plugins-good: GStreamer: Heap buffer overflow in WavPack decoder via integer overflow (CVE-2026-53705)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-53705" id="CVE-2026-53705" type="cve" title="CVE-2026-53705" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2487615" id="2487615" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36675" id="RLSA-2026:36675" type="self" title="RLSA-2026:36675" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gstreamer1-plugins-good-gtk" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-good-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-good-gtk-1.26.7-2.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">cc9761bf0adb9af8f9e355534b4032d79c9c32302a8ca6f619c890ff18161151</sum>
        </package>
        <package name="gstreamer1-plugins-good" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2.1" src="gstreamer1-plugins-good-1.26.7-2.el10_2.1.src.rpm">
          <filename>gstreamer1-plugins-good-1.26.7-2.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">4d4403c59ca82513ec15582b77fc4a766a82d59559df45746662488636c8c333</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36749</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* gstreamer1-plugins-bad-free: GStreamer: Denial of service via AV1 tile_list_obu parser byte/bit confusion (CVE-2026-52718)

* gstreamer1-plugins-bad-free: GStreamer: Out-of-bounds read via JPEG segment length validation in VA decoder (CVE-2026-52719)

* gstreamer1-plugins-bad-free: GStreamer: Heap buffer overflow via crafted VNC server rectangle in librfb (CVE-2026-52720)

* gstreamer1-plugins-bad-free: GStreamer: Signed integer overflow in VMnc decoder cursor payload handling (CVE-2026-52722)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52718" id="CVE-2026-52718" type="cve" title="CVE-2026-52718" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52719" id="CVE-2026-52719" type="cve" title="CVE-2026-52719" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52720" id="CVE-2026-52720" type="cve" title="CVE-2026-52720" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-52722" id="CVE-2026-52722" type="cve" title="CVE-2026-52722" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486731" id="2486731" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486353" id="2486353" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486733" id="2486733" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486328" id="2486328" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36749" id="RLSA-2026:36749" type="self" title="RLSA-2026:36749" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gstreamer1-plugins-bad-free" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2.4" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">c3a8e6270834381f35cb7b7ce6021e6ba4a96e4b6c87c6c472d44eaf00b96224</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="aarch64" epoch="0" version="1.26.7" release="2.el10_2.4" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.4.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.26.7-2.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">f67eecddc31a980398e2135db0be276a0f39c6bf23351caaa440b52c757c07d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35842</id>
    <title>Important: nodejs22 security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)

* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)

* undici: Undici: Information disclosure due to improper cache-control header parsing (CVE-2026-9678)

* undici: Undici: Response queue poisoning on reused keep-alive sockets can lead to incorrect response delivery. (CVE-2026-6733)

* undici: undici: Weakening of cookie SameSite policy due to incorrect parsing of Set-Cookie header (CVE-2026-11525)

* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)

* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)

* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)

* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)

* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)

* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)

* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)

* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)

Bug Fix(es) and Enhancement(s):

* nodejs22: Rebase to the latest Node.js 22 release [rhel-10.2.z] (JIRA:Rocky Linux-186623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11525" id="CVE-2026-11525" type="cve" title="CVE-2026-11525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12151" id="CVE-2026-12151" type="cve" title="CVE-2026-12151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42338" id="CVE-2026-42338" type="cve" title="CVE-2026-42338" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48615" id="CVE-2026-48615" type="cve" title="CVE-2026-48615" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48618" id="CVE-2026-48618" type="cve" title="CVE-2026-48618" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48619" id="CVE-2026-48619" type="cve" title="CVE-2026-48619" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48928" id="CVE-2026-48928" type="cve" title="CVE-2026-48928" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48930" id="CVE-2026-48930" type="cve" title="CVE-2026-48930" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48933" id="CVE-2026-48933" type="cve" title="CVE-2026-48933" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48934" id="CVE-2026-48934" type="cve" title="CVE-2026-48934" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48935" id="CVE-2026-48935" type="cve" title="CVE-2026-48935" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-6733" id="CVE-2026-6733" type="cve" title="CVE-2026-6733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9678" id="CVE-2026-9678" type="cve" title="CVE-2026-9678" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490006" id="2490006" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476810" id="2476810" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490008" id="2490008" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493333" id="2493333" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493329" id="2493329" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493335" id="2493335" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493331" id="2493331" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489980" id="2489980" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493332" id="2493332" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2490000" id="2490000" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493326" id="2493326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493325" id="2493325" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493337" id="2493337" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35842" id="RLSA-2026:35842" type="self" title="RLSA-2026:35842" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nodejs-full-i18n" arch="aarch64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-full-i18n-22.23.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">80c7c9e50cf170ab904bfdda58980963bfd461949059b0bebaf40d403fb76275</sum>
        </package>
        <package name="nodejs-devel" arch="aarch64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-devel-22.23.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2be9a6023b8b459a1ad6285aee06d99561c866bcbb0c5f10b459ab69d8f054c6</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-docs-22.23.1-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">c445b134107495680afbb7148ce62f7d861da464bd69956a01343b69425db4a9</sum>
        </package>
        <package name="nodejs-libs" arch="aarch64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-libs-22.23.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7fa2a6006c8c562679d4cd1990460818ef3a602f7b815c9b08120d5e3c56f1ba</sum>
        </package>
        <package name="nodejs" arch="aarch64" epoch="1" version="22.23.1" release="2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-22.23.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4df455379d5605efe4c543160c2d09c2ed9e1d907992e664f6820649664de037</sum>
        </package>
        <package name="nodejs-npm" arch="aarch64" epoch="1" version="10.9.8" release="1.22.23.1.2.el10_2" src="nodejs22-22.23.1-2.el10_2.src.rpm">
          <filename>nodejs-npm-10.9.8-1.22.23.1.2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">44bdf9d050bd5c56ecb88a5c264d2483dd487c8176d424803f8f7dfe261b9dfc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36193</id>
    <title>Important: python3.14-pip security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14-pip.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite (CVE-2026-8643)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8643" id="CVE-2026-8643" type="cve" title="CVE-2026-8643" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460927" id="2460927" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36193" id="RLSA-2026:36193" type="self" title="RLSA-2026:36193" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3.14-pip" arch="noarch" epoch="0" version="25.2" release="3.el10_2.5" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">b2b879c8b24e449d465a83b2f005527bd01bac2235ac1438fd0e566aed2d8fe2</sum>
        </package>
        <package name="python3.14-pip-wheel" arch="noarch" epoch="0" version="25.2" release="3.el10_2.5" src="python3.14-pip-25.2-3.el10_2.5.src.rpm">
          <filename>python3.14-pip-wheel-25.2-3.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">bd3a925a4d2a54231e5d77058cfafc3a928fc3dfb986677755e5746d7f09f5b8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36196</id>
    <title>Important: 389-ds-base security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for 389-ds-base.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>389 Directory Server is an LDAP version 3 (LDAPv3) compliant server. The base packages include the Lightweight Directory Access Protocol (LDAP) server and command-line utilities for server administration.

Security Fix(es):

* 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610)

* 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow (CVE-2026-11774)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11610" id="CVE-2026-11610" type="cve" title="CVE-2026-11610" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-11774" id="CVE-2026-11774" type="cve" title="CVE-2026-11774" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484414" id="2484414" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484916" id="2484916" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36196" id="RLSA-2026:36196" type="self" title="RLSA-2026:36196" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-lib389" arch="noarch" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>python3-lib389-3.2.0-8.el10_2.noarch.rpm</filename>
          <sum type="sha256">15aaf000a8cda875daca68b969d0e2b54147ff2d82b49bfca1132402283db902</sum>
        </package>
        <package name="389-ds-base-snmp" arch="aarch64" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-snmp-3.2.0-8.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c89d4baa0bc92b78b7dba833b64762d8690a0e07a086d34b79c2476bbdd6c08f</sum>
        </package>
        <package name="389-ds-base-libs" arch="aarch64" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-libs-3.2.0-8.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7a62253c638b3b22096132c4179d6720dca180186acd519538e7454c97a0d697</sum>
        </package>
        <package name="389-ds-base" arch="aarch64" epoch="0" version="3.2.0" release="8.el10_2" src="389-ds-base-3.2.0-8.el10_2.src.rpm">
          <filename>389-ds-base-3.2.0-8.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cb1f4d30fb98b64c758c3842aacc09e0e8fe879599eb1e59ce3408b0e5e74857</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36199</id>
    <title>Important: buildah security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829" id="CVE-2026-39829" type="cve" title="CVE-2026-39829" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830" id="CVE-2026-39830" type="cve" title="CVE-2026-39830" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" id="CVE-2026-39832" type="cve" title="CVE-2026-39832" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" id="CVE-2026-39835" type="cve" title="CVE-2026-39835" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480684" id="2480684" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480681" id="2480681" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480685" id="2480685" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480680" id="2480680" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36199" id="RLSA-2026:36199" type="self" title="RLSA-2026:36199" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.43.1" release="3.el10_2" src="buildah-1.43.1-3.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-3.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f2ae89ed4cd1512c16495b049d90c8446b02152437de7a60d4173736b5b1c0e9</sum>
        </package>
        <package name="buildah" arch="aarch64" epoch="2" version="1.43.1" release="3.el10_2" src="buildah-1.43.1-3.el10_2.src.rpm">
          <filename>buildah-1.43.1-3.el10_2.aarch64.rpm</filename>
          <sum type="sha256">06ef72f5e0b4a5c70b3ca850fc31a51f89fcdd8f42c9d89f036f6c2b4cb7e257</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36203</id>
    <title>Important: freerdp security update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface (CVE-2026-40033)

* freerdp: FreeRDP: Arbitrary code execution or denial of service via heap use-after-free in RDPEAR NDR parser (CVE-2026-44422)

* freerdp: FreeRDP: Out-of-bounds write in planar bitmap decoder allows arbitrary code execution (CVE-2026-45700)

* freerdp: FreeRDP: Arbitrary code execution via crafted RDPGFX PDUs (CVE-2026-44421)

* freerdp: FreeRDP: Arbitrary code execution and denial of service via heap-buffer-overflow (CVE-2026-44420)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-40033" id="CVE-2026-40033" type="cve" title="CVE-2026-40033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44420" id="CVE-2026-44420" type="cve" title="CVE-2026-44420" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44421" id="CVE-2026-44421" type="cve" title="CVE-2026-44421" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44422" id="CVE-2026-44422" type="cve" title="CVE-2026-44422" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-45700" id="CVE-2026-45700" type="cve" title="CVE-2026-45700" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483470" id="2483470" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483480" id="2483480" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2481473" id="2481473" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483471" id="2483471" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2483467" id="2483467" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36203" id="RLSA-2026:36203" type="self" title="RLSA-2026:36203" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="12.el10_2.6" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>libwinpr-3.10.3-12.el10_2.6.aarch64.rpm</filename>
          <sum type="sha256">09967ded23ed53f2e86915a2ceddabcc3470aa7f4d1a9bc7a7b6f79140cf99e7</sum>
        </package>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="12.el10_2.6" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-3.10.3-12.el10_2.6.aarch64.rpm</filename>
          <sum type="sha256">4664f555945a50dcbcf189ccfb268ce3a5791691cec4b8a9b1763978fa055ef7</sum>
        </package>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="12.el10_2.6" src="freerdp-3.10.3-12.el10_2.6.src.rpm">
          <filename>freerdp-libs-3.10.3-12.el10_2.6.aarch64.rpm</filename>
          <sum type="sha256">28714b7d42f4f191aff11317787ae1eec4c0b79d31321f6f03021dd4b9dd8750</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36364</id>
    <title>Important: nginx security, bug fix, and enhancement update</title>
    <issued date="2026-07-08 12:06:21" />
    <updated date="2026-07-22 12:07:42" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nginx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. 

Security Fix(es):

* nginx: NGINX: Arbitrary code execution or Denial of Service via heap-based buffer overflow with crafted HTTP/2 headers (CVE-2026-42055)

Bug Fix(es) and Enhancement(s):

* "HTTP/2 bomb" nginx fix breaks module ABI causing crashes [rhel-10.2.z] (JIRA:Rocky Linux-191778)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42055" id="CVE-2026-42055" type="cve" title="CVE-2026-42055" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2489866" id="2489866" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36364" id="RLSA-2026:36364" type="self" title="RLSA-2026:36364" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nginx-mod-http-perl" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-perl-1.26.3-6.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">ed3528d862fdfa925b185ed14df571f04be3b2ea899fd2873fa203d41e124373</sum>
        </package>
        <package name="nginx-filesystem" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-filesystem-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">70869b22331eda13a826332976a1f254157838aa68f5c3d65e328473d84f0983</sum>
        </package>
        <package name="nginx" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-1.26.3-6.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">aab5805daa7c7dbbf64b311aa8b520d180fdc4e0211709ef94702968f4af2f1f</sum>
        </package>
        <package name="nginx-mod-mail" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-mail-1.26.3-6.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">6d7fa043f73a7eb5bca209dabd4c68a60ade2933dbf211ca3b00ed363003ebb8</sum>
        </package>
        <package name="nginx-all-modules" arch="noarch" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-all-modules-1.26.3-6.el10_2.5.noarch.rpm</filename>
          <sum type="sha256">36e7dca9092cc1c4977087120cf2640ba586f28101ff094d0528d22792f289f5</sum>
        </package>
        <package name="nginx-core" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-core-1.26.3-6.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">adaad5cbb8541ce2cf273480decd14aecb4d2b4db24d589f08e4cdb46b9258e2</sum>
        </package>
        <package name="nginx-mod-http-image-filter" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-image-filter-1.26.3-6.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">96b6726c5cb4070760964ea50544dd4d1f8fe4148767aa63df7b6a467698fac6</sum>
        </package>
        <package name="nginx-mod-stream" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-stream-1.26.3-6.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">b1159b8c62c2fd318f00f2f3945b357a3a646cad1e8ae73fceee92e1d53b2aae</sum>
        </package>
        <package name="nginx-mod-http-xslt-filter" arch="aarch64" epoch="2" version="1.26.3" release="6.el10_2.5" src="nginx-1.26.3-6.el10_2.5.src.rpm">
          <filename>nginx-mod-http-xslt-filter-1.26.3-6.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">f2ff1e947fbbadd0b1e554d915800e1701994ff17c226c5ffd3d450fc85eeec9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:33731</id>
    <title>Moderate: rrdtool security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for rrdtool.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The round robin database (RRD) system stores and displays time-series data, such as network bandwidth, machine-room temperature, and server load average. RRDtool is a high performance data logging and graphing utility, which can be easily integrated with shell scripts, or used to create applications using its Perl, Python, Ruby, Lua, Tcl, and PHP bindings. The data is stored in a compact manner that does not expand over time, and RRDtool provides the user with useful graphs by processing the data to enforce a certain data density.

Security Fix(es):

* rrdtool: Stack buffer overflow in rrdcached handle_request_create() allows local privilege escalation via unbounded DS/RRA arguments (CVE-2026-43958)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43958" id="CVE-2026-43958" type="cve" title="CVE-2026-43958" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2460932" id="2460932" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:33731" id="RLSA-2026:33731" type="self" title="RLSA-2026:33731" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="rrdtool" arch="aarch64" epoch="0" version="1.8.0" release="21.el10_2" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-1.8.0-21.el10_2.aarch64.rpm</filename>
          <sum type="sha256">83aa4291bfecef4a04678eb50ab7397626886167ae553505a9772c975958bfb9</sum>
        </package>
        <package name="rrdtool-perl" arch="aarch64" epoch="0" version="1.8.0" release="21.el10_2" src="rrdtool-1.8.0-21.el10_2.src.rpm">
          <filename>rrdtool-perl-1.8.0-21.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c5c26afea70213c16ac46a851788bfb7ffa84a65156e12137b2d1bc3c752f2a6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:34109</id>
    <title>Important: httpd security, bug fix, and enhancement update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:31" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: incomplete fix for CVE-2023-38709 (CVE-2024-42516)

* httpd: NULL pointer dereference via specially crafted request (CVE-2026-29169)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356)

* httpd: Apache HTTP Server: Buffer Over-read via outbound OCSP requests to attacker-controlled server (CVE-2026-44185)

* httpd: Apache HTTP Server: Denial of Service via crafted regular expressions (CVE-2026-44631)

* httpd: Apache HTTP Server: Heap-based Buffer Overflow via untrusted content in mod_xml2enc (CVE-2026-42536)

* httpd: Apache HTTP Server: Buffer overflow in mod_proxy_html allows security bypass (CVE-2026-34355)

Bug Fix(es) and Enhancement(s):

* address Moderate severity issues from httpd 2.4.68 [rhel-10.2.z] (JIRA:Rocky Linux-184518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-42516" id="CVE-2024-42516" type="cve" title="CVE-2024-42516" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24072" id="CVE-2026-24072" type="cve" title="CVE-2026-24072" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29169" id="CVE-2026-29169" type="cve" title="CVE-2026-29169" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33006" id="CVE-2026-33006" type="cve" title="CVE-2026-33006" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34355" id="CVE-2026-34355" type="cve" title="CVE-2026-34355" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34356" id="CVE-2026-34356" type="cve" title="CVE-2026-34356" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42535" id="CVE-2026-42535" type="cve" title="CVE-2026-42535" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42536" id="CVE-2026-42536" type="cve" title="CVE-2026-42536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43951" id="CVE-2026-43951" type="cve" title="CVE-2026-43951" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44119" id="CVE-2026-44119" type="cve" title="CVE-2026-44119" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44185" id="CVE-2026-44185" type="cve" title="CVE-2026-44185" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44186" id="CVE-2026-44186" type="cve" title="CVE-2026-44186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-44631" id="CVE-2026-44631" type="cve" title="CVE-2026-44631" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486411" id="2486411" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486397" id="2486397" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374549" id="2374549" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486399" id="2486399" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486395" id="2486395" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2465296" id="2465296" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486414" id="2486414" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486415" id="2486415" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2465293" id="2465293" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486416" id="2486416" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486402" id="2486402" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486406" id="2486406" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2464941" id="2464941" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:34109" id="RLSA-2026:34109" type="self" title="RLSA-2026:34109" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_ssl" arch="aarch64" epoch="1" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_ssl-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">d5b6cad78f218c4752bbe625ef77981fbb5bf106072fb76f94335e3517426b14</sum>
        </package>
        <package name="mod_lua" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_lua-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">80e7ef038cd5f278c36c3c15362f2182ab8bab82f5ed60470945b5211c6f3667</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-filesystem-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">ca2e34bd838cbcae62e3b8016d136f176d7139be57372b5ec6893ef5f777b8cf</sum>
        </package>
        <package name="mod_proxy_html" arch="aarch64" epoch="1" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_proxy_html-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">bddb98d928d9efcdf9b636bbe4e218c9bf1c457af19f0c673655d32f8f42f9d2</sum>
        </package>
        <package name="httpd-tools" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-tools-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">fd8ce3c0b32f3d9407b3a2c881b458a042dba6edef4be90573771e63112d7e58</sum>
        </package>
        <package name="mod_session" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_session-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">93dd1ea90340d1640de26371b0ca302adb51ed40ef4e6f11d0669155452b42bb</sum>
        </package>
        <package name="httpd-devel" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-devel-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">dd04a81ecdbfbcfe216c8d575063d8ff26f3cf20bd69873ed18d703df15ccd18</sum>
        </package>
        <package name="httpd-core" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-core-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">ea4bce77b85a9589bbbe2a4d9a7d19a99354d96ab6c4361a8330c3efdd1e3364</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-manual-2.4.63-13.el10_2.4.noarch.rpm</filename>
          <sum type="sha256">49f415b3e7032f430319a8047f39e8d1477ba790df8d02b6035044a82e9eae2a</sum>
        </package>
        <package name="httpd" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>httpd-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">071d1eb87df0769ea6b344523faba35eac42c20bbc6c490c21a8feb44f90909f</sum>
        </package>
        <package name="mod_ldap" arch="aarch64" epoch="0" version="2.4.63" release="13.el10_2.4" src="httpd-2.4.63-13.el10_2.4.src.rpm">
          <filename>mod_ldap-2.4.63-13.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">8dc62b5ce641066c4f4d8745d638c05b276a7fcee84c87e8c823a38c2411115b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:34355</id>
    <title>Moderate: mod_http2 security, bug fix, and enhancement update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: mod_http2: Apache HTTP Server mod_http2: Use After Free vulnerability allows arbitrary code execution or denial of service. (CVE-2026-48913)

* httpd: Apache HTTP Server: Out-of-bounds Read in mod_headers and mod_mime (CVE-2026-43951)

Bug Fix(es) and Enhancement(s):

* address CVE-2026-43951 and CVE-2026-48913 in mod_http2 (JIRA:Rocky Linux-188008)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-43951" id="CVE-2026-43951" type="cve" title="CVE-2026-43951" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-48913" id="CVE-2026-48913" type="cve" title="CVE-2026-48913" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486415" id="2486415" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486405" id="2486405" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:34355" id="RLSA-2026:34355" type="self" title="RLSA-2026:34355" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_http2" arch="aarch64" epoch="0" version="2.0.29" release="4.el10_2.2" src="mod_http2-2.0.29-4.el10_2.2.src.rpm">
          <filename>mod_http2-2.0.29-4.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">1af68b87840dd0e401895f3b3d9becfa5c2fc7277eec0227ec17f8eb3c422bc6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:34357</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* github.com/prometheus/prometheus: Prometheus: Denial of Service via uncontrolled memory allocation in remote read endpoint (CVE-2026-42154)

* github.com/prometheus/prometheus: Prometheus: Information disclosure of Azure OAuth client secret via config API (CVE-2026-42151)

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" id="CVE-2026-25681" type="cve" title="CVE-2026-25681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42151" id="CVE-2026-42151" type="cve" title="CVE-2026-42151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42154" id="CVE-2026-42154" type="cve" title="CVE-2026-42154" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466507" id="2466507" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2466505" id="2466505" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480761" id="2480761" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484207" id="2484207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467822" id="2467822" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:34357" id="RLSA-2026:34357" type="self" title="RLSA-2026:34357" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="aarch64" epoch="0" version="0.152.1" release="1.el10_2" src="opentelemetry-collector-0.152.1-1.el10_2.src.rpm">
          <filename>opentelemetry-collector-0.152.1-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d6f85650114441e5d0d31a00d99aad5d0db17857545ff0e411c7937f561bc6d6</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35827</id>
    <title>Important: grafana security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" id="CVE-2026-25681" type="cve" title="CVE-2026-25681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480761" id="2480761" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35827" id="RLSA-2026:35827" type="self" title="RLSA-2026:35827" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="27.el10_2" src="grafana-10.2.6-27.el10_2.src.rpm">
          <filename>grafana-10.2.6-27.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c2acba9a1b6df6dedfc43cc7c157d56388df85c90197bba5796b1e2e0c6dd8a5</sum>
        </package>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="27.el10_2" src="grafana-10.2.6-27.el10_2.src.rpm">
          <filename>grafana-selinux-10.2.6-27.el10_2.aarch64.rpm</filename>
          <sum type="sha256">f9e72654f6ee6a8ed929b1c1bec77a9a4e5328b08e11d7783d47d70e18d10985</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35826</id>
    <title>Important: grafana-pcp security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35826" id="RLSA-2026:35826" type="self" title="RLSA-2026:35826" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-pcp" arch="aarch64" epoch="0" version="5.3.0" release="7.el10_2" src="grafana-pcp-5.3.0-7.el10_2.src.rpm">
          <filename>grafana-pcp-5.3.0-7.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b7f4bd497c09741d1057575940c837ba0bb03679ad26bc783974a720b337a1aa</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:35832</id>
    <title>Important: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2026-07-07 12:05:23" />
    <updated date="2026-07-21 12:07:32" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484207" id="2484207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467822" id="2467822" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:35832" id="RLSA-2026:35832" type="self" title="RLSA-2026:35832" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipp-usb" arch="aarch64" epoch="0" version="0.9.27" release="7.el10_2.2" src="golang-github-openprinting-ipp-usb-0.9.27-7.el10_2.2.src.rpm">
          <filename>ipp-usb-0.9.27-7.el10_2.2.aarch64.rpm</filename>
          <sum type="sha256">301da3f431d5089795685090a9c6bb1102cc5f6bf3e9fe3ba3893d5a4081c1d8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36782</id>
    <title>Moderate: aardvark-dns security update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for aardvark-dns.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Authoritative DNS server for A/AAAA container records  Forwards other request to configured resolvers. Read more about configuration in `src/backend/mod.rs`.

Security Fix(es):

* aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset (CVE-2026-35406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-35406" id="CVE-2026-35406" type="cve" title="CVE-2026-35406" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456280" id="2456280" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36782" id="RLSA-2026:36782" type="self" title="RLSA-2026:36782" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aardvark-dns" arch="aarch64" epoch="2" version="1.17.1" release="1.el10_2" src="aardvark-dns-1.17.1-1.el10_2.src.rpm">
          <filename>aardvark-dns-1.17.1-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">21e56750c4e228f8b75940e5fc1309d791c740c6e0305d49e9d3ef4ad4c21b14</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36790</id>
    <title>Important: tomcat9 security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)

* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:Rocky Linux-185571)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-66614" id="CVE-2025-66614" type="cve" title="CVE-2025-66614" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24733" id="CVE-2026-24733" type="cve" title="CVE-2026-24733" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24734" id="CVE-2026-24734" type="cve" title="CVE-2026-24734" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-24880" id="CVE-2026-24880" type="cve" title="CVE-2026-24880" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25854" id="CVE-2026-25854" type="cve" title="CVE-2026-25854" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29129" id="CVE-2026-29129" type="cve" title="CVE-2026-29129" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29145" id="CVE-2026-29145" type="cve" title="CVE-2026-29145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-32990" id="CVE-2026-32990" type="cve" title="CVE-2026-32990" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34483" id="CVE-2026-34483" type="cve" title="CVE-2026-34483" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34487" id="CVE-2026-34487" type="cve" title="CVE-2026-34487" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34500" id="CVE-2026-34500" type="cve" title="CVE-2026-34500" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457027" id="2457027" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457020" id="2457020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457031" id="2457031" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457040" id="2457040" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440430" id="2440430" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457043" id="2457043" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440426" id="2440426" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2440437" id="2440437" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457044" id="2457044" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457037" id="2457037" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457039" id="2457039" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457038" id="2457038" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457025" id="2457025" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36790" id="RLSA-2026:36790" type="self" title="RLSA-2026:36790" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-lib-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">683c5f85d2401482be297ea03195ee45106bc824cf2ecdb70650d20809e383cb</sum>
        </package>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">b15a4252e5c69c99bec43dfd3f607523e8d140c99a56718d76cd82551d8e78af</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">3d159c1ddd402e454d198b78d94122046c5295b7ff47d60dd12542f6880fa3b4</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">9e0c9011b4b9a50633335f9000fd7ca843ae7cdb187bd2c4ae85b295c330562b</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-webapps-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">48d9de76a1fbddb304aee31188eefcaae80c0363969dde185406df2d66103196</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">d88b46c29b1fbd0c4f6cfdc98ea9d2ace20db8dc2de0267346367fee143643cb</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">842f5604ed8323cc3351ea6a2d582f09894371f740bad67a74c50ca2ce205be5</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.117" release="2.el10_2" src="tomcat9-9.0.117-2.el10_2.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.117-2.el10_2.noarch.rpm</filename>
          <sum type="sha256">c5003a87d029c2a076e15eb946fc14f7431c50a137b1059669f7a7d5d6de0644</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36788</id>
    <title>Important: tomcat security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)

* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)

Bug Fix(es) and Enhancement(s):

* Remove tomcat clustering JAR from RPM builds (JIRA:Rocky Linux-168577)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-29146" id="CVE-2026-29146" type="cve" title="CVE-2026-29146" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-34486" id="CVE-2026-34486" type="cve" title="CVE-2026-34486" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457027" id="2457027" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2457020" id="2457020" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36788" id="RLSA-2026:36788" type="self" title="RLSA-2026:36788" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-docs-webapp-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">f77bac79a8487880b7aa20bee573515bc76854c724122045bbfdb91574de28b8</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">4c6f0fa1c5836a6f219f49ea6ee662f10530cb93482dc3cbddc6a6933be57fe9</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-admin-webapps-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">538ce92952c00d4e49ec935dcf908eb291638a9bcefe9104e9822e317a96763f</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-webapps-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">08bdf6df703c7c98b8d870e3273ada67e39643c0c940001df1beecaa305511fc</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">6fbf7894259828065b77f5016dbf0d892bc953d0aba0c39b6b9e6be69b1b776c</sum>
        </package>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">c1ea0f315e45dfb7eb39f51ab66fa4f02c72d3213187b9c209c943ce60bffb58</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">a470bd4f75c4bf1ef7dd98afbfd7dd852165111d29282c8aef2417c6621412a3</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.49" release="3.el10_2" src="tomcat-10.1.49-3.el10_2.src.rpm">
          <filename>tomcat-lib-10.1.49-3.el10_2.noarch.rpm</filename>
          <sum type="sha256">8a7ebad976679a90775eaf497779d3f0a07ea5b9125118ccfe045b925ceb8e7d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:37072</id>
    <title>Important: podman security, bug fix, and enhancement update</title>
    <issued date="2026-07-10 12:05:34" />
    <updated date="2026-07-24 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)

* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)

* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)

* golang.org/x/crypto/ssh/knownhosts: golang: golang.org/x/crypto/ssh/knownhosts: Revocation bypass via unchecked SignatureKey (CVE-2026-42508)

* golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass (CVE-2026-27136)

* golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting (CVE-2026-25681)

* podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231)

Bug Fix(es) and Enhancement(s):

* podman does not clean up all files and leaves orphaned files consuming disk space [rhel-10.2.z] (JIRA:Rocky Linux-173842)

* [FJ10.2 Bug]: [REG]The "podman-remote save" command fails for rootless users. [rhel-10.2.z] (JIRA:Rocky Linux-192440)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-25681" id="CVE-2026-25681" type="cve" title="CVE-2026-25681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27136" id="CVE-2026-27136" type="cve" title="CVE-2026-27136" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39829" id="CVE-2026-39829" type="cve" title="CVE-2026-39829" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39830" id="CVE-2026-39830" type="cve" title="CVE-2026-39830" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39832" id="CVE-2026-39832" type="cve" title="CVE-2026-39832" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39835" id="CVE-2026-39835" type="cve" title="CVE-2026-39835" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42508" id="CVE-2026-42508" type="cve" title="CVE-2026-42508" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57231" id="CVE-2026-57231" type="cve" title="CVE-2026-57231" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480688" id="2480688" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480681" id="2480681" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480680" id="2480680" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480684" id="2480684" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480761" id="2480761" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480685" id="2480685" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2493620" id="2493620" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480757" id="2480757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:37072" id="RLSA-2026:37072" type="self" title="RLSA-2026:37072" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.8.2" release="4.el10_2" src="podman-5.8.2-4.el10_2.src.rpm">
          <filename>podman-remote-5.8.2-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">20cd8cd3031a837987e8aae85922ca35761d74189c636f3e626bd05db74404bd</sum>
        </package>
        <package name="podman" arch="aarch64" epoch="7" version="5.8.2" release="4.el10_2" src="podman-5.8.2-4.el10_2.src.rpm">
          <filename>podman-5.8.2-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b07a75b4041892b744db4038e7b7eed993cb18e466a4afbe553c8fef5826232c</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="4.el10_2" src="podman-5.8.2-4.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-4.el10_2.noarch.rpm</filename>
          <sum type="sha256">1f8f1552aa0fdc7917048d9c874502c74433bdcfb2e78d992981685c0ca3eebe</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:36211</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-07-13 18:04:04" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freeipmi.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.

Security Fix(es):

* freeipmi: FreeIPMI: Denial of service via buffer overflow in ipmi-oem client (CVE-2026-50031)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50031" id="CVE-2026-50031" type="cve" title="CVE-2026-50031" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484296" id="2484296" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:36211" id="RLSA-2026:36211" type="self" title="RLSA-2026:36211" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freeipmi-ipmiseld" arch="aarch64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-ipmiseld-1.6.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">d573ecfd438b9a7f74b457cedbf5411422095d68eb851d663f14f7254fa830c2</sum>
        </package>
        <package name="freeipmi-ipmidetectd" arch="aarch64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-ipmidetectd-1.6.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0e6a5554a1c232ec9313db6f32ba382a27bae505ab86cd4bf39a10a0cd412100</sum>
        </package>
        <package name="freeipmi-bmc-watchdog" arch="aarch64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-bmc-watchdog-1.6.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6a4a233237403812899cd7000151d76c469bf9dce9ad9e231c69786050a5dff3</sum>
        </package>
        <package name="freeipmi" arch="aarch64" epoch="0" version="1.6.18" release="1.el10_2" src="freeipmi-1.6.18-1.el10_2.src.rpm">
          <filename>freeipmi-1.6.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">90e7dfd6ae2289086c5b3bdbde9930ce70dd2f250e4998875e0d2d7388b5beb2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38494</id>
    <title>Important: buildah security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498152" id="2498152" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38494" id="RLSA-2026:38494" type="self" title="RLSA-2026:38494" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.43.1" release="4.el10_2" src="buildah-1.43.1-4.el10_2.src.rpm">
          <filename>buildah-tests-1.43.1-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">831fd9d0c89ef6bd261215478404e15fa713368e779a893e8ea12d919a0d4641</sum>
        </package>
        <package name="buildah" arch="aarch64" epoch="2" version="1.43.1" release="4.el10_2" src="buildah-1.43.1-4.el10_2.src.rpm">
          <filename>buildah-1.43.1-4.el10_2.aarch64.rpm</filename>
          <sum type="sha256">5eb5b8cbbd735eb113d995bb089fa886b31da1865882691cdf3f629dacda5482</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38514</id>
    <title>Important: plexus-utils security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for plexus-utils.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Plexus project seeks to create end-to-end developer tools for writing applications. At the core is the container, which can be embedded or for a full scale application server. There are many reusable components for hibernate, form processing, jndi, i18n, velocity, etc. Plexus also includes an application server which is like a J2EE application server, without all the baggage.

Security Fix(es):

* org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-67030" id="CVE-2025-67030" type="cve" title="CVE-2025-67030" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451409" id="2451409" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38514" id="RLSA-2026:38514" type="self" title="RLSA-2026:38514" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="plexus-utils" arch="noarch" epoch="0" version="3.5.1" release="9.el10_2" src="plexus-utils-3.5.1-9.el10_2.src.rpm">
          <filename>plexus-utils-3.5.1-9.el10_2.noarch.rpm</filename>
          <sum type="sha256">fa709eeedd422e5f53c93c8ec20f4aba5d39caccd81473f43666a4e1c6a47959</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38489</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow (CVE-2026-55999)

* X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent() (CVE-2026-56000)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-55999" id="CVE-2026-55999" type="cve" title="CVE-2026-55999" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56000" id="CVE-2026-56000" type="cve" title="CVE-2026-56000" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2496193" id="2496193" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2496165" id="2496165" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38489" id="RLSA-2026:38489" type="self" title="RLSA-2026:38489" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="aarch64" epoch="0" version="24.1.9" release="4.el10_2.3" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.9-4.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">9688c8b85ecc2f1548f252f9933cb1db7b0a6bdbe01b40e058e883dfccf0b733</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38513</id>
    <title>Important: perl-DBI security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-DBI.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>DBI is a database access Application Programming Interface (API) for the Perl Language. The DBI API Specification defines a set of functions, variables and conventions that provide a consistent database interface independent of the actual database being used.

Security Fix(es):

* DBI: DBI: Buffer overflow in error handling can lead to arbitrary code execution (CVE-2026-9698)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10879" id="CVE-2026-10879" type="cve" title="CVE-2026-10879" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-9698" id="CVE-2026-9698" type="cve" title="CVE-2026-9698" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2486734" id="2486734" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485464" id="2485464" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38513" id="RLSA-2026:38513" type="self" title="RLSA-2026:38513" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl-DBI" arch="aarch64" epoch="0" version="1.643" release="26.el10_2.1" src="perl-DBI-1.643-26.el10_2.1.src.rpm">
          <filename>perl-DBI-1.643-26.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">fb48a37f7dd3b2a5fc32c12902c8318752ce4023f0da9bd5fd6a45e42de58ef1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38495</id>
    <title>Important: podman security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* os: golang: Go os.Root: Symlink following vulnerability allows directory traversal (CVE-2026-39822)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39822" id="CVE-2026-39822" type="cve" title="CVE-2026-39822" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498152" id="2498152" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38495" id="RLSA-2026:38495" type="self" title="RLSA-2026:38495" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman-docker" arch="noarch" epoch="7" version="5.8.2" release="5.el10_2" src="podman-5.8.2-5.el10_2.src.rpm">
          <filename>podman-docker-5.8.2-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">8c6b2c85bbf2245bb41c018a03a2314b20e98e4afc950ac71a86f9349424435b</sum>
        </package>
        <package name="podman" arch="aarch64" epoch="7" version="5.8.2" release="5.el10_2" src="podman-5.8.2-5.el10_2.src.rpm">
          <filename>podman-5.8.2-5.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9e8275d35f465a110964ba09e7c00f55240e8de9ed55470aba14f0b8b941837e</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="7" version="5.8.2" release="5.el10_2" src="podman-5.8.2-5.el10_2.src.rpm">
          <filename>podman-remote-5.8.2-5.el10_2.aarch64.rpm</filename>
          <sum type="sha256">b519c0a78962796890731df56df7d206e2e8fb2d505b8386d0be25f49785dfda</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:38499</id>
    <title>Important: openexr security update</title>
    <issued date="2026-07-14 12:05:31" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openexr.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format.  This package containes the binaries for OpenEXR.

Security Fix(es):

* OpenEXR: OpenEXR: Arbitrary code execution via integer overflow in image resizing (CVE-2026-41142)

* OpenEXR: OpenEXR: Information disclosure and denial of service via malformed EXR files (CVE-2026-42216)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-41142" id="CVE-2026-41142" type="cve" title="CVE-2026-41142" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42216" id="CVE-2026-42216" type="cve" title="CVE-2026-42216" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467633" id="2467633" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467623" id="2467623" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:38499" id="RLSA-2026:38499" type="self" title="RLSA-2026:38499" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="openexr" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_2.3" src="openexr-3.1.10-8.el10_2.3.src.rpm">
          <filename>openexr-3.1.10-8.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">387256a762e9ce8c167b785335713eaf19c35e78a598b06a3ea3d33dbe4b232b</sum>
        </package>
        <package name="openexr-libs" arch="aarch64" epoch="0" version="3.1.10" release="8.el10_2.3" src="openexr-3.1.10-8.el10_2.3.src.rpm">
          <filename>openexr-libs-3.1.10-8.el10_2.3.aarch64.rpm</filename>
          <sum type="sha256">4ae94281c583939d280ff8528c14c0d67c88ada98d673672adb7d1cc76e7ae31</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:39272</id>
    <title>Important: git-lfs security update</title>
    <issued date="2026-07-15 12:06:01" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467822" id="2467822" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:39272" id="RLSA-2026:39272" type="self" title="RLSA-2026:39272" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git-lfs" arch="aarch64" epoch="0" version="3.7.1" release="5.el10_2.6" src="git-lfs-3.7.1-5.el10_2.6.src.rpm">
          <filename>git-lfs-3.7.1-5.el10_2.6.aarch64.rpm</filename>
          <sum type="sha256">bd419420bae1bea7bfd9bb1e42cc5a86fef99a598ee3ffde2b76823da12cbb60</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:39297</id>
    <title>Moderate: edk2 security, bug fix, and enhancement update</title>
    <issued date="2026-07-15 12:06:01" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for edk2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM. 

Security Fix(es):

* openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key (CVE-2026-31790)

* openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing (CVE-2026-28390)

Bug Fix(es) and Enhancement(s):

* edk2/x64: re-enable legacy kernel loader [rhel-10.2.z] (JIRA:Rocky Linux-182421)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-28390" id="CVE-2026-28390" type="cve" title="CVE-2026-28390" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-31790" id="CVE-2026-31790" type="cve" title="CVE-2026-31790" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2456314" id="2456314" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2451094" id="2451094" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:39297" id="RLSA-2026:39297" type="self" title="RLSA-2026:39297" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="edk2-aarch64" arch="noarch" epoch="0" version="20251114" release="5.el10_2.2" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">265b732f29dbac4df05f7afbbb5a8b243b281aa90ec4212373389276610eb1e3</sum>
        </package>
        <package name="edk2-ovmf" arch="noarch" epoch="0" version="20251114" release="5.el10_2.2" src="edk2-20251114-5.el10_2.2.src.rpm">
          <filename>edk2-ovmf-20251114-5.el10_2.2.noarch.rpm</filename>
          <sum type="sha256">4bb2cda1a65acef0c9aba7c15f779b0fd8a63cc370fad8029236ea1b4ae09997</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:39296</id>
    <title>Moderate: libinput security update</title>
    <issued date="2026-07-15 12:06:01" />
    <updated date="2026-07-27 06:07:59" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libinput.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libinput is a library that handles input devices for display servers and other applications that need to directly deal with input devices.

Security Fix(es):

* libinput: local privilege escalation via crafted uinput devices (CVE-2026-50292)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50292" id="CVE-2026-50292" type="cve" title="CVE-2026-50292" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2485390" id="2485390" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:39296" id="RLSA-2026:39296" type="self" title="RLSA-2026:39296" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libinput" arch="aarch64" epoch="0" version="1.30.1" release="2.el10_2" src="libinput-1.30.1-2.el10_2.src.rpm">
          <filename>libinput-1.30.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">2815f168ed014fd2f7685810331a144c3e09efe540b77a9681c0f6d90164e536</sum>
        </package>
        <package name="libinput-utils" arch="aarch64" epoch="0" version="1.30.1" release="2.el10_2" src="libinput-1.30.1-2.el10_2.src.rpm">
          <filename>libinput-utils-1.30.1-2.el10_2.aarch64.rpm</filename>
          <sum type="sha256">4ae575c3f049dc2d62de49379b1e44ed9590b5eda49c73021c38e53e3b5ba0ae</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:39573</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-07-15 12:06:01" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)

* golang.org/x/net/idna: golang: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)

* crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-27145" id="CVE-2026-27145" type="cve" title="CVE-2026-27145" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-33811" id="CVE-2026-33811" type="cve" title="CVE-2026-33811" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-39821" id="CVE-2026-39821" type="cve" title="CVE-2026-39821" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2484207" id="2484207" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2480756" id="2480756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2467822" id="2467822" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:39573" id="RLSA-2026:39573" type="self" title="RLSA-2026:39573" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil" arch="aarch64" epoch="0" version="0.4.9.2" release="1.el10_2" src="yggdrasil-0.4.9.2-1.el10_2.src.rpm">
          <filename>yggdrasil-0.4.9.2-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">62caf63a0a5a757db806659c1b6571ca0fca8ecb07d8ccf3e87100fa9a92dce9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:39547</id>
    <title>Important: perl-XML-LibXML security update</title>
    <issued date="2026-07-15 18:05:36" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-XML-LibXML.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>This module implements a Perl interface to the GNOME libxml2 library which provides interfaces for parsing and manipulating XML files. This module allows Perl programmers to make use of the highly capable validating XML parser and the high performance DOM implementation.

Security Fix(es):

* perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names (CVE-2026-8177)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-8177" id="CVE-2026-8177" type="cve" title="CVE-2026-8177" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2468684" id="2468684" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:39547" id="RLSA-2026:39547" type="self" title="RLSA-2026:39547" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl-XML-LibXML" arch="aarch64" epoch="1" version="2.0210" release="4.el10_2.1" src="perl-XML-LibXML-2.0210-4.el10_2.1.src.rpm">
          <filename>perl-XML-LibXML-2.0210-4.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">9e847fba86e2d90fd913bde5407b0b40349ce9ea7ead741e3a21dd0db292dd27</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:39976</id>
    <title>Important: hplip security update</title>
    <issued date="2026-07-16 12:05:50" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for hplip.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals.

Security Fix(es):

* HPLIP: Incomplete Fix for CVE-2026-8631 (CVE-2026-14544)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-14544" id="CVE-2026-14544" type="cve" title="CVE-2026-14544" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2496772" id="2496772" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:39976" id="RLSA-2026:39976" type="self" title="RLSA-2026:39976" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="hplip-libs" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.5" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>hplip-libs-3.23.12-10.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">2035959294ff8156a99181e66d24ab55ef61454d4f075120c7db59468ed7f4a5</sum>
        </package>
        <package name="libsane-hpaio" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.5" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>libsane-hpaio-3.23.12-10.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">31954659fecc453d9310ad0ae8128f7f64cf8a502eb408198941772bfada1989</sum>
        </package>
        <package name="hplip" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.5" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>hplip-3.23.12-10.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">b4ddec5091e1b825f3c16481a5605967bde4fafacd624ea3cccc3a971ed23fc9</sum>
        </package>
        <package name="hplip-common" arch="aarch64" epoch="0" version="3.23.12" release="10.el10_2.5" src="hplip-3.23.12-10.el10_2.5.src.rpm">
          <filename>hplip-common-3.23.12-10.el10_2.5.aarch64.rpm</filename>
          <sum type="sha256">3d3fa3c60373fce959493ca04879f10f29db7e5749e69a413a45792f45561eb8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:40833</id>
    <title>Important: pacemaker security update</title>
    <issued date="2026-07-22 12:05:54" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for pacemaker.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Pacemaker cluster resource manager is a collection of technologies working together to maintain data integrity and application availability in the event of failures. 

Security Fix(es):

* pacemaker: Pacemaker: Denial of Service via integer overflow in remote message decompression (CVE-2026-10649)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-10649" id="CVE-2026-10649" type="cve" title="CVE-2026-10649" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2462817" id="2462817" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:40833" id="RLSA-2026:40833" type="self" title="RLSA-2026:40833" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="pacemaker-schemas" arch="noarch" epoch="0" version="3.0.1" release="5.el10_2.1" src="pacemaker-3.0.1-5.el10_2.1.src.rpm">
          <filename>pacemaker-schemas-3.0.1-5.el10_2.1.noarch.rpm</filename>
          <sum type="sha256">20bf6658c1c546d93b07432255dc86f85ae56ea2377c3e27c8fc34828c087f61</sum>
        </package>
        <package name="pacemaker-libs" arch="aarch64" epoch="0" version="3.0.1" release="5.el10_2.1" src="pacemaker-3.0.1-5.el10_2.1.src.rpm">
          <filename>pacemaker-libs-3.0.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">45fbfdd15030ea884bf9b4be3b51636be15e76ebcf5346ed16a5730f4317ea91</sum>
        </package>
        <package name="pacemaker-cluster-libs" arch="aarch64" epoch="0" version="3.0.1" release="5.el10_2.1" src="pacemaker-3.0.1-5.el10_2.1.src.rpm">
          <filename>pacemaker-cluster-libs-3.0.1-5.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">7db5c91f7e3f0de23e9106ba276388bdaf480424bc3368033348c17801c63285</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:40856</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-07-22 12:05:54" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python3.14.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-15308" id="CVE-2026-15308" type="cve" title="CVE-2026-15308" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2498608" id="2498608" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:40856" id="RLSA-2026:40856" type="self" title="RLSA-2026:40856" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3.14" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2.1" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-3.14.5-1.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">10995285d1a0acfb859f9b905a1c72e8c3df6f9183cea42e40bffb18a96a12a6</sum>
        </package>
        <package name="python3.14-libs" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2.1" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-libs-3.14.5-1.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">456b78bc0d8afda81fe9b6991286cffff42eabf3d333f0ee20cdc5b544e6a438</sum>
        </package>
        <package name="python3.14-devel" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2.1" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-devel-3.14.5-1.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">68054ec441db54a9f9df1e7e20f08fc4ee206bff5294844793279093e0fb8524</sum>
        </package>
        <package name="python3.14-tkinter" arch="aarch64" epoch="0" version="3.14.5" release="1.el10_2.1" src="python3.14-3.14.5-1.el10_2.1.src.rpm">
          <filename>python3.14-tkinter-3.14.5-1.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">76f091e449be265ca71ac1e45a010af422082ded0ed5ecd525787953692a7cc3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41892</id>
    <title>Important: libtiff security, bug fix, and enhancement update</title>
    <issued date="2026-07-22 12:05:54" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libtiff.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.

Security Fix(es):

* libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM (CVE-2023-52355)

* libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image (CVE-2026-12912)

Bug Fix(es) and Enhancement(s):

* Reintroduce the `tiffcp -i` option (JIRA:Rocky Linux-185328)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-52355" id="CVE-2023-52355" type="cve" title="CVE-2023-52355" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-12912" id="CVE-2026-12912" type="cve" title="CVE-2026-12912" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2492871" id="2492871" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2251326" id="2251326" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41892" id="RLSA-2026:41892" type="self" title="RLSA-2026:41892" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libtiff" arch="aarch64" epoch="0" version="4.6.0" release="8.el10_2.4" src="libtiff-4.6.0-8.el10_2.4.src.rpm">
          <filename>libtiff-4.6.0-8.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">ce3c74da72c9674f661ab36b894ef64ca34b02b4d65acb28785c6a713dc39368</sum>
        </package>
        <package name="libtiff-devel" arch="aarch64" epoch="0" version="4.6.0" release="8.el10_2.4" src="libtiff-4.6.0-8.el10_2.4.src.rpm">
          <filename>libtiff-devel-4.6.0-8.el10_2.4.aarch64.rpm</filename>
          <sum type="sha256">5f0f3e9892ca309847ae33cdc000a4637a54f4fd066bf5acc045db9d377dafcc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41988</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-07-22 12:05:54" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dovecot.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages. 

Security Fix(es):

* dovecot: Dovecot: Denial of Service via excessive IMAP bracing (CVE-2026-42006)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42006" id="CVE-2026-42006" type="cve" title="CVE-2026-42006" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2476476" id="2476476" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41988" id="RLSA-2026:41988" type="self" title="RLSA-2026:41988" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dovecot-mysql" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2.1" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-mysql-2.3.21-19.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">d1e6bf91347b015f4ffa4aa5421df1565ae95c90a583e0a5ff5d65b8900f297b</sum>
        </package>
        <package name="dovecot-pgsql" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2.1" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-pgsql-2.3.21-19.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">a1a256ad4d45a0916d8453388d89e12ea65ce0aee81c4d68a810b490e3106a57</sum>
        </package>
        <package name="dovecot-pigeonhole" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2.1" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-pigeonhole-2.3.21-19.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">26f282e17f07319651fa37224e225afb6bc2a1a026db9314dc3a4d9bdbb0fee6</sum>
        </package>
        <package name="dovecot" arch="aarch64" epoch="1" version="2.3.21" release="19.el10_2.1" src="dovecot-2.3.21-19.el10_2.1.src.rpm">
          <filename>dovecot-2.3.21-19.el10_2.1.aarch64.rpm</filename>
          <sum type="sha256">7681ac19d58f43bf9d991f04efb696b11f06b51d6cc90f42d1831af9b23490d8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41893</id>
    <title>Important: .NET 8.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.129 and .NET Runtime 8.0.29.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET: Denial of Service due to uncontrolled resource allocation (CVE-2026-50525)

* dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

* dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

* .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

* dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

* Update .NET 8.0 to SDK 8.0.129 and Runtime 8.0.29 [rhel-10.2.z] (JIRA:Rocky Linux-192468)

* dotnet8.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192329)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50525" id="CVE-2026-50525" type="cve" title="CVE-2026-50525" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500509" id="2500509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500565" id="2500565" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500563" id="2500563" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500502" id="2500502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500562" id="2500562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500589" id="2500589" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500587" id="2500587" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500189" id="2500189" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500109" id="2500109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500581" id="2500581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500556" id="2500556" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500593" id="2500593" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500577" id="2500577" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499217" id="2499217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500580" id="2500580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500515" id="2500515" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500492" id="2500492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41893" id="RLSA-2026:41893" type="self" title="RLSA-2026:41893" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">5c444cb0acb3ba7a6f17a0ed39dc32804975b28e4f27d09d961518668267f771</sum>
        </package>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">a1af40c35c286fa17a4d5b50da0c75510613cc958c2ef5d92374083a295d3597</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">3b45a823602e1c43caeb24ba31f1f993180a4c7509e719896ded7fc98106862f</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.129" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.129-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">bbfde7e0273a4d9a76b8334ba2603e6944329e62a9296d25e6c2e12aa49026ec</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e439ea8ffbd2271b11be0f394d58874e89e560203405d3bb022e8f5856b23416</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ab554a9c4f8eb52a80026f71c72fbbf0a319dfeeb7430d14fe5400642f3ed7bd</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">6a24473bf2dcccb0059ee72d78511be915ff08ddb434c5c6c9e36b159cc55104</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">acffabecfba88dcc2e6eb0eb1c34500d06cec44ffb4d85e4870e940f894aa1a7</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.129" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-templates-8.0-8.0.129-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">53f1caf9ff712f323f60d26a468395968b2f410487b6a8f05cf70d10fd611aab</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.129" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.129-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0d9447a185e4c2f44e1859ba21c15e3a98df2f9ceff2f0f14598849814f0aef1</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.29" release="1.el10_2" src="dotnet8.0-8.0.129-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.29-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">17f240da26a934e03b92fb8d8d3c6d20f5bd0e07d62054b120c42d052508aee7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41895</id>
    <title>Important: .NET 9.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.119 and .NET Runtime 9.0.18.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

* dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

* .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

* dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

* Update .NET 9.0 to SDK 9.0.119 and Runtime 9.0.18 [rhel-10.2.z] (JIRA:Rocky Linux-192473)

* dotnet9.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192330)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500509" id="2500509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500565" id="2500565" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500563" id="2500563" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500502" id="2500502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500562" id="2500562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500589" id="2500589" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500587" id="2500587" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500189" id="2500189" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500109" id="2500109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500581" id="2500581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500556" id="2500556" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500593" id="2500593" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500577" id="2500577" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499217" id="2499217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500515" id="2500515" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500492" id="2500492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41895" id="RLSA-2026:41895" type="self" title="RLSA-2026:41895" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9846d80ae531dc3294eb01e6b7d2876d5bcc0e591d501bb7c35ab1ad75c7d409</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e9696761fe6f9580a00e6b8a718cda4c213640f509d3bdec8f99db8317c2176d</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9f46d052fa36ad6a31588437d1e2945dc7f53948538e046f9e8573bd81c8fa1d</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.119-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">fe254ff46c414f49f8ea2ea44b78699b7debb58de97d65ec36c602958bd05972</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">7cefec00755434da0520095979eee8dd91f182137a42b0aeb27d1fa9c792958b</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.119-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0ffe922e7ccec01a300dbd895188a8709d3aa624c4102c0d4427d7da8284544a</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.119-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">c0c065a1af41cad89c6caa6e4908116d89c1d4840a700254c551af5ce34aabc4</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-templates-9.0-9.0.119-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">99a3969655dc3dc792f92354b598c698faf4bd387863288bf98467f89f479884</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cc5aed440e65bca28044b58ce296deeabf6aa8a396f85c352c7b4823d4169e0f</sum>
        </package>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">39c41b789ab45025c57466850b8465739b87eb4a8a81a34e221d4cf0e515c5f4</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">cf93040a0af1ed0c400e8b45f2a47acfbdb47bd2911461d89248f29161b29ab8</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.119" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.119-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e9eb22252fd088684d9182ac9d3954cac8541ded95678f5c76b5bcf4da0d4318</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.18" release="1.el10_2" src="dotnet9.0-9.0.119-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.18-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">ebf5fcc0aa7b7885270fa47f9393fd71ed897f06fd1781a4319230025e4ac466</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:41897</id>
    <title>Important: .NET 10.0 security, bug fix, and enhancement update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet10.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10.

Security Fix(es):

* dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM (CVE-2026-50651)

* dotnet: .NET Core: Denial of Service via type confusion (CVE-2026-57108)

* ASP.NET Core: ASP.NET Core: Denial of Service via uncontrolled resource allocation (CVE-2026-56170)

* ASP.NET Core: ASP.NET Core: Privilege Escalation via Incorrect Authentication Algorithm (CVE-2026-47300)

* ASP.NET Core: ASP.NET Core: Privilege Elevation via Authentication Bypass (CVE-2026-47303)

* dotnet: .NET Security Feature Bypass Vulnerability (CVE-2026-47304)

* dotnet: .NET: Denial of Service vulnerability due to uncontrolled resource allocation (CVE-2026-47302)

* dotnet: .NET Framework: Privilege escalation via code injection (CVE-2026-50650)

* dotnet: .NET: Security feature bypass due to incorrect authorization (CVE-2026-50528)

* dotnet: .NET: Local code execution via deserialization of untrusted data (CVE-2026-50649)

* dotnet: .NET: Local tampering via improper link resolution (CVE-2026-50526)

* dotnet: .NET Framework: Local Code Execution via Protection Mechanism Failure (CVE-2026-50646)

* dotnet: .NET Framework: Denial of Service via network-based buffer overflow (CVE-2026-50527)

* dotnet: .NET Framework: Remote Denial of Service due to uncontrolled resource allocation (CVE-2026-50648)

* .NET: .NET: Network Spoofing Vulnerability (CVE-2026-50659)

* dotnet: .NET Framework: Denial of Service via improper input validation (CVE-2026-50524)

Bug Fix(es) and Enhancement(s):

* Update .NET 10.0 to SDK 10.0.110 and Runtime 10.0.10 [rhel-10.2.z] (JIRA:Rocky Linux-192463)

* dotnet10.0: Reduce time to detect hanging builds during .NET RPM builds (c10s) [rhel-10.2.z] (JIRA:Rocky Linux-192326)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47300" id="CVE-2026-47300" type="cve" title="CVE-2026-47300" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47302" id="CVE-2026-47302" type="cve" title="CVE-2026-47302" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47303" id="CVE-2026-47303" type="cve" title="CVE-2026-47303" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-47304" id="CVE-2026-47304" type="cve" title="CVE-2026-47304" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50524" id="CVE-2026-50524" type="cve" title="CVE-2026-50524" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50526" id="CVE-2026-50526" type="cve" title="CVE-2026-50526" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50527" id="CVE-2026-50527" type="cve" title="CVE-2026-50527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50528" id="CVE-2026-50528" type="cve" title="CVE-2026-50528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50646" id="CVE-2026-50646" type="cve" title="CVE-2026-50646" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50648" id="CVE-2026-50648" type="cve" title="CVE-2026-50648" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50649" id="CVE-2026-50649" type="cve" title="CVE-2026-50649" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50650" id="CVE-2026-50650" type="cve" title="CVE-2026-50650" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50651" id="CVE-2026-50651" type="cve" title="CVE-2026-50651" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-50659" id="CVE-2026-50659" type="cve" title="CVE-2026-50659" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-56170" id="CVE-2026-56170" type="cve" title="CVE-2026-56170" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-57108" id="CVE-2026-57108" type="cve" title="CVE-2026-57108" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500509" id="2500509" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500565" id="2500565" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500563" id="2500563" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500502" id="2500502" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500562" id="2500562" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500589" id="2500589" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500587" id="2500587" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500189" id="2500189" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500109" id="2500109" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500581" id="2500581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500556" id="2500556" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500593" id="2500593" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500577" id="2500577" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2499217" id="2499217" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500515" id="2500515" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2500492" id="2500492" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:41897" id="RLSA-2026:41897" type="self" title="RLSA-2026:41897" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-targeting-pack-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">77610e34724de72daacc55273ec77fdfec269fa168ed708d7179586f2a54b456</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-host-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">725eec221d5df3e8be2e88c043b7f9fdcebac7f64c9b05b4ee5d6d89e34f925d</sum>
        </package>
        <package name="dotnet-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-runtime-dbg-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">985c5e9ac839f60482a7476597d330f1a740653fd61d3f73611f0e62285dfaef</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-dbg-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">3a122be3a1f8ac6e49bf9f5a01f72ab584b976b55f533c9f4eca29a08dc19751</sum>
        </package>
        <package name="dotnet-apphost-pack-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-apphost-pack-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">e0d3eb27987915deb286045e3e9ff612ce7c9661cc4ad7740057d27b9e1aa033</sum>
        </package>
        <package name="dotnet-runtime-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-runtime-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">9aa0c1aacd71d946903b10af3d93424eb04034393ac83812eef0d84ccc49cf0e</sum>
        </package>
        <package name="dotnet-hostfxr-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-hostfxr-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">0ad8e2d17d53d38c3904f07484b6ce84f679ebd99758525e1498f8586aee9f06</sum>
        </package>
        <package name="dotnet-templates-10.0" arch="aarch64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-templates-10.0-10.0.110-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8a640f6888d0aae2389d40fb99e954c8ff743a12ce0f2be0cea6b85d79a124d3</sum>
        </package>
        <package name="aspnetcore-runtime-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>aspnetcore-runtime-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">dfc494d1dc76cb214d5dee34f88b8f4fae731476f21c71ff272c236cd81691dc</sum>
        </package>
        <package name="dotnet-sdk-10.0" arch="aarch64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-10.0-10.0.110-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">908c3e8daa842d0b707e2e887c0378bf3a19a6d3c390c8cc1a7e91e23b4b76bb</sum>
        </package>
        <package name="dotnet-sdk-aot-10.0" arch="aarch64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-aot-10.0-10.0.110-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">935b2459d8e9f35ebaa1caf3445feecd92ca71aa6ffad6876eefe75fbf3d674a</sum>
        </package>
        <package name="dotnet-sdk-dbg-10.0" arch="aarch64" epoch="0" version="10.0.110" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-sdk-dbg-10.0-10.0.110-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">79ddb29eef26dddfa9bcd4e76efbe64d0ab7679e19fb69d89f3649fe3e605cee</sum>
        </package>
        <package name="dotnet-targeting-pack-10.0" arch="aarch64" epoch="0" version="10.0.10" release="1.el10_2" src="dotnet10.0-10.0.110-1.el10_2.src.rpm">
          <filename>dotnet-targeting-pack-10.0-10.0.10-1.el10_2.aarch64.rpm</filename>
          <sum type="sha256">8941b3a799b4314998a350eada91a73f7ec4f4d293d832f2a9d70eea003a1348</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2026:43400</id>
    <title>Important: dogtag-pki security update</title>
    <issued date="2026-07-23 06:07:38" />
    <updated date="2026-07-27 06:08:00" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10.2</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dogtag-pki.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments.  IdM PKI consists of the following components: 
  * Certificate Authority (CA)
  * Key Recovery Authority (KRA)
  * Online Certificate Status Protocol (OCSP) Manager
  * Token Key Service (TKS)
  * Token Processing Service (TPS)
  * Automatic Certificate Management Environment (ACME) Responder
  * Enrollment over Secure Transport (EST) Responder

Security Fix(es):

* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)

* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54512" id="CVE-2026-54512" type="cve" title="CVE-2026-54512" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-54513" id="CVE-2026-54513" type="cve" title="CVE-2026-54513" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2492015" id="2492015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2492010" id="2492010" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2026:43400" id="RLSA-2026:43400" type="self" title="RLSA-2026:43400" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="idm-pki-server" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-server-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">98b781b5ea8bb853d20563d38eb2bfc67e7151462ad61858ee14a6f7eea3368b</sum>
        </package>
        <package name="idm-pki-ca" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-ca-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">8f32674a96a6f47411d51b52a365a4260cb026923f042dfe6cb12c98a01b2a4d</sum>
        </package>
        <package name="idm-pki-base" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-base-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">8e8f843ddc2bfa4ac5bec288a009b178cfc44779ed69cc1db066d9060f497b4f</sum>
        </package>
        <package name="idm-pki-kra" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-kra-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">d45f57cca9aeced7958c36c9c2b9a2ec068fbab0949f59d9607348b15fa849e5</sum>
        </package>
        <package name="idm-pki-tools" arch="aarch64" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-tools-11.9.0-4.el10_2.rocky.0.1.aarch64.rpm</filename>
          <sum type="sha256">e2fd458897232a8404cbdd164261db5c8d85d784ff583132f24121dab6815995</sum>
        </package>
        <package name="python3-idm-pki" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>python3-idm-pki-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">c6d0f5541588fc4603e0b2bbc5fd02f00c4a302f7a0af77ec3846b0d3161ce16</sum>
        </package>
        <package name="idm-pki-acme" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-acme-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">41dc615c14ce67d13c3be27d9c24a7100f843ed26c8fec95ce234fdeb91b31e4</sum>
        </package>
        <package name="idm-pki-java" arch="noarch" epoch="0" version="11.9.0" release="4.el10_2.rocky.0.1" src="dogtag-pki-11.9.0-4.el10_2.rocky.0.1.src.rpm">
          <filename>idm-pki-java-11.9.0-4.el10_2.rocky.0.1.noarch.rpm</filename>
          <sum type="sha256">656c272e766b97cf08111b999807872bbb6e897bf9a83897f73e95355f4bb6f9</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="bugfix" version="2">
    <id>RLBA-2025:5309</id>
    <title>Moderate:mod_proxy_cluster bug fix and enhancement update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:02" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_proxy_cluster.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>For detailed information on changes in this release, see the Rocky Linux 10.0 Release Notes linked from the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10306" id="CVE-2024-10306" type="cve" title="CVE-2024-10306" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2321302" id="2321302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLBA-2025:5309" id="RLBA-2025:5309" type="self" title="RLBA-2025:5309" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_proxy_cluster" arch="aarch64" epoch="0" version="1.3.21" release="1.el10" src="mod_proxy_cluster-1.3.21-1.el10.src.rpm">
          <filename>mod_proxy_cluster-1.3.21-1.el10.aarch64.rpm</filename>
          <sum type="sha256">567e144ffb1debfbf00214e4c7bc8028c85c378a94778d9b2a412f2dd7cd1d9f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7496</id>
    <title>Important: libxslt security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libxslt.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. 

Security Fix(es):

* libxslt: Use-After-Free in libxslt numbers.c (CVE-2025-24855)

* libxslt: Use-After-Free in libxslt (xsltGetInheritedNsList) (CVE-2024-55549)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-55549" id="CVE-2024-55549" type="cve" title="CVE-2024-55549" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24855" id="CVE-2025-24855" type="cve" title="CVE-2025-24855" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352483" id="2352483" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352484" id="2352484" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7496" id="RLSA-2025:7496" type="self" title="RLSA-2025:7496" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libxslt" arch="aarch64" epoch="0" version="1.1.39" release="7.el10_0" src="libxslt-1.1.39-7.el10_0.src.rpm">
          <filename>libxslt-1.1.39-7.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2c2049284e086642a3a5834230af404fb8fc06dea5c6b89ec32bae0eabf659cc</sum>
        </package>
        <package name="libxslt-devel" arch="aarch64" epoch="0" version="1.1.39" release="7.el10_0" src="libxslt-1.1.39-7.el10_0.src.rpm">
          <filename>libxslt-devel-1.1.39-7.el10_0.aarch64.rpm</filename>
          <sum type="sha256">54d3d7ebcd90bbcf6acfb166d9d83e5e9e3c40059650da50751b6b85ccf48364</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7466</id>
    <title>Moderate: delve and golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve, golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* golang: crypto/x509: crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints (CVE-2024-45341)

* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)

* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336" id="CVE-2024-45336" type="cve" title="CVE-2024-45336" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45341" id="CVE-2024-45341" type="cve" title="CVE-2024-45341" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22866" id="CVE-2025-22866" type="cve" title="CVE-2025-22866" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341750" id="2341750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341751" id="2341751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2344219" id="2344219" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7466" id="RLSA-2025:7466" type="self" title="RLSA-2025:7466" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="delve" arch="aarch64" epoch="0" version="1.24.1" release="1.el10_0" src="delve-1.24.1-1.el10_0.src.rpm">
          <filename>delve-1.24.1-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">43b67a30f6a7b5120dbfe0832ed7aded227d8b3c1300aac3f1377975a146d2bf</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-1.23.7-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2ad1768aa859d614e78941007634212262b0c962be17bcfceb9fdde58d3c11d9</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-bin-1.23.7-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2193abfa49e85b02c944761bf58711259cff4bdf52c2a7d6156a21fbf3397c11</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-docs-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">a173b0da2e4752bfec1cf06f363224f6fa16ddba7370e6f2ffb8247587a4bcf4</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-misc-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">7bc05ee75edf98cb9343ef66d21fe35c1c592c61ba91484f778ac863170b4c0f</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-src-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">96f3dbb87940a6cfb09e7cc728c9fa35b1823688d51cdc133a0f9d051890835a</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>golang-tests-1.23.7-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">859c5d5d9e4832afaeaf815e3564bfe80ada878f8e9efec2845d1c0e0cadbe4f</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.23.7" release="1.el10_0" src="golang-1.23.7-1.el10_0.src.rpm">
          <filename>go-toolset-1.23.7-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b46b83129917694dd54178ce8a011b76669e4e46041f27712ce1630fd17c2cfc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7476</id>
    <title>Important: python-jinja2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-jinja2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* jinja2: Jinja sandbox breakout through attr filter selecting format method (CVE-2025-27516)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27516" id="CVE-2025-27516" type="cve" title="CVE-2025-27516" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2350190" id="2350190" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7476" id="RLSA-2025:7476" type="self" title="RLSA-2025:7476" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-jinja2" arch="noarch" epoch="0" version="3.1.6" release="1.el10_0" src="python-jinja2-3.1.6-1.el10_0.src.rpm">
          <filename>python3-jinja2-3.1.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0be3f5f469b49779d362bfeb982bfa4e089c5ba06907aea63c842224e044f287</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7484</id>
    <title>Important: gvisor-tap-vsock security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gvisor-tap-vsock.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22869" id="CVE-2025-22869" type="cve" title="CVE-2025-22869" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348367" id="2348367" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7484" id="RLSA-2025:7484" type="self" title="RLSA-2025:7484" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gvisor-tap-vsock" arch="aarch64" epoch="6" version="0.8.5" release="1.el10_0" src="gvisor-tap-vsock-0.8.5-1.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-0.8.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f59ebe5e29c3b66679c009633b758ad84e1da0b9352c542942bdd364b96a31ce</sum>
        </package>
        <package name="gvisor-tap-vsock-gvforwarder" arch="aarch64" epoch="6" version="0.8.5" release="1.el10_0" src="gvisor-tap-vsock-0.8.5-1.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-gvforwarder-0.8.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">31614db8686d23ca2ae325d444d968929638ae13b9c11619ecd77f72f068fd64</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7500</id>
    <title>Important: perl security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl: Perl 5.34, 5.36, 5.38 and 5.40 are vulnerable to a heap buffer overflow when transliterating non-ASCII bytes (CVE-2024-56406)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56406" id="CVE-2024-56406" type="cve" title="CVE-2024-56406" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359290" id="2359290" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7500" id="RLSA-2025:7500" type="self" title="RLSA-2025:7500" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl" arch="aarch64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-5.40.2-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7dc7c9215a8c55a6d61391778acb503aa984863d66b86e33a9ce1d26041a7b18</sum>
        </package>
        <package name="perl-Attribute-Handlers" arch="noarch" epoch="0" version="1.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Attribute-Handlers-1.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">df82bff8696134f3dc521dd8b8443178771c46142a732b5626990b8c50b7f322</sum>
        </package>
        <package name="perl-AutoLoader" arch="noarch" epoch="0" version="5.74" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-AutoLoader-5.74-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2b4fca6da03e83a1f282dd4752b9f8f01c285fbabd0ff41d03ab8726d63cf223</sum>
        </package>
        <package name="perl-AutoSplit" arch="noarch" epoch="0" version="5.74" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-AutoSplit-5.74-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">47d60990ce13c089eea37d3a61fcd0f19f9cd592c76e7f37c61feabc2dc9b63e</sum>
        </package>
        <package name="perl-autouse" arch="noarch" epoch="0" version="1.11" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-autouse-1.11-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2aed9a5c5c3c64195602f3745dfae8ce3810635d8cffadc3c000cc890ddd103c</sum>
        </package>
        <package name="perl-B" arch="aarch64" epoch="0" version="1.89" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-B-1.89-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a8f027099b0a4879cb28cec6070a9e6122b311eb184a5eb3fc6e89a405c373fc</sum>
        </package>
        <package name="perl-base" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-base-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">64cb01cd07d0b974b1fe31dafc1ee5b2de90cd38f9e6a7885ec3903b83e8f0b4</sum>
        </package>
        <package name="perl-Benchmark" arch="noarch" epoch="0" version="1.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Benchmark-1.25-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">74ac8e111917550e3ae4bdc752e4021ce8d84ac96ea09db372c5902e59db11ae</sum>
        </package>
        <package name="perl-blib" arch="noarch" epoch="0" version="1.07" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-blib-1.07-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9105b51ea0d25e084761b4c0090ac6a7920e6ec963b8205050ef0bd5953b9adf</sum>
        </package>
        <package name="perl-Class-Struct" arch="noarch" epoch="0" version="0.68" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Class-Struct-0.68-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b0a5b9a9669ac59df8d16e5f193cc73e2cf6533f56f865fafc28ef0c9bcbe536</sum>
        </package>
        <package name="perl-Config-Extensions" arch="noarch" epoch="0" version="0.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Config-Extensions-0.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f685d02211fce93b0617d99de4c02719ee94e418aaafa7e907a88e11fd861ec</sum>
        </package>
        <package name="perl-DBM_Filter" arch="noarch" epoch="0" version="0.06" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DBM_Filter-0.06-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f8f99b4dd16050e8554ca0dd65a11c063a26dfdffb224a626ccb3ae0633c5f8</sum>
        </package>
        <package name="perl-debugger" arch="noarch" epoch="0" version="1.60" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-debugger-1.60-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8fc7bfa0a4fe63fd2e0da152b148598355d27c933e2460d2e9cc79050b352a65</sum>
        </package>
        <package name="perl-deprecate" arch="noarch" epoch="0" version="0.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-deprecate-0.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9f0afea047f8b7135faf0867cddc951eb1866c137a2cdc16ed9d99c6498aba75</sum>
        </package>
        <package name="perl-devel" arch="aarch64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-devel-5.40.2-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8fe702260b36c7b6986da648869549792b1927c0a8ecba474a4ad49484de5bd5</sum>
        </package>
        <package name="perl-Devel-Peek" arch="aarch64" epoch="0" version="1.34" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Devel-Peek-1.34-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">97aec9ea064b691452543add3a00ef9b0ab12be34fa2fcbf0d80063c1ca0860b</sum>
        </package>
        <package name="perl-Devel-SelfStubber" arch="noarch" epoch="0" version="1.06" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Devel-SelfStubber-1.06-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c5e20dc46a76c81d39581bec7dba3cd34e8bcbd55d0d1695738030c898c97bed</sum>
        </package>
        <package name="perl-diagnostics" arch="noarch" epoch="0" version="1.40" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-diagnostics-1.40-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9b993ecbf537f9b8cf7fcc2bba8e9237dcbe10fbd1e00fe8b8055b5e3d6a7a8f</sum>
        </package>
        <package name="perl-DirHandle" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DirHandle-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d64e1eccf3366c9be2a3998b26bdb732314caedfede71f45729f2b66e700a3aa</sum>
        </package>
        <package name="perl-doc" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-doc-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ccbbf526615bcc2b8076d26e5b957bd587df1185b8a89f10050c80049edd50fc</sum>
        </package>
        <package name="perl-Dumpvalue" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Dumpvalue-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">cae22391d31b927192b3be47b2727061f4455c0a2102000ae3ccdec554d5e0f6</sum>
        </package>
        <package name="perl-DynaLoader" arch="aarch64" epoch="0" version="1.56" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-DynaLoader-1.56-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">3527fa9847563d5c47af3123e596ea2ce7d15692ba48b4c44cf481627d4c8e22</sum>
        </package>
        <package name="perl-encoding-warnings" arch="noarch" epoch="0" version="0.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-encoding-warnings-0.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1fbd441fd14bde577f07caa18c9a65a54555bbc379fc93216692240e744d8d74</sum>
        </package>
        <package name="perl-English" arch="noarch" epoch="0" version="1.11" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-English-1.11-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b29f221e1a50532d874cd57b0640ccdab73bef336d474dc63b91370b064faa06</sum>
        </package>
        <package name="perl-Errno" arch="aarch64" epoch="0" version="1.38" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Errno-1.38-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">dddaae45a02b9d91a0b493024354ad900a5ab17bd1b866d34977751a90b24579</sum>
        </package>
        <package name="perl-ExtUtils-Constant" arch="noarch" epoch="0" version="0.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Constant-0.25-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">673d5d8970de686dee8373ff9f98ac1c2402e68c83f39265122a76385961bc96</sum>
        </package>
        <package name="perl-ExtUtils-Embed" arch="noarch" epoch="0" version="1.35" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Embed-1.35-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">fdb1db30f202624588f7cbf745a4a6c8fca01afdf97210a5770510e7b9c2ace5</sum>
        </package>
        <package name="perl-ExtUtils-Miniperl" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ExtUtils-Miniperl-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e72582fed4537442ae4e4a003b1dda5d9698598fb496633807bc081f0e9c15b9</sum>
        </package>
        <package name="perl-Fcntl" arch="aarch64" epoch="0" version="1.18" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Fcntl-1.18-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2c7a386e31ac78a114b6618fbccb2ec5246357de4f0859f445250c1ab8943421</sum>
        </package>
        <package name="perl-fields" arch="noarch" epoch="0" version="2.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-fields-2.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">76406839f2803d7b0cb0e251407e0b2a962badf80d05a23875258f25fce023b6</sum>
        </package>
        <package name="perl-File-Basename" arch="noarch" epoch="0" version="2.86" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Basename-2.86-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">18fe7a38257dc997a05f6c6c28982b7eeb3b2f3e5faf691fb96d0e937841428a</sum>
        </package>
        <package name="perl-FileCache" arch="noarch" epoch="0" version="1.10" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FileCache-1.10-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2b487ea17c1aa09778b7dbbd7ac1b47dc6a93b26530fe20371b2bdb51258ad20</sum>
        </package>
        <package name="perl-File-Compare" arch="noarch" epoch="0" version="1.100.800" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Compare-1.100.800-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1881005b6b2bde554c16be1802d9bbcd5a909de38ee51ffec32a02583ddb0382</sum>
        </package>
        <package name="perl-File-Copy" arch="noarch" epoch="0" version="2.41" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Copy-2.41-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">fba17e4e04679f16bd6d6504978b8c6d087c92272c84dee25556d094a11c6d74</sum>
        </package>
        <package name="perl-File-DosGlob" arch="aarch64" epoch="0" version="1.12" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-DosGlob-1.12-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">572b0593a287886441f83e80059723ba095cf0a1ce5871ce0c65054f8b4f9916</sum>
        </package>
        <package name="perl-File-Find" arch="noarch" epoch="0" version="1.44" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-Find-1.44-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4340329aebc6d4e2a20a4a0262490a02eab3c3f8c14cdbc56167041bfc406da6</sum>
        </package>
        <package name="perl-FileHandle" arch="noarch" epoch="0" version="2.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FileHandle-2.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3e39fb116ad7d27753bedcef1a6e820f63a60b4c5063bc43fdb243b9650a993a</sum>
        </package>
        <package name="perl-File-stat" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-File-stat-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">69584b304b37a71085d1b1999832552e3dc1f121fa56d4f69a4e29a2e537fa65</sum>
        </package>
        <package name="perl-filetest" arch="noarch" epoch="0" version="1.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-filetest-1.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">40840e2b871078b6563e722341b7b125b6c9d53966929daeca5120eb6c5dd388</sum>
        </package>
        <package name="perl-FindBin" arch="noarch" epoch="0" version="1.54" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-FindBin-1.54-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9cad58324085e230d93182830c46360a175d1a0ffba308ceebc7b25f5a7a8038</sum>
        </package>
        <package name="perl-GDBM_File" arch="aarch64" epoch="1" version="1.24" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-GDBM_File-1.24-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9daaaf18ac1607c04c89dea1a41ffa623ece24c8008e3b51e057a789892a7605</sum>
        </package>
        <package name="perl-Getopt-Std" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Getopt-Std-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">99dcfad5e06149134c3ec786f6740c6c72b20ab6edb1cdc03369e2d4b2eb7767</sum>
        </package>
        <package name="perl-Hash-Util" arch="aarch64" epoch="0" version="0.32" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Hash-Util-0.32-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">eed84aab149ae14e6e701f3b9c72bf9f492e4f9fd129262f24483cb76774fab5</sum>
        </package>
        <package name="perl-Hash-Util-FieldHash" arch="aarch64" epoch="0" version="1.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Hash-Util-FieldHash-1.27-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">54159906ccfc4cc6c260bcaf3287863759df1b512b06063308d5a9b7c0c20638</sum>
        </package>
        <package name="perl-I18N-Collate" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-Collate-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6d20a8498404c9197de54883101b165edfe2b93c5c62070b361e40ae8e3b7f30</sum>
        </package>
        <package name="perl-I18N-Langinfo" arch="aarch64" epoch="0" version="0.24" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-Langinfo-0.24-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5838a11ffdbfc2687aaf1bc4939248d40eadc7541808e5694b6661a5cf784f7a</sum>
        </package>
        <package name="perl-I18N-LangTags" arch="noarch" epoch="0" version="0.45" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-I18N-LangTags-0.45-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">7f3c00984f9daf4674a3946e5cd3e42d38241c28cd50a538ad65b933038acb3b</sum>
        </package>
        <package name="perl-if" arch="noarch" epoch="0" version="0.61.000" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-if-0.61.000-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0e7302913d6133623cbe84b6f7cac2e372e6b05d5f79158b1856baf46a731c51</sum>
        </package>
        <package name="perl-interpreter" arch="aarch64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-interpreter-5.40.2-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">52e65ddc7b2455fba0f2638899566d289897bff41ef171060404555c6067fdec</sum>
        </package>
        <package name="perl-IO" arch="aarch64" epoch="0" version="1.55" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-IO-1.55-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2f2e7d4b164c5ddfc5c06157ba6df5e6ca1d81d6503761d5057720109ff844cf</sum>
        </package>
        <package name="perl-IPC-Open3" arch="noarch" epoch="0" version="1.22" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-IPC-Open3-1.22-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b457c4435a6f06fbc648180db5a51c4438d66b150001498f77ea7c211b372769</sum>
        </package>
        <package name="perl-less" arch="noarch" epoch="0" version="0.03" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-less-0.03-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">670ebc3d46f7503f84b3d69f79b0cb7ff7958b8e7253c1b33c195be31fc9e680</sum>
        </package>
        <package name="perl-lib" arch="aarch64" epoch="0" version="0.65" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-lib-0.65-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a3025a3a239e5baf5be513e5014968569e4480a6a3fea735a4f1a0e9d80efce5</sum>
        </package>
        <package name="perl-libnetcfg" arch="noarch" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-libnetcfg-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">41de6c67a452247623014006b4ddb34678ea17acceb43e9df3d2c76725d51ae2</sum>
        </package>
        <package name="perl-libs" arch="aarch64" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-libs-5.40.2-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5c00da41ee5de69845c2e6a705fa58f6b9778b5492a103ee139bc9b13f33c4d2</sum>
        </package>
        <package name="perl-locale" arch="noarch" epoch="0" version="1.12" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-locale-1.12-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d20218fb1d4cfb6ba774c3c65ada3fc3ed221a352046a7888d828c9cc1f04b53</sum>
        </package>
        <package name="perl-Locale-Maketext-Simple" arch="noarch" epoch="1" version="0.21" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Locale-Maketext-Simple-0.21-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">0748651e441428a3fe630edd8e59c7c4bd1298c11f73609870dd47f6f1fdbdea</sum>
        </package>
        <package name="perl-macros" arch="noarch" epoch="4" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-macros-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">29508d63ad1c04709cc244b49fee772f1b739c98a5cf40ef77655047e9cb9ab4</sum>
        </package>
        <package name="perl-Math-Complex" arch="noarch" epoch="0" version="1.62" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Math-Complex-1.62-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c65895672c9bb24c35443a82c397d44f2f1eaba3153f78cac25c474240025754</sum>
        </package>
        <package name="perl-Memoize" arch="noarch" epoch="0" version="1.16" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Memoize-1.16-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7bce1afae95fba04201089bb45eda58f4a6dffe75e15396ae01735f47020508</sum>
        </package>
        <package name="perl-meta-notation" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-meta-notation-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ceb2b652e10eb44fa6b0ab9d404ea5d1a504148c788298974b7f0dda845c996b</sum>
        </package>
        <package name="perl-Module-Loaded" arch="noarch" epoch="1" version="0.08" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Module-Loaded-0.08-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c4802ec4db4c080bf27de5740f4460b02dac0afcf04c90e96895d73d81e70caa</sum>
        </package>
        <package name="perl-mro" arch="aarch64" epoch="0" version="1.29" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-mro-1.29-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5c3a3aadded1673e3dec9df428d43fbc1715447821fdc5dd82c843ab4150a38e</sum>
        </package>
        <package name="perl-NDBM_File" arch="aarch64" epoch="0" version="1.17" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-NDBM_File-1.17-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">71326520b3fc6aeeb7ee2040349e0d784d620d132d2d8a5626a074bd733ae240</sum>
        </package>
        <package name="perl-Net" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Net-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3f05fb3a1ccdbf490a8da8d17a6b2f49eb891ce079d12d37896a678226717001</sum>
        </package>
        <package name="perl-NEXT" arch="noarch" epoch="0" version="0.69" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-NEXT-0.69-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9bc98bc8feb85d727a82b56b0005d351538fa826649abcdc0d7f94dda0a3f72a</sum>
        </package>
        <package name="perl-ODBM_File" arch="aarch64" epoch="0" version="1.18" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ODBM_File-1.18-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b3a4718af4143d0af0f054299500770b704594fd05b226f02d06ecd05bccf223</sum>
        </package>
        <package name="perl-Opcode" arch="aarch64" epoch="0" version="1.65" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Opcode-1.65-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c5a8c4dbffd9c17230a54cfa56b4117cb6e5cb416dfac8088f5d4a6395ac65ea</sum>
        </package>
        <package name="perl-open" arch="noarch" epoch="0" version="1.13" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-open-1.13-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5805aba0d8aac827b89fa9b1c6af7998c911c1189b0967b32307a0216270d0d5</sum>
        </package>
        <package name="perl-overload" arch="noarch" epoch="0" version="1.37" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-overload-1.37-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9c701c301917c4cd0a536917ee80b2fc29c532745afa6d840aac1e73ae420502</sum>
        </package>
        <package name="perl-overloading" arch="noarch" epoch="0" version="0.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-overloading-0.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1567b7808f7d0a3664abddb60175c5009f301886b2b15a1c81ead50987300c5b</sum>
        </package>
        <package name="perl-ph" arch="aarch64" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-ph-5.40.2-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ddd93186af4c8a84388f097d005a0f29609878cfda54ae5340b4393b23a8f733</sum>
        </package>
        <package name="perl-Pod-Functions" arch="noarch" epoch="0" version="1.14" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Pod-Functions-1.14-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">eeb09288b3ad9d99f248311e87142e9a46f7bc9989727a881b363ba4f6005c22</sum>
        </package>
        <package name="perl-Pod-Html" arch="noarch" epoch="0" version="1.35" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Pod-Html-1.35-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8221ab5df8c2b1ee30ecb1582bbdf7ec18586516e5c84ebf0cb4f6555da9a7c2</sum>
        </package>
        <package name="perl-POSIX" arch="aarch64" epoch="0" version="2.20" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-POSIX-2.20-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d846e335703fa153448fb7e4d3426d6f40fbf0bac5fc3c1c47ffa9aa5f1362cf</sum>
        </package>
        <package name="perl-Safe" arch="noarch" epoch="0" version="2.46" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Safe-2.46-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6144a8a3c79c9e5a80b8607af9c539b134abb4008bcfa2eb0880a18a8459441f</sum>
        </package>
        <package name="perl-Search-Dict" arch="noarch" epoch="0" version="1.07" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Search-Dict-1.07-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">51c258972fdd46bbd373502c17e6b48644f119ea220152a0d3a4b51c1700a0c5</sum>
        </package>
        <package name="perl-SelectSaver" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-SelectSaver-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8431cdd6e9d962bbf1298e488b9e5af8bc7f184ecb81ddadb8fadf58ca223e88</sum>
        </package>
        <package name="perl-SelfLoader" arch="noarch" epoch="0" version="1.27" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-SelfLoader-1.27-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">28d0a2be3dc6a6d05b9e81f46a68fee3d91b26b4461388400dce5b0f27966800</sum>
        </package>
        <package name="perl-sigtrap" arch="noarch" epoch="0" version="1.10" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-sigtrap-1.10-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">d02f886ef561027bc19c4418b8de4b5bc7537fe3d35a17db4c2be08d5db132f6</sum>
        </package>
        <package name="perl-sort" arch="noarch" epoch="0" version="2.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-sort-2.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f1430143b9693f9bc1e12d1a9df1544d48cd424fc43c3ba61502be710bc60740</sum>
        </package>
        <package name="perl-subs" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-subs-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">8918c1a21617b7914d8634e7eac6abde85e395b50e6a6e321b93a3968e7f3da4</sum>
        </package>
        <package name="perl-Symbol" arch="noarch" epoch="0" version="1.09" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Symbol-1.09-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">17ead97396a311f64f762f306ccf538c25d49404c16e5012fcfff7795db9a969</sum>
        </package>
        <package name="perl-Sys-Hostname" arch="aarch64" epoch="0" version="1.25" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Sys-Hostname-1.25-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f913df04a84483c8d382a75da4a77675a48c2267fcb97ae3987b04b7d41d04ed</sum>
        </package>
        <package name="perl-Term-Complete" arch="noarch" epoch="0" version="1.403" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Term-Complete-1.403-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">66b362c03c004559eb0df57b25449a54fee5c3c473bf9ad824a949a0b9b7de9a</sum>
        </package>
        <package name="perl-Term-ReadLine" arch="noarch" epoch="0" version="1.17" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Term-ReadLine-1.17-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9634510df64298d518d9da81f0498e3c32b5770f5b09ca13b173d29b223c7621</sum>
        </package>
        <package name="perl-Test" arch="noarch" epoch="0" version="1.31" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Test-1.31-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">526ad97e3b7dcd8863fc3e778974b1472368f7d1a8f17b80a05788fa8a6fdd98</sum>
        </package>
        <package name="perl-Text-Abbrev" arch="noarch" epoch="0" version="1.02" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Text-Abbrev-1.02-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4281e15c48c90708addcc97d41dd25ed9b69c773df3edfc024191d6446d1a506</sum>
        </package>
        <package name="perl-Thread" arch="noarch" epoch="0" version="3.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Thread-3.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">cc65ce65130f119bce6de89dccb7175ccb960bd6bbbbb2adfc271c4f74ea68cd</sum>
        </package>
        <package name="perl-Thread-Semaphore" arch="noarch" epoch="0" version="2.13" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Thread-Semaphore-2.13-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">86a92e6eb3c9000fb6ea1184ee93b94e0fb0a3ebb51fc4a69672ddf1dbb39749</sum>
        </package>
        <package name="perl-Tie" arch="noarch" epoch="0" version="4.6" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-4.6-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c504397313693520cb3b5ac42a41f4e460526b0a166eba98ebfe0267c58f9aff</sum>
        </package>
        <package name="perl-Tie-File" arch="noarch" epoch="0" version="1.09" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-File-1.09-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">81d7b7e5cbc4c391f219ebb42adc67dabfe157c3f33b1d3f1ad9e54aa2b884d4</sum>
        </package>
        <package name="perl-Tie-Memoize" arch="noarch" epoch="0" version="1.1" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Tie-Memoize-1.1-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">21cc178b7ea848ba45ef3ffa2fe36ed8904fcae31f89b18a48d6cc535ac83a09</sum>
        </package>
        <package name="perl-Time" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Time-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1086aba3487a8b2a57d839272fb1e3cf43753f814604070a7469ef0e965d27ed</sum>
        </package>
        <package name="perl-Time-Piece" arch="aarch64" epoch="0" version="1.3401" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Time-Piece-1.3401-512.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5a67baed9ade1c8d6d6f5dead733eaf1e33cb2c5b654a92841e8da156b4b6663</sum>
        </package>
        <package name="perl-Unicode-UCD" arch="noarch" epoch="0" version="0.78" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-Unicode-UCD-0.78-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e946bb7b7bea19f5129b8a8f51f60b33fb9ef11f48252c61ba0821caa8348088</sum>
        </package>
        <package name="perl-User-pwent" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-User-pwent-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">2e134003c8129f2b32aa4fe533959d092ec05a46c8dcca4388ba21cc680aef6e</sum>
        </package>
        <package name="perl-utils" arch="noarch" epoch="0" version="5.40.2" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-utils-5.40.2-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">b57e93b65d5b1b9382282af8ae96173bc97169fa2afabb3eb3890745f973e30a</sum>
        </package>
        <package name="perl-vars" arch="noarch" epoch="0" version="1.05" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-vars-1.05-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5a825accc7d995c71c719ec15ab84221c533a3abe6be6b061381d7606a4854b6</sum>
        </package>
        <package name="perl-vmsish" arch="noarch" epoch="0" version="1.04" release="512.1.el10_0" src="perl-5.40.2-512.1.el10_0.src.rpm">
          <filename>perl-vmsish-1.04-512.1.el10_0.noarch.rpm</filename>
          <sum type="sha256">1105ceabfffbdb6623a09ef153437cf83399cf3c9e90886af08debdef5ea9efb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7494</id>
    <title>Moderate: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24813" id="CVE-2025-24813" type="cve" title="CVE-2025-24813" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2351129" id="2351129" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7494" id="RLSA-2025:7494" type="self" title="RLSA-2025:7494" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">b437e4fc937d6b74f899196746d369a6a92329101a31896fa56218c02f46d8f2</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d89438b2d7d2e13b6ca687b167d642ffaeaa56759ff8ae29ed4b0c6f999c116</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">da4573e35e6a878c5d8b183fca36afb47d21bd6ddf6986b5036c8fda3a50c899</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">633995220500848334199accb63d5fb50138965dc0ea0be7ba15ff6781f0bfcf</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">6998f6dff03a9fe84d0f74fe7d58d24d7e852dc4120eece360bfad99e4fd026b</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">b4ad34cca71a8de6a211fca37ab3c96e9b9c7ea305fed7b854295b1b4b834f5c</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">18e71ac028c3f2d5029044ab9c6f2b8b1f9e7807d493ae50a4cc5ca943de0197</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0" src="tomcat9-9.0.87-5.el10_0.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.noarch.rpm</filename>
          <sum type="sha256">249400041e694a3f0a2163c207d03ea61a785931ebc8a089e7b48bfaf645da9e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7497</id>
    <title>Moderate: tomcat security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API (CVE-2024-52316)

* tomcat: Apache Tomcat: DoS in examples web application (CVE-2024-54677)

* tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT (CVE-2025-24813)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52316" id="CVE-2024-52316" type="cve" title="CVE-2024-52316" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-54677" id="CVE-2024-54677" type="cve" title="CVE-2024-54677" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-24813" id="CVE-2025-24813" type="cve" title="CVE-2025-24813" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2326972" id="2326972" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2332815" id="2332815" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2351129" id="2351129" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7497" id="RLSA-2025:7497" type="self" title="RLSA-2025:7497" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">4cf0f9042968d70ef2898c37fac49a01de1b1cfa3c328bb07b209e3d8dbff610</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d6f90224fc1711fe2b7abdd716b0731eeffed54dd5cc1aa367e2b363761005f</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6d0065b1bf9c100520228fb27d19e05a21a94c08f7afb93cccc1b8c481217c8a</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3976c9f95398f8f87e813ac6f2c3a79195a292f9e82730aa3c2eaaf89eb584c5</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e1d02f3b4da77ba27efd41c2081f47ff826e02cdb6f7178d694c7f0d690a79ff</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-lib-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ea3e898fec9e468462d24e57789c94a1715e2bee582c87c2323232f238570be5</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">ef37f975774200329ec5683bb10febc6cd7f6be8d8713a6834f245f604f6cf1e</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0" src="tomcat-10.1.36-1.el10_0.src.rpm">
          <filename>tomcat-webapps-10.1.36-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">5001b035bd821674c28eca7704f915abfad1d76546fce19420e00a3452040571</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7490</id>
    <title>Important: mod_auth_openidc security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for mod_auth_openidc.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. 

Security Fix(es):

* mod_auth_openidc: mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data (CVE-2025-31492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31492" id="CVE-2025-31492" type="cve" title="CVE-2025-31492" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357738" id="2357738" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7490" id="RLSA-2025:7490" type="self" title="RLSA-2025:7490" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_auth_openidc" arch="aarch64" epoch="0" version="2.4.15" release="4.el10_0.1" src="mod_auth_openidc-2.4.15-4.el10_0.1.src.rpm">
          <filename>mod_auth_openidc-2.4.15-4.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">f5004a29d6093b56e49bea5398a6702c6370ae6b614a409638532f8e1d1cf584</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7458</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability (CVE-2024-9632)

* X.Org: Xwayland: Use-after-free of the root cursor (CVE-2025-26594)

* xorg: xwayland: Use-after-free in SyncInitTrigger() (CVE-2025-26601)

* xorg: xwayland: Use-after-free in PlayReleasedEvents() (CVE-2025-26600)

* xorg: xwayland: Use of uninitialized pointer in compRedirectWindow() (CVE-2025-26599)

* xorg: xwayland: Out-of-bounds write in CreatePointerBarrierClient() (CVE-2025-26598)

* xorg: xwayland: Buffer overflow in XkbChangeTypesOfKey() (CVE-2025-26597)

* xorg: xwayland: Heap overflow in XkbWriteKeySyms() (CVE-2025-26596)

* Xorg: xwayland: Buffer overflow in XkbVModMaskText() (CVE-2025-26595)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-9632" id="CVE-2024-9632" type="cve" title="CVE-2024-9632" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26594" id="CVE-2025-26594" type="cve" title="CVE-2025-26594" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26595" id="CVE-2025-26595" type="cve" title="CVE-2025-26595" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26596" id="CVE-2025-26596" type="cve" title="CVE-2025-26596" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26597" id="CVE-2025-26597" type="cve" title="CVE-2025-26597" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26598" id="CVE-2025-26598" type="cve" title="CVE-2025-26598" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26599" id="CVE-2025-26599" type="cve" title="CVE-2025-26599" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26600" id="CVE-2025-26600" type="cve" title="CVE-2025-26600" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26601" id="CVE-2025-26601" type="cve" title="CVE-2025-26601" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2317233" id="2317233" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345248" id="2345248" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345251" id="2345251" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345252" id="2345252" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345253" id="2345253" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345254" id="2345254" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345255" id="2345255" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345256" id="2345256" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2345257" id="2345257" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7458" id="RLSA-2025:7458" type="self" title="RLSA-2025:7458" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="aarch64" epoch="0" version="24.1.5" release="3.el10_0" src="xorg-x11-server-Xwayland-24.1.5-3.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4a428db076d0f1e5aa0cd2fa9d679da294a75d3f26fad58ae93769cb2dc9eab8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7462</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

* golang.org/x/crypto/ssh: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh (CVE-2025-22869)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22869" id="CVE-2025-22869" type="cve" title="CVE-2025-22869" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348367" id="2348367" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7462" id="RLSA-2025:7462" type="self" title="RLSA-2025:7462" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman" arch="aarch64" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-5.4.0-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">aae5c5ac1cd7fcce7904d4e9846b23ce728719339813051bef5e84b4ec2b70b2</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-9.el10_0.noarch.rpm</filename>
          <sum type="sha256">7ae66cfa21aa2ec6ca3c8a9071719dbd74044bbae59aa125845f0deb025a6329</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="6" version="5.4.0" release="9.el10_0" src="podman-5.4.0-9.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6e025e537dd056a986555093b9e2061e4654fdeaf2caf1f645741131847633f3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7482</id>
    <title>Moderate: git security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for git.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git is a distributed revision control system with a decentralized architecture. As opposed to centralized version control systems with a client-server model, Git ensures that each working copy of a Git repository is an exact copy with complete revision history. This not only allows the user to work on and contribute to projects without the need to have permission to push the changes to their official repositories, but also makes it possible for the user to work with no network connection.

Security Fix(es):

* git: The sideband payload is passed unfiltered to the terminal in git (CVE-2024-52005)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-52005" id="CVE-2024-52005" type="cve" title="CVE-2024-52005" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2338289" id="2338289" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7482" id="RLSA-2025:7482" type="self" title="RLSA-2025:7482" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git" arch="aarch64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-2.47.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a88e3bfdcc17ad3663277449ab689560db89bdd72c91472ca81dd82faff4cd0f</sum>
        </package>
        <package name="git-all" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-all-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bdac5c5ba4bfafed747139711d4f1914945210296dc86facf5432c7f99084f22</sum>
        </package>
        <package name="git-core" arch="aarch64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-core-2.47.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1282845b31c497a7ffd8394843ed4c79c6c32451fed01257b49003f1c26e0be1</sum>
        </package>
        <package name="git-core-doc" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-core-doc-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">dff88d5bf97778c8ffa84c94fba0c513a974d8a22377dacb9d0d3d144e8ac113</sum>
        </package>
        <package name="git-credential-libsecret" arch="aarch64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-credential-libsecret-2.47.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">862ab4ada0e9972532f7c7f42adcad297036e254187d43b00f8a58e9acd3a2b9</sum>
        </package>
        <package name="git-daemon" arch="aarch64" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-daemon-2.47.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f692742870f8565adead8a3513d52dd8d75a8a4e255282968a56a8e9e68cbacc</sum>
        </package>
        <package name="git-email" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-email-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">302cbdefd3aeef9e3cb6a60171ca3ff7359992cb4a9152b7108d104ea115f6d9</sum>
        </package>
        <package name="git-gui" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-gui-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7de5ac4a009799fac2ddf54a02931c705ee1a98dfbb9c68d7896e07dd1d639a</sum>
        </package>
        <package name="git-instaweb" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-instaweb-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a7b51b56a736417cf73bce8edb49e630148261994fafcf7452aadc661590c3f7</sum>
        </package>
        <package name="gitk" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>gitk-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b3aee409817b28b7d56de0fb83098e1cc9beb2e16a62e94090dd8cfdebab8fcc</sum>
        </package>
        <package name="git-subtree" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-subtree-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">46242bbebcd1ad2839abfd60513fb03fd03784110b4f23a33292b9b36b2767e2</sum>
        </package>
        <package name="git-svn" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>git-svn-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3bcd83dd028d37947088d1f3cd86a662a008b0ca693c9e3540f7e9b50b858c28</sum>
        </package>
        <package name="gitweb" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>gitweb-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">0decb63454ebe01d56cde889e20f36c21e1a53be754ff0371ace2d49352d47cd</sum>
        </package>
        <package name="perl-Git" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>perl-Git-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a71275b85f0a971d28ad5a09f367052c44662020585c0053e7ae7dda0527c0db</sum>
        </package>
        <package name="perl-Git-SVN" arch="noarch" epoch="0" version="2.47.1" release="2.el10_0" src="git-2.47.1-2.el10_0.src.rpm">
          <filename>perl-Git-SVN-2.47.1-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">43f3df75d8bf0c722c592f13c33b87d3e1cb0939f38aa0849043d9b7a60c20b0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7478</id>
    <title>Moderate: corosync security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:03" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for corosync.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The corosync packages provide the Corosync Cluster Engine and C APIs for Rocky Linux cluster software.

Security Fix(es):

* corosync: Stack buffer overflow from 'orf_token_endian_convert' (CVE-2025-30472)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30472" id="CVE-2025-30472" type="cve" title="CVE-2025-30472" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354229" id="2354229" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7478" id="RLSA-2025:7478" type="self" title="RLSA-2025:7478" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="corosynclib" arch="aarch64" epoch="0" version="3.1.9" release="1.el10_0.1" src="corosync-3.1.9-1.el10_0.1.src.rpm">
          <filename>corosynclib-3.1.9-1.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">12d12308d43f7ebb4a58e719c103b31a973f8cf43ec7b8130b3f367448740e4f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7489</id>
    <title>Important: php security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for php.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server.

Security Fix(es):

* php: Header parser of http stream wrapper does not handle folded headers (CVE-2025-1217)

* php: Stream HTTP wrapper header check might omit basic auth header (CVE-2025-1736)

* php: Streams HTTP wrapper does not fail for headers with invalid name and no colon (CVE-2025-1734)

* php: libxml streams use wrong content-type header when requesting a redirected resource (CVE-2025-1219)

* php: Stream HTTP wrapper truncates redirect location to 1024 bytes (CVE-2025-1861)

* php: Reference counting in php_request_shutdown causes Use-After-Free (CVE-2024-11235)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-11235" id="CVE-2024-11235" type="cve" title="CVE-2024-11235" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1217" id="CVE-2025-1217" type="cve" title="CVE-2025-1217" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1219" id="CVE-2025-1219" type="cve" title="CVE-2025-1219" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1734" id="CVE-2025-1734" type="cve" title="CVE-2025-1734" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1736" id="CVE-2025-1736" type="cve" title="CVE-2025-1736" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1861" id="CVE-2025-1861" type="cve" title="CVE-2025-1861" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2355917" id="2355917" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356041" id="2356041" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356042" id="2356042" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356043" id="2356043" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2356046" id="2356046" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357531" id="2357531" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7489" id="RLSA-2025:7489" type="self" title="RLSA-2025:7489" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="php" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2b7bbde608db7c9fcd866ac4fa37d38284a07feac5bc6994c25d792bb8ee326d</sum>
        </package>
        <package name="php-bcmath" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-bcmath-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">3b09c0857a258bf80ba0714820ee86f48c03de87bf466ffe24195ff78cc378d0</sum>
        </package>
        <package name="php-cli" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-cli-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6ce9ef0fa55797529cb67fd1095e0d73fb12117f261a41d1e3e7c1459a4e58a8</sum>
        </package>
        <package name="php-common" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-common-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a7f0bf365bf421dfed0390de349477ebb45cd0935463445be15f36f88edf3ed8</sum>
        </package>
        <package name="php-dba" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-dba-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ffc21f19dba9646109392134921e82dbc16677a7befe98e791e338d16d212097</sum>
        </package>
        <package name="php-dbg" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-dbg-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">debedd72814913ffd9590b2b07245c45cccdb01b1bf6d4cee733fb1a0cab32ff</sum>
        </package>
        <package name="php-devel" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-devel-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d6978b2f37a645aa184bef2fb7faaa70e53286193bb917bd7c4431635d3f8eb3</sum>
        </package>
        <package name="php-embedded" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-embedded-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">396f73f73a0748c864be3bc4ee68173a81f3eba66d60eafe5443c5fabf26db0b</sum>
        </package>
        <package name="php-enchant" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-enchant-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1771089f90d1ce305e37b279e994ff7586599d29bdf2845d941d913f32b7ef76</sum>
        </package>
        <package name="php-ffi" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-ffi-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d34877bc30fa98707a4ada9679c571ccff4175b9df74b49481753b5a36a801b0</sum>
        </package>
        <package name="php-fpm" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-fpm-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">68ecb22d629710629d8bd6f4b61a58feb2152f5bae695168e733d4ab9b2d9192</sum>
        </package>
        <package name="php-gd" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-gd-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">923089ce99a1b66f71d4d2cc1424611f71f2891ea78114927561371aa98fe27a</sum>
        </package>
        <package name="php-gmp" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-gmp-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">780ba082ca85076fbd0412ee58221a4ac4324c7448dd473b96bee60e86ddc381</sum>
        </package>
        <package name="php-intl" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-intl-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">76dc4f09a00f3ecca19942707a684e14962814966d225965a5a67ccb6180171e</sum>
        </package>
        <package name="php-ldap" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-ldap-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ae667da5d09dd783bb79098cc6a0596fb80be4f8c9126c1600e504757ea7b027</sum>
        </package>
        <package name="php-mbstring" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-mbstring-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6e3e7c8a11fed0c650c90cd106441b38027283c22cc9acd784e809215a5c63bb</sum>
        </package>
        <package name="php-mysqlnd" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-mysqlnd-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6d86978406227e93bb3ee5e159de93e2e36168321834743673cb36478d4f8e9a</sum>
        </package>
        <package name="php-odbc" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-odbc-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">55b01bd6992f430125f2fa26d3eab0b06d9e8ee62afb27f8e444effaf379cf1f</sum>
        </package>
        <package name="php-opcache" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-opcache-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">48b62e61bfe6fc6031e1101e83fa29ec35c1fe1e6624734138b64732cc68ba0b</sum>
        </package>
        <package name="php-pdo" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-pdo-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0d06cdfbb3ae9a1c6cb2a744b149f7079333aa56842a2c839959ab0dd4dacd37</sum>
        </package>
        <package name="php-pgsql" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-pgsql-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1c3cdfabaf98cf9cf7b1702841386394da3fdd7c819ab21f3885af752d186980</sum>
        </package>
        <package name="php-process" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-process-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">75b460d2911455e81325c8d00df579b9bb7417005c7fc957332df24df3446abb</sum>
        </package>
        <package name="php-snmp" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-snmp-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e2d750598c581c520b7f071a40b84ba7001a8346f9b262ba51517bd95dea08b5</sum>
        </package>
        <package name="php-soap" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-soap-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f31b159a560909ca0fa5357d4f2d855da5253ee1ba8ca7837c4cc9a568bc0e7e</sum>
        </package>
        <package name="php-xml" arch="aarch64" epoch="0" version="8.3.19" release="1.el10_0" src="php-8.3.19-1.el10_0.src.rpm">
          <filename>php-xml-8.3.19-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">cc4e7dc66f7ee29b4b8a7de0b232dca9d0c8a50a3fdf0f2f7847e16328618df8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7479</id>
    <title>Important: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

* golang.org/x/oauth2/jws: Unexpected memory consumption during token parsing in golang.org/x/oauth2/jws (CVE-2025-22868)

* github.com/expr-lang/expr: Memory Exhaustion in Expr Parser with Unrestricted Input (CVE-2025-29786)

* golang-jwt/jwt: jwt-go allows excessive memory allocation during header parsing (CVE-2025-30204)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22868" id="CVE-2025-22868" type="cve" title="CVE-2025-22868" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-29786" id="CVE-2025-29786" type="cve" title="CVE-2025-29786" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30204" id="CVE-2025-30204" type="cve" title="CVE-2025-30204" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2348366" id="2348366" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2352914" id="2352914" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354195" id="2354195" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7479" id="RLSA-2025:7479" type="self" title="RLSA-2025:7479" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="aarch64" epoch="0" version="0.107.0" release="9.el10_0" src="opentelemetry-collector-0.107.0-9.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.107.0-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">df4d486cdfc5cc1043ab1c8ff1d1c20e68cc5e87630e998bc83973bd7ef1cd76</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7509</id>
    <title>Important: valkey security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Redis DoS Vulnerability due to unlimited growth of output buffers abused by unauthenticated client (CVE-2025-21605)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21605" id="CVE-2025-21605" type="cve" title="CVE-2025-21605" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2361883" id="2361883" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7509" id="RLSA-2025:7509" type="self" title="RLSA-2025:7509" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="valkey" arch="aarch64" epoch="0" version="8.0.3" release="1.el10_0" src="valkey-8.0.3-1.el10_0.src.rpm">
          <filename>valkey-8.0.3-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">18061271f9471788e6e4c1f50abe55b591a40293b2f5b916b839baba1543e47b</sum>
        </package>
        <package name="valkey-devel" arch="aarch64" epoch="0" version="8.0.3" release="1.el10_0" src="valkey-8.0.3-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.3-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">719399532b37a0b00cfaad8cd6f60261ccb4ebdafcbc0d12cc1fc6833a904193</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7467</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7467" id="RLSA-2025:7467" type="self" title="RLSA-2025:7467" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="skopeo" arch="aarch64" epoch="2" version="1.18.1" release="1.el10_0" src="skopeo-1.18.1-1.el10_0.src.rpm">
          <filename>skopeo-1.18.1-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b80f9f6d3b9dadef786257c91fa91316976d863f2d8b33150c9444c415972086</sum>
        </package>
        <package name="skopeo-tests" arch="aarch64" epoch="2" version="1.18.1" release="1.el10_0" src="skopeo-1.18.1-1.el10_0.src.rpm">
          <filename>skopeo-tests-1.18.1-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">84433b3a8f46f3e5d06a17f30a37e0d32c09146de75d4b675dda5ddcc8e30557</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7459</id>
    <title>Moderate: buildah security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* go-jose: Go JOSE's Parsing Vulnerable to Denial of Service (CVE-2025-27144)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27144" id="CVE-2025-27144" type="cve" title="CVE-2025-27144" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2347423" id="2347423" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7459" id="RLSA-2025:7459" type="self" title="RLSA-2025:7459" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah" arch="aarch64" epoch="2" version="1.39.4" release="1.el10_0" src="buildah-1.39.4-1.el10_0.src.rpm">
          <filename>buildah-1.39.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e8ea0d25aef77a9bea9ae374430f45538702ea5f6120afcc9c4726cb2a5e5e8c</sum>
        </package>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.39.4" release="1.el10_0" src="buildah-1.39.4-1.el10_0.src.rpm">
          <filename>buildah-tests-1.39.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ffed8fb218b48fc6d1cfacb96ae3543ab3f406c7a7d8c9865fbd5380fe362f7b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7457</id>
    <title>Moderate: exiv2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for exiv2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Exiv2 is a C++ library to access image metadata, supporting read and write access to the Exif, IPTC and XMP metadata, Exif MakerNote support, extract and delete methods for Exif thumbnails, classes to access Ifd, and support for various image formats.

Security Fix(es):

* exiv2: Use After Free in Exiv2 (CVE-2025-26623)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26623" id="CVE-2025-26623" type="cve" title="CVE-2025-26623" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2346345" id="2346345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7457" id="RLSA-2025:7457" type="self" title="RLSA-2025:7457" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="exiv2" arch="aarch64" epoch="0" version="0.28.3" release="3.el10_0.2" src="exiv2-0.28.3-3.el10_0.2.src.rpm">
          <filename>exiv2-0.28.3-3.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">8d43edb00c691b981eae36dfe00bbc6669eebbccd16790683a37de153e4b7013</sum>
        </package>
        <package name="exiv2-libs" arch="aarch64" epoch="0" version="0.28.3" release="3.el10_0.2" src="exiv2-0.28.3-3.el10_0.2.src.rpm">
          <filename>exiv2-libs-0.28.3-3.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">337e28fea3ba8edf6f2dccc627119db70139563956cf5bda7b9071aba0369a75</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7592</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for yggdrasil.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.

Security Fix(es):

* yggdrasil: Local privilege escalation in yggdrasil (CVE-2025-3931)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-45336" id="CVE-2024-45336" type="cve" title="CVE-2024-45336" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3931" id="CVE-2025-3931" type="cve" title="CVE-2025-3931" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2341751" id="2341751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362345" id="2362345" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7592" id="RLSA-2025:7592" type="self" title="RLSA-2025:7592" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="yggdrasil" arch="aarch64" epoch="0" version="0.4.5" release="3.el10_0" src="yggdrasil-0.4.5-3.el10_0.src.rpm">
          <filename>yggdrasil-0.4.5-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">beea4d7fc17a73b4e00928122f3b09faa3569a0db9432cd872ebe7a9b651ce4c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7593</id>
    <title>Moderate: ghostscript security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:04" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ghostscript.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Ghostscript suite contains utilities for rendering PostScript and PDF documents. Ghostscript translates PostScript code to common bitmap formats so that the code can be displayed or printed.

Security Fix(es):

* Ghostscript: NPDL device: Compression buffer overflow (CVE-2025-27832)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27832" id="CVE-2025-27832" type="cve" title="CVE-2025-27832" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2354949" id="2354949" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7593" id="RLSA-2025:7593" type="self" title="RLSA-2025:7593" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ghostscript" arch="aarch64" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-10.02.1-16.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9f363958513942357d3a8072ab9caa791506fb89f1736dd5ba72228802d6332f</sum>
        </package>
        <package name="ghostscript-doc" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-doc-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">f4914cfd80f9e897646ac8e36f35e168dff0f5d687bedd1ecc1e5136f57ddfa7</sum>
        </package>
        <package name="ghostscript-tools-fonts" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-tools-fonts-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">c86349f057a12bd7dcb6abc7f6f0724a83df500266b99fe894462a62ef242058</sum>
        </package>
        <package name="ghostscript-tools-printing" arch="noarch" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>ghostscript-tools-printing-10.02.1-16.el10_0.noarch.rpm</filename>
          <sum type="sha256">f20d5ba7b32a253d2c2a24a263142c8d24062116a76f8bb2d82a0ece4b9875ea</sum>
        </package>
        <package name="libgs" arch="aarch64" epoch="0" version="10.02.1" release="16.el10_0" src="ghostscript-10.02.1-16.el10_0.src.rpm">
          <filename>libgs-10.02.1-16.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d1cdc3782f5f2a27551e72dcfc2a6dba92fee914e58a3fceff6048cd36317b32</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7599</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.116 and .NET Runtime 8.0.16.Security Fix(es):

* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26646" id="CVE-2025-26646" type="cve" title="CVE-2025-26646" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365317" id="2365317" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7599" id="RLSA-2025:7599" type="self" title="RLSA-2025:7599" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9f04c8f076a8e7db4286fe4612fbd58cefbeacc1ecbc4e3a18471c88d39f8d73</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">79e2bb90cd0be88722d576bdc2bd610dae7c4220cbfdf1ff51a379cac2ab84f7</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8f48aaae18366533db35aa8e4544bd1b46dbe635b4e24adc7dfbaf50ec861bba</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5b49945d281acaf0e7fc27a0bf880580d54f5388e69d2db9e7cdd3fe1c8e532b</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f590c4540ae16a904d520defbdc99a6afe8be1fef244986c2f9c8f7e0fb7174f</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">cb5ad0088be8164bae07226af50ceafdc3521ce0d2e4bec6c7640ee14e6f316a</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">25021f30be2b8578d4c5fd1a2bb06ed045b82cdc13d86cf551f77d66c2fa6823</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.116-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d861c5429f4d5539908df0e011241cea4027730183ddddf79b3d40fd60925cca</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.116-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ccace88b3125a4b80f2a1488c5cb6c74c1582af27d55af187f267b7f225f8ea8</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.16" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.16-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0a96856399a15f8e05721b14b249b0f721a1d583e2455bdc009a0cd1995efd59</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.116" release="1.el10_0" src="dotnet8.0-8.0.116-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.116-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">99445be0065789af35b869ae80d0b41cf0b6b9d1b445730ff7612161c340dd67</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7601</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.106 and .NET Runtime 9.0.5.Security Fix(es):

* dotnet: .NET and Visual Studio Spoofing Vulnerability (CVE-2025-26646)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-26646" id="CVE-2025-26646" type="cve" title="CVE-2025-26646" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365317" id="2365317" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7601" id="RLSA-2025:7601" type="self" title="RLSA-2025:7601" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d7762d78b3846423cfb7ee5542833b2cdaf11686a9e1162b875f3bf5452f0108</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4d4cacac0833ffc30d42f605bad52518d8e11af2b870437e2156499663cd4a74</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b9597f486d2a5e6e5be237cfa9506a4a94338c3cca944e43a2d3817a4c4bd20c</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">14ea597bddbbf31acf9a25993d83b5ec1f888ecb3ea4d8add07aac841bbd897d</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">de9f04933f5135a5fe89b6c61d3837f665de84aca474116b892f5d152ecd9db8</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a476731a732a8c87a41d20a4dc2068f815d3d1a712f896fae8cfbb02a4d5b28c</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">07c73f4d883d13225ab9a19d0ac7e339a5f0d9181e141dd089407c72678b8532</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d1a295cba69e5e159ba5c5da9e2667c97a56198f5296416de64b520bbbfeaaeb</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.106-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">59120662a9d54082646afb2ff77f7f1a51a9aca5c468d4b3a99559e8e884b0c2</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.106-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c94ea637034eb8ec8f641e54f574410acaa2b944651b4e7ccd093ec71ac2f8db</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.106-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5534acc941b79de7a7ec89e52d72fc32185d76689eb2061ab270afe74dfae26d</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.5" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.5-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">09bf2fcc341230738bf30dbe6a8bc241379fa90a900f89bbc6d80b3cb41c1871</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.106-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1a0afc501e4c05087759d19bd9c4740f5bc78e6ca0ecc576c2a39f4a835fb323</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.106" release="1.el10_0" src="dotnet9.0-9.0.106-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.106-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e2608d5bc7e5b5d6cb5d6d2b29ccd9f0b1cd670c5dee7dd41f1fa860e4af1f34</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:7892</id>
    <title>Important: grafana security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4123" id="CVE-2025-4123" type="cve" title="CVE-2025-4123" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364632" id="2364632" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:7892" id="RLSA-2025:7892" type="self" title="RLSA-2025:7892" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="17.el10_0" src="grafana-10.2.6-17.el10_0.src.rpm">
          <filename>grafana-10.2.6-17.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5e9b77d17ee06657ce145929e0524f739456383cade94cddfb136d4b91ac16b1</sum>
        </package>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="17.el10_0" src="grafana-10.2.6-17.el10_0.src.rpm">
          <filename>grafana-selinux-10.2.6-17.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1db66c315643ac8cd269366526afb4c1706f655719f68e9deee3dc630bb77231</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8047</id>
    <title>Moderate: unbound security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Unbounded name compression could lead to Denial of Service (CVE-2024-8508)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-8508" id="CVE-2024-8508" type="cve" title="CVE-2024-8508" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2316321" id="2316321" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8047" id="RLSA-2025:8047" type="self" title="RLSA-2025:8047" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-unbound" arch="aarch64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>python3-unbound-1.20.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9f2c083f74c844cf485012f53694d4ea50bebc985ecb805b4730f65311db4ba4</sum>
        </package>
        <package name="unbound" arch="aarch64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-1.20.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">14bdb1ac09dee8be1336671100a8292d8d9fad2051dffd02d7ae9f5b3c9ea3a5</sum>
        </package>
        <package name="unbound-anchor" arch="aarch64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-anchor-1.20.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">077ca2c607b17cab94d770df4d25597128651c69e475d5c390380a8ca7d40737</sum>
        </package>
        <package name="unbound-dracut" arch="aarch64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-dracut-1.20.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">168347a97a7281cfd14e921a6bf5d06677aa86e2502b6c3e432d111e56f4b7ba</sum>
        </package>
        <package name="unbound-libs" arch="aarch64" epoch="0" version="1.20.0" release="10.el10_0" src="unbound-1.20.0-10.el10_0.src.rpm">
          <filename>unbound-libs-1.20.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e12d92edb46e46a79246248af0ba2e57c49d1a6738f32b7ea46152ba4a35f94f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8125</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

* firefox: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4918" id="CVE-2025-4918" type="cve" title="CVE-2025-4918" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4919" id="CVE-2025-4919" type="cve" title="CVE-2025-4919" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367016" id="2367016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367018" id="2367018" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8125" id="RLSA-2025:8125" type="self" title="RLSA-2025:8125" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="128.10.1" release="1.el10_0" src="firefox-128.10.1-1.el10_0.src.rpm">
          <filename>firefox-128.10.1-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ddc663c77f923ebec3a09cc8e84fc72a9467efd079750c3e1d2c9a101e08e084</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8128</id>
    <title>Important: libsoup3 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libsoup3.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages.  libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.

Security Fix(es):

* libsoup: Denial of Service attack to websocket server (CVE-2025-32049)

* libsoup: Denial of service in server when client requests a large amount of  overlapping ranges with Range header (CVE-2025-32907)

* libsoup: Cookie domain validation bypass via uppercase characters in libsoup (CVE-2025-4035)

* libsoup: Integer Underflow in soup_multipart_new_from_message() Leading to Denial of Service in libsoup (CVE-2025-4948)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32049" id="CVE-2025-32049" type="cve" title="CVE-2025-32049" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32907" id="CVE-2025-32907" type="cve" title="CVE-2025-32907" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4035" id="CVE-2025-4035" type="cve" title="CVE-2025-4035" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4948" id="CVE-2025-4948" type="cve" title="CVE-2025-4948" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2357066" id="2357066" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359342" id="2359342" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362651" id="2362651" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367183" id="2367183" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8128" id="RLSA-2025:8128" type="self" title="RLSA-2025:8128" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libsoup3" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_0.6" src="libsoup3-3.6.5-3.el10_0.6.src.rpm">
          <filename>libsoup3-3.6.5-3.el10_0.6.aarch64.rpm</filename>
          <sum type="sha256">8ff908399d99a56961aa0acf6ec3e42ab9f207e0c7de0a6500996201113aed49</sum>
        </package>
        <package name="libsoup3-devel" arch="aarch64" epoch="0" version="3.6.5" release="3.el10_0.6" src="libsoup3-3.6.5-3.el10_0.6.src.rpm">
          <filename>libsoup3-devel-3.6.5-3.el10_0.6.aarch64.rpm</filename>
          <sum type="sha256">2a2d748fa4d17411753dd822a42a0e59604967c7c7a5c30e65ba94fdbe25343d</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8131</id>
    <title>Moderate: ruby security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for ruby.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks.

Security Fix(es):

* net-imap: Net::IMAP vulnerable to possible DoS by memory exhaustion (CVE-2025-25186)

* CGI: Denial of Service in CGI::Cookie.parse (CVE-2025-27219)

* uri: userinfo leakage in URI#join, URI#merge and URI#+ (CVE-2025-27221)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-25186" id="CVE-2025-25186" type="cve" title="CVE-2025-25186" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27219" id="CVE-2025-27219" type="cve" title="CVE-2025-27219" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27221" id="CVE-2025-27221" type="cve" title="CVE-2025-27221" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2344680" id="2344680" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2349699" id="2349699" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2349700" id="2349700" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8131" id="RLSA-2025:8131" type="self" title="RLSA-2025:8131" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ruby" arch="aarch64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-3.3.8-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e3d3b3b6255ad4f0f84a7ff7c041fe7ea893b4a845487e214a2cce8b15342d67</sum>
        </package>
        <package name="ruby-bundled-gems" arch="aarch64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-bundled-gems-3.3.8-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">79c2f5428481736f48d1bf4d71ca9972335c6028626d7b8913b8e5c6aa73ecb2</sum>
        </package>
        <package name="ruby-default-gems" arch="noarch" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-default-gems-3.3.8-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">2904c2be6de7adbab5728cba1bf5f581345a9ec634bf41d756b327d5df6cdc1d</sum>
        </package>
        <package name="ruby-devel" arch="aarch64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-devel-3.3.8-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">3322a77b87b6f60f9de591c7abcac8ed9ecb07f80e4aa20563da3452d4332b3b</sum>
        </package>
        <package name="rubygem-bigdecimal" arch="aarch64" epoch="0" version="3.1.5" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-bigdecimal-3.1.5-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">cdcbb70f068be52bd84a9b60619e68e81316ac133b431363cb73ef899091512f</sum>
        </package>
        <package name="rubygem-bundler" arch="noarch" epoch="0" version="2.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-bundler-2.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">d7b4cd0ea6f73904a04b3406e6ae24ec8054e6d370477622248c6da2d0cbba61</sum>
        </package>
        <package name="rubygem-io-console" arch="aarch64" epoch="0" version="0.7.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-io-console-0.7.1-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e642314f6e369def1e4674c21b684a6db1d9d70a0c75f0a5a1c15ee03fe5e65f</sum>
        </package>
        <package name="rubygem-irb" arch="noarch" epoch="0" version="1.13.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-irb-1.13.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">47789a9d47f47375f2265bbfba6a021f98d2f2840f774b8c8dcb2d64a11c79f1</sum>
        </package>
        <package name="rubygem-json" arch="aarch64" epoch="0" version="2.7.2" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-json-2.7.2-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5601918c32ab2ecc95425fc21848d3e872234ddfacad56a754c760725fd3dd34</sum>
        </package>
        <package name="rubygem-minitest" arch="noarch" epoch="0" version="5.20.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-minitest-5.20.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">443713643e31df383a0adb8f57a219441de801e241bcb862d3be37542d8c3d72</sum>
        </package>
        <package name="rubygem-power_assert" arch="noarch" epoch="0" version="2.0.3" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-power_assert-2.0.3-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">fd83ea41220fdd4bcd8e00f692c937507141e2fac3adae231441766600ac83a9</sum>
        </package>
        <package name="rubygem-psych" arch="aarch64" epoch="0" version="5.1.2" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-psych-5.1.2-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2ebd5b6912c0eaeb879d07b0fe8c59330b5eebe58d211af22e2e5df8c0756271</sum>
        </package>
        <package name="rubygem-rake" arch="noarch" epoch="0" version="13.1.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rake-13.1.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">18f422e254af9edb5743dd00a53c2ce7a4d0e04939a2ab9ac711a7bd264a1e84</sum>
        </package>
        <package name="rubygem-rbs" arch="aarch64" epoch="0" version="3.4.0" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rbs-3.4.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">3dacf56b91c1dc3845fa199b7e6eb883a4aa0090dcf1a348b2d621bea83b0e99</sum>
        </package>
        <package name="rubygem-rdoc" arch="noarch" epoch="0" version="6.6.3.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rdoc-6.6.3.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">656cedbc171c0d9924948b15bb319b8220c71e29a74a040d6f4a4f1b3358dde0</sum>
        </package>
        <package name="rubygem-rexml" arch="noarch" epoch="0" version="3.3.9" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rexml-3.3.9-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">f63afbc11ae33c3c780e6b46f2f7274c2ef874656cfb4633779181a508e8cf9a</sum>
        </package>
        <package name="rubygem-rss" arch="noarch" epoch="0" version="0.3.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-rss-0.3.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">312bb55e83f14b500d7a0e5c911f8745d5b5d06a3fcd847fb314c943deb18d1a</sum>
        </package>
        <package name="rubygems" arch="noarch" epoch="0" version="3.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygems-3.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">bb066d3068ce2da7cefc8f9f89d01e223d2870bd4a509e0aad5ebf7432a860be</sum>
        </package>
        <package name="rubygems-devel" arch="noarch" epoch="0" version="3.5.22" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygems-devel-3.5.22-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">d44c057b948919daf238b6b1463d7b1c47c91420a539346ccc8436b77387b527</sum>
        </package>
        <package name="rubygem-test-unit" arch="noarch" epoch="0" version="3.6.1" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-test-unit-3.6.1-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">cde1cbfe9e860af0cd849fb742cffa0fe5128ceb80f93497b3f8571fa0752517</sum>
        </package>
        <package name="rubygem-typeprof" arch="noarch" epoch="0" version="0.21.9" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>rubygem-typeprof-0.21.9-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">79fec13dace5e8b27fabccda2bf8904f5279779a88b3a67a4c156db8c03003da</sum>
        </package>
        <package name="ruby-libs" arch="aarch64" epoch="0" version="3.3.8" release="10.el10_0" src="ruby-3.3.8-10.el10_0.src.rpm">
          <filename>ruby-libs-3.3.8-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">3047cd6bffc21c866379fba799f8f0bd24ffc831039a01e7ed0947910385a96a</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8135</id>
    <title>Important: python-tornado security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for python-tornado.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.

Security Fix(es):

* tornado: Tornado Multipart Form-Data Denial of Service (CVE-2025-47287)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47287" id="CVE-2025-47287" type="cve" title="CVE-2025-47287" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366703" id="2366703" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8135" id="RLSA-2025:8135" type="self" title="RLSA-2025:8135" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-tornado" arch="aarch64" epoch="0" version="6.4.2" release="1.el10_0.1" src="python-tornado-6.4.2-1.el10_0.1.src.rpm">
          <filename>python3-tornado-6.4.2-1.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">538bbb2e6525be224cddd28de4ceb6eff51e66d269930101e0357fa4b817e685</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8184</id>
    <title>Important: gstreamer1-plugins-bad-free security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for gstreamer1-plugins-bad-free.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.

Security Fix(es):

* GStreamer: GStreamer H265 Codec Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVE-2025-3887)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3887" id="CVE-2025-3887" type="cve" title="CVE-2025-3887" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367919" id="2367919" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8184" id="RLSA-2025:8184" type="self" title="RLSA-2025:8184" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gstreamer1-plugins-bad-free" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_0" src="gstreamer1-plugins-bad-free-1.24.11-2.el10_0.src.rpm">
          <filename>gstreamer1-plugins-bad-free-1.24.11-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ea858f7ba32aa49adbc5155a4d39ec83ffac617993353e1827e808f2efae35c0</sum>
        </package>
        <package name="gstreamer1-plugins-bad-free-libs" arch="aarch64" epoch="0" version="1.24.11" release="2.el10_0" src="gstreamer1-plugins-bad-free-1.24.11-2.el10_0.src.rpm">
          <filename>gstreamer1-plugins-bad-free-libs-1.24.11-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c7c845023a336b83e6539eb532da647615b8d14e42e484fa394af342a4f95b74</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8196</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:05" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: JavaScript Execution via Spoofed PDF Attachment and file:/// Link (CVE-2025-3909)

* thunderbird: Sender Spoofing via Malformed From Header in Thunderbird (CVE-2025-3875)

* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-3877)

* thunderbird: Tracking Links in Attachments Bypassed Remote Content Blocking (CVE-2025-3932)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3875" id="CVE-2025-3875" type="cve" title="CVE-2025-3875" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3877" id="CVE-2025-3877" type="cve" title="CVE-2025-3877" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3909" id="CVE-2025-3909" type="cve" title="CVE-2025-3909" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3932" id="CVE-2025-3932" type="cve" title="CVE-2025-3932" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366283" id="2366283" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366287" id="2366287" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366291" id="2366291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366297" id="2366297" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8196" id="RLSA-2025:8196" type="self" title="RLSA-2025:8196" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="128.10.1" release="1.el10_0" src="thunderbird-128.10.1-1.el10_0.src.rpm">
          <filename>thunderbird-128.10.1-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f815272496337abb938f0df455da55cfe7bc88cdc4da3dfaa23a6ecd8a1afefc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8341</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)

* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

* firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)

* firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263" id="CVE-2025-5263" type="cve" title="CVE-2025-5263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264" id="CVE-2025-5264" type="cve" title="CVE-2025-5264" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266" id="CVE-2025-5266" type="cve" title="CVE-2025-5266" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267" id="CVE-2025-5267" type="cve" title="CVE-2025-5267" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268" id="CVE-2025-5268" type="cve" title="CVE-2025-5268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269" id="CVE-2025-5269" type="cve" title="CVE-2025-5269" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368750" id="2368750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368751" id="2368751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368752" id="2368752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368755" id="2368755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368756" id="2368756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368757" id="2368757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8341" id="RLSA-2025:8341" type="self" title="RLSA-2025:8341" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="128.11.0" release="1.el10_0" src="firefox-128.11.0-1.el10_0.src.rpm">
          <filename>firefox-128.11.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8e7fe33789bef842b37ee3f95c92f8e2d2cbd20ae889937252b72cb534c2da16</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8477</id>
    <title>Moderate: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8477" id="RLSA-2025:8477" type="self" title="RLSA-2025:8477" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-tests-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">3215e7950d792a9a14b68b16cc720ae61ec83fe3b50223d9fb441bcaee76e7c9</sum>
        </package>
        <package name="golang" arch="aarch64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-1.23.9-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">214838533d4f16dde82db9015e0f3216204774391b9797b3a3462f49b946cf39</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-bin-1.23.9-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">91feafb36fcf948cef64bc503232bd950c8f473fc6bc0e2d0c1b214adbcdf330</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-docs-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">bdd2760b73c9324ad1b4499a8f0ac93db56f828057b077941bb8e625050d26a7</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-misc-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">69b802400d4176e7bad9d0c1f1b5d73e5b76c67b3e976c8e150d266ce45a7ced</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>golang-src-1.23.9-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">431c56db3fafa2e52ebeaf24f7722efd266be7ac65dfbb6ce76ec106d22711b8</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.23.9" release="1.el10_0" src="golang-1.23.9-1.el10_0.src.rpm">
          <filename>go-toolset-1.23.9-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e65cd9c4219c6766f8b4fe11ba111569622f1fb0f90aeb39a49555422bdc6711</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8493</id>
    <title>Important: nodejs22 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for nodejs22.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices.

Security Fix(es):

* nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js (CVE-2025-23166)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23165" id="CVE-2025-23165" type="cve" title="CVE-2025-23165" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23166" id="CVE-2025-23166" type="cve" title="CVE-2025-23166" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367162" id="2367162" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367163" id="2367163" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8493" id="RLSA-2025:8493" type="self" title="RLSA-2025:8493" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="nodejs" arch="aarch64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-22.16.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e068aebe64784517741581d5b515d18c091a928cab1cda91e1b1f21ea09ae36c</sum>
        </package>
        <package name="nodejs-devel" arch="aarch64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-devel-22.16.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1180e50876c81caae1d254c96892c864f4f31d11eace6361831385b04cd98cde</sum>
        </package>
        <package name="nodejs-docs" arch="noarch" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-docs-22.16.0-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f120d25fe9ff48ab63fa1691b7c726ce10a6aea9d36e5fd8d312b8da1618d995</sum>
        </package>
        <package name="nodejs-full-i18n" arch="aarch64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-full-i18n-22.16.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">226925b681748d46ec02b52fa9212bf70de0fe8aab5585ab75af2b263c990728</sum>
        </package>
        <package name="nodejs-libs" arch="aarch64" epoch="1" version="22.16.0" release="1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-libs-22.16.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d0c8c67f783a6a601e217e9decf3078c616518b86db8f9a9de73f2c6a1395ab6</sum>
        </package>
        <package name="nodejs-npm" arch="aarch64" epoch="1" version="10.9.2" release="1.22.16.0.1.el10_0" src="nodejs22-22.16.0-1.el10_0.src.rpm">
          <filename>nodejs-npm-10.9.2-1.22.16.0.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ccc316b8739541fd7e2f29208446bfd4e6ef812a5c9f8ba3ec1f45ecfa8f0832</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8550</id>
    <title>Important: varnish security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for varnish.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Varnish Cache is a high-performance HTTP accelerator. It stores web pages in memory so web servers don't have to create the same web page over and over again, giving the website a significant speed up.

Security Fix(es):

* varnish: request smuggling attacks (CVE-2025-47905)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47905" id="CVE-2025-47905" type="cve" title="CVE-2025-47905" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364235" id="2364235" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8550" id="RLSA-2025:8550" type="self" title="RLSA-2025:8550" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="varnish" arch="aarch64" epoch="0" version="7.6.1" release="2.el10_0.1" src="varnish-7.6.1-2.el10_0.1.src.rpm">
          <filename>varnish-7.6.1-2.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">a028f0a346651208b2faa4658432d1da990580575c55ee4b00b08a9d30a34df3</sum>
        </package>
        <package name="varnish-docs" arch="aarch64" epoch="0" version="7.6.1" release="2.el10_0.1" src="varnish-7.6.1-2.el10_0.1.src.rpm">
          <filename>varnish-docs-7.6.1-2.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">6d9691835d72bc337ccde1a986c97c4afefbc84bbfa7e2a388717d01deea4dd0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8608</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Out-of-bounds access when resolving Promise objects (CVE-2025-4918)

* firefox: thunderbird: Out-of-bounds access when optimizing linear sums (CVE-2025-4919)

* firefox: thunderbird: Clickjacking vulnerability could have led to leaking saved payment card details (CVE-2025-5267)

* firefox: thunderbird: Potential local code execution in ?Copy as cURL? command (CVE-2025-5264)

* firefox: thunderbird: Memory safety bugs (CVE-2025-5268)

* firefox: thunderbird: Script element events leaked cross-origin resource status (CVE-2025-5266)

* firefox: thunderbird: Error handling for script execution was incorrectly isolated from web content (CVE-2025-5263)

* firefox: thunderbird: Memory safety bug (CVE-2025-5269)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4918" id="CVE-2025-4918" type="cve" title="CVE-2025-4918" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4919" id="CVE-2025-4919" type="cve" title="CVE-2025-4919" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5263" id="CVE-2025-5263" type="cve" title="CVE-2025-5263" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5264" id="CVE-2025-5264" type="cve" title="CVE-2025-5264" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5266" id="CVE-2025-5266" type="cve" title="CVE-2025-5266" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5267" id="CVE-2025-5267" type="cve" title="CVE-2025-5267" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5268" id="CVE-2025-5268" type="cve" title="CVE-2025-5268" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5269" id="CVE-2025-5269" type="cve" title="CVE-2025-5269" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367016" id="2367016" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367018" id="2367018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368750" id="2368750" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368751" id="2368751" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368752" id="2368752" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368755" id="2368755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368756" id="2368756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368757" id="2368757" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8608" id="RLSA-2025:8608" type="self" title="RLSA-2025:8608" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="128.11.0" release="1.el10_0" src="thunderbird-128.11.0-1.el10_0.src.rpm">
          <filename>thunderbird-128.11.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ca9894e6e7a37f80729f5ef86110f5d4cd2244d8fe45d058b510bb054cfb5025</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8636</id>
    <title>Important: perl-FCGI security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for perl-FCGI.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FastCGI Perl bindings.

Security Fix(es):

* perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library (CVE-2025-40907)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40907" id="CVE-2025-40907" type="cve" title="CVE-2025-40907" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2366847" id="2366847" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8636" id="RLSA-2025:8636" type="self" title="RLSA-2025:8636" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl-FCGI" arch="aarch64" epoch="1" version="0.82" release="13.1.el10_0" src="perl-FCGI-0.82-13.1.el10_0.src.rpm">
          <filename>perl-FCGI-0.82-13.1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">12d4b7f294a54818bbc71f823841d9c8d230b3bf3deca7437593aa7282f8f657</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8666</id>
    <title>Moderate: grafana security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB &amp; OpenTSDB. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8666" id="RLSA-2025:8666" type="self" title="RLSA-2025:8666" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana" arch="aarch64" epoch="0" version="10.2.6" release="18.el10_0" src="grafana-10.2.6-18.el10_0.src.rpm">
          <filename>grafana-10.2.6-18.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5ec6d797e4092fcdab3e79b666dc711343b6497a2e89a48013882a864f0a02dd</sum>
        </package>
        <package name="grafana-selinux" arch="aarch64" epoch="0" version="10.2.6" release="18.el10_0" src="grafana-10.2.6-18.el10_0.src.rpm">
          <filename>grafana-selinux-10.2.6-18.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2da1fdd10c9127a03da7ade8081f0563a564e4c287b632329784165c1f7f7041</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8814</id>
    <title>Important: .NET 8.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet8.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es):

* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30399" id="CVE-2025-30399" type="cve" title="CVE-2025-30399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369701" id="2369701" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8814" id="RLSA-2025:8814" type="self" title="RLSA-2025:8814" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ea11a7a3f4a3fcd5bd59ef04fc54cd0de54ef46e3e9cd83d380f71365ce4e5ec</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">dea386f1a9c079a35f44afeffba18314219c473656109b67a8963ed7e7911090</sum>
        </package>
        <package name="aspnetcore-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2165259f409c299009037623e1a19261086c7de52eaff437e7034555d1101b6d</sum>
        </package>
        <package name="dotnet-apphost-pack-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">289fbba0c6437cfa0c72da69b10715978f2c858bb0fb2cc2d73862c86302179e</sum>
        </package>
        <package name="dotnet-hostfxr-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">554776cb7ca5ed84350bb0cc3f94813ea7d849ed58706568e073b64975c31a6b</sum>
        </package>
        <package name="dotnet-runtime-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-runtime-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c1de70c25acc557e578796c17818a825eaf3116192c151788c2d79eb68bbdee1</sum>
        </package>
        <package name="dotnet-runtime-dbg-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e0592311bdbca2501406e40dc4779e13277907ba2b45ba3720ebbbf2428122ae</sum>
        </package>
        <package name="dotnet-sdk-8.0" arch="aarch64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-sdk-8.0-8.0.117-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">83cf0c847c33f029b03edf2c92d947cf041ff80f0aa8d0f4de1f57eeda4be212</sum>
        </package>
        <package name="dotnet-sdk-dbg-8.0" arch="aarch64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-8.0-8.0.117-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d95a300c0bc82396be2ae2a4a7b21c8f3a7def7365518363a6c07819c4d61d64</sum>
        </package>
        <package name="dotnet-targeting-pack-8.0" arch="aarch64" epoch="0" version="8.0.17" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-8.0-8.0.17-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">dc39173f2eefe868dd6c78070f707edcc9f82a18947b9029c0c8c31615b0235b</sum>
        </package>
        <package name="dotnet-templates-8.0" arch="aarch64" epoch="0" version="8.0.117" release="1.el10_0" src="dotnet8.0-8.0.117-1.el10_0.src.rpm">
          <filename>dotnet-templates-8.0-8.0.117-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0a301971876eb27381dccdfa7dc0cf845646e8603097e2261cdd429e8efe8f84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8816</id>
    <title>Important: .NET 9.0 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:06" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for dotnet9.0.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.

New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es):

* dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30399" id="CVE-2025-30399" type="cve" title="CVE-2025-30399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369701" id="2369701" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8816" id="RLSA-2025:8816" type="self" title="RLSA-2025:8816" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aspnetcore-runtime-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2630d01a35da7ba52379e8230c411cfb1f07b2bce382347874809ae4464215aa</sum>
        </package>
        <package name="aspnetcore-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-runtime-dbg-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e2d6cfd177af9ea959b3b32ca531c9f71a8d4dec482d22d83713555f12084f66</sum>
        </package>
        <package name="aspnetcore-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>aspnetcore-targeting-pack-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1ad5a8eb2e743e4b82671307457540cd5c597f5e7114d883d76e2819ece742a5</sum>
        </package>
        <package name="dotnet-apphost-pack-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-apphost-pack-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">11d65f15b3c76e6ce1f48b7bef71c4ab2632a1f269591ea19f64692fd6cf8fd5</sum>
        </package>
        <package name="dotnet-host" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-host-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">aeeb037fcdfa1e767682aeb714fae10fc53b9482deb3d85aa6cab7e1862f5199</sum>
        </package>
        <package name="dotnet-hostfxr-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-hostfxr-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f84f6acbb39aab92de7fb6088678bd764d277b75b9906c41d38b0f6949b92747</sum>
        </package>
        <package name="dotnet-runtime-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-runtime-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9a3c749d2174e236b0a6aa34a8bb3dcfe5443e4a7c9b362c6bde85b6c6119350</sum>
        </package>
        <package name="dotnet-runtime-dbg-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-runtime-dbg-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">fc5a1e7e9dd4315b88311fb76f256e496237c7f76d343f139f9564db95c75bd2</sum>
        </package>
        <package name="dotnet-sdk-9.0" arch="aarch64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-9.0-9.0.107-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2319013c3d69dfd9dec9577e661049fda94b82ce6450a7e9987980d772b5598e</sum>
        </package>
        <package name="dotnet-sdk-aot-9.0" arch="aarch64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-aot-9.0-9.0.107-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">010267412220c6204331e5a0af5d36e295f79facfd020ba2377e5fc7d31f68cd</sum>
        </package>
        <package name="dotnet-sdk-dbg-9.0" arch="aarch64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-sdk-dbg-9.0-9.0.107-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">680f8cc407143b14fcb3124b96c65e01e9927e122bc3504013c140ea42751e61</sum>
        </package>
        <package name="dotnet-targeting-pack-9.0" arch="aarch64" epoch="0" version="9.0.6" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-targeting-pack-9.0-9.0.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4fdc067534349619343583196e0970840d6e172d5d0fa8584cd1b95bbd291249</sum>
        </package>
        <package name="dotnet-templates-9.0" arch="aarch64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>dotnet-templates-9.0-9.0.107-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">34cfad8620e035ea0acde05502b86087048c73d18252a3874c9c17e960c2ad9d</sum>
        </package>
        <package name="netstandard-targeting-pack-2.1" arch="aarch64" epoch="0" version="9.0.107" release="1.el10_0" src="dotnet9.0-9.0.107-1.el10_0.src.rpm">
          <filename>netstandard-targeting-pack-2.1-9.0.107-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0bc48992f5bcd7245e7a5aa2d25e1450ee94458ecc0353074a01a026d123d446</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:8915</id>
    <title>Moderate: grafana-pcp security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for grafana-pcp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:8915" id="RLSA-2025:8915" type="self" title="RLSA-2025:8915" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="grafana-pcp" arch="aarch64" epoch="0" version="5.2.2" release="3.el10_0" src="grafana-pcp-5.2.2-3.el10_0.src.rpm">
          <filename>grafana-pcp-5.2.2-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9803453c5afe2511b26a2621a2a8708d574d816ef21f3c6ad065b835a215262c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9063</id>
    <title>Moderate: git-lfs security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for git-lfs.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9063" id="RLSA-2025:9063" type="self" title="RLSA-2025:9063" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="git-lfs" arch="aarch64" epoch="0" version="3.6.1" release="2.el10_0" src="git-lfs-3.6.1-2.el10_0.src.rpm">
          <filename>git-lfs-3.6.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">02b07fa85180b39d0e95119b5a67b7c5ff1d84e91778ac135ea9678b2cc4f073</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9120</id>
    <title>Important: libvpx security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libvpx.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libvpx packages provide the VP8 SDK, which allows the encoding and decoding of the VP8 video codec, commonly used with the WebM multimedia container file format.

Security Fix(es):

* libvpx: Double-free in libvpx encoder (CVE-2025-5283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5283" id="CVE-2025-5283" type="cve" title="CVE-2025-5283" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2368749" id="2368749" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9120" id="RLSA-2025:9120" type="self" title="RLSA-2025:9120" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libvpx" arch="aarch64" epoch="0" version="1.14.1" release="3.el10_0" src="libvpx-1.14.1-3.el10_0.src.rpm">
          <filename>libvpx-1.14.1-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">afdf5a1c581eab2548015dc04b09175d0e5262d9e4e2049edff71cf16757544b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9121</id>
    <title>Moderate: wireshark security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for wireshark.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network.

Security Fix(es):

* wireshark: Uncontrolled Recursion in Wireshark (CVE-2025-1492)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-1492" id="CVE-2025-1492" type="cve" title="CVE-2025-1492" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2346737" id="2346737" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9121" id="RLSA-2025:9121" type="self" title="RLSA-2025:9121" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="wireshark" arch="aarch64" epoch="1" version="4.4.2" release="3.el10_0" src="wireshark-4.4.2-3.el10_0.src.rpm">
          <filename>wireshark-4.4.2-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e3287fe24e29fa3e753576227ffdb3763350584e02ab5bf74508d478c9258c8f</sum>
        </package>
        <package name="wireshark-cli" arch="aarch64" epoch="1" version="4.4.2" release="3.el10_0" src="wireshark-4.4.2-3.el10_0.src.rpm">
          <filename>wireshark-cli-4.4.2-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b61d3af66853fc5430c98411fc44aaad4fc9cfa7c34af11e9e391b05832fff52</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9148</id>
    <title>Moderate: buildah security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for buildah.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9148" id="RLSA-2025:9148" type="self" title="RLSA-2025:9148" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="buildah" arch="aarch64" epoch="2" version="1.39.4" release="2.el10_0" src="buildah-1.39.4-2.el10_0.src.rpm">
          <filename>buildah-1.39.4-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a6c7341e5bb916800458e7d3c2047b0161055e8171dce1ad6dd588ad7557b756</sum>
        </package>
        <package name="buildah-tests" arch="aarch64" epoch="2" version="1.39.4" release="2.el10_0" src="buildah-1.39.4-2.el10_0.src.rpm">
          <filename>buildah-tests-1.39.4-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4754030f20380a92032fca0c36bdbcf0b673bae8ce0bcdf7802d396586522bb1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9146</id>
    <title>Moderate: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9146" id="RLSA-2025:9146" type="self" title="RLSA-2025:9146" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman" arch="aarch64" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-5.4.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">82c1499b97b5518e72e5ae7a6eb93abd349a6e9f04c1b541527fd8fedf2fc2e1</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-10.el10_0.noarch.rpm</filename>
          <sum type="sha256">72ee4b59f086d755726270ee648923634a2c7363eaecb7668975444143214d9f</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="6" version="5.4.0" release="10.el10_0" src="podman-5.4.0-10.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-10.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6c13d2e086bc8c5d0c4e19d4bd81fe1f2888f04aaf232313571daa638c9ed931</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9149</id>
    <title>Moderate: skopeo security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for skopeo.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The skopeo command lets you inspect images from container image registries, get images and image layers, and use signatures to create and verify files. 

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9149" id="RLSA-2025:9149" type="self" title="RLSA-2025:9149" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="skopeo" arch="aarch64" epoch="2" version="1.18.1" release="2.el10_0" src="skopeo-1.18.1-2.el10_0.src.rpm">
          <filename>skopeo-1.18.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">564c3950698964f67cb49eb14983c5a598e057dd71db24462476fb01a72a5cae</sum>
        </package>
        <package name="skopeo-tests" arch="aarch64" epoch="2" version="1.18.1" release="2.el10_0" src="skopeo-1.18.1-2.el10_0.src.rpm">
          <filename>skopeo-tests-1.18.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">bee5889d3b1d0840fe21bfdba72530beaf93bc8191b6e1a041185440e8f55226</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9151</id>
    <title>Moderate: gvisor-tap-vsock security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gvisor-tap-vsock.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>A replacement for libslirp and VPNKit, written in pure Go. It is based on the network stack of gVisor. Compared to libslirp, gvisor-tap-vsock brings a configurable DNS server and dynamic port forwarding.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9151" id="RLSA-2025:9151" type="self" title="RLSA-2025:9151" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gvisor-tap-vsock" arch="aarch64" epoch="6" version="0.8.5" release="2.el10_0" src="gvisor-tap-vsock-0.8.5-2.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-0.8.5-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c8222f0577fc11cbb5371c9573d381a1dec9035025086ffdacd3eddd2692623a</sum>
        </package>
        <package name="gvisor-tap-vsock-gvforwarder" arch="aarch64" epoch="6" version="0.8.5" release="2.el10_0" src="gvisor-tap-vsock-0.8.5-2.el10_0.src.rpm">
          <filename>gvisor-tap-vsock-gvforwarder-0.8.5-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1f588cef07960d0ece8fb708bfe0dd68c5e4bfe020ed31500a69481dae746013</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9156</id>
    <title>Moderate: golang-github-openprinting-ipp-usb security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang-github-openprinting-ipp-usb.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables
 driverless support for USB devices capable of using IPP-over-USB protocol.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9156" id="RLSA-2025:9156" type="self" title="RLSA-2025:9156" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipp-usb" arch="aarch64" epoch="0" version="0.9.27" release="3.el10_0" src="golang-github-openprinting-ipp-usb-0.9.27-3.el10_0.src.rpm">
          <filename>ipp-usb-0.9.27-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">56f06cdff6a16f3c9e852cfbd0ac13ad5fa6bc0701da418313a6e57d76e2fc19</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9190</id>
    <title>Important: ipa security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:07" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for ipa.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Rocky Enterprise Software Foundation Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments.

Security Fix(es):

* freeIPA: idm: Privilege escalation from host to domain admin in FreeIPA (CVE-2025-4404)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4404" id="CVE-2025-4404" type="cve" title="CVE-2025-4404" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2364606" id="2364606" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9190" id="RLSA-2025:9190" type="self" title="RLSA-2025:9190" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="ipa-client" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-4.12.2-15.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">f87ad8d36d73036e1000f63cfcb8a56dd50d4db79d93b2a40c00537e8262a4f9</sum>
        </package>
        <package name="ipa-client-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">6c1ae01a5131f824bf97c644496f68706f567b22085c430ca56bc03afb053207</sum>
        </package>
        <package name="ipa-client-encrypted-dns" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-encrypted-dns-4.12.2-15.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">1ebbfa8917c083a341b7d4d7d1262bf82c3116315fc634ef776f6615f7c88c07</sum>
        </package>
        <package name="ipa-client-epn" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-epn-4.12.2-15.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">70aad74c1bbc3bbeb89369dae460695c79f2bce35a5aa385cd6201f86363fd05</sum>
        </package>
        <package name="ipa-client-samba" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-client-samba-4.12.2-15.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">6caa0f3d3f2dd5ccd682796100b71dc6173ced18cf266dbe3885197c26365f09</sum>
        </package>
        <package name="ipa-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">bd4658263915b86e0754a48dfef208eb3a06aeacef66b87e1e3e413c2c0d9423</sum>
        </package>
        <package name="ipa-selinux" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">9392af39d79b05f3d3584c5e2f8defe0aa763b7c26df19606b6ae69882e9d7f4</sum>
        </package>
        <package name="ipa-selinux-luna" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-luna-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">862cf3612971baf244e116d8f0860b18b99683e48e3a976f62be514c9e5ebe81</sum>
        </package>
        <package name="ipa-selinux-nfast" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-selinux-nfast-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">da232069356f6a7fed12c9b12c17d4e08adda805fbe718e9ffe83ce286498881</sum>
        </package>
        <package name="ipa-server" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-4.12.2-15.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">2ba31e8249e9721a80c0a627f6cd09b3d64c952079650a657a8f5f501d5347fa</sum>
        </package>
        <package name="ipa-server-common" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-common-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">89236fce67fe052cb19173070c2f50c2b514b865567328686e46a6f845ab302c</sum>
        </package>
        <package name="ipa-server-dns" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-dns-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">7303e5d8311880f7cae2058f4ed51096749cd5afa1d58e4303823207aefcfce4</sum>
        </package>
        <package name="ipa-server-encrypted-dns" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-encrypted-dns-4.12.2-15.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">660d24b6811b0e46280503eff197ca97d7072162d2691827d0a377335ff22039</sum>
        </package>
        <package name="ipa-server-trust-ad" arch="aarch64" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>ipa-server-trust-ad-4.12.2-15.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">7431ee688906310eaa0c3762b4f6de1edfafb3175e059d010b302a9e8b121476</sum>
        </package>
        <package name="python3-ipaclient" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipaclient-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">3acf20126fa2ebd03bd719db4b3fdee63e40f34cfc4a805cca9042354485004c</sum>
        </package>
        <package name="python3-ipalib" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipalib-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">8296ccacd4fbd8cea4f94f0f3442e6dac1ef32e62d3c197cdfe69cdb6876b69b</sum>
        </package>
        <package name="python3-ipaserver" arch="noarch" epoch="0" version="4.12.2" release="15.el10_0.1" src="ipa-4.12.2-15.el10_0.1.src.rpm">
          <filename>python3-ipaserver-4.12.2-15.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">9c5d1580ae5902f184e00a231e6482c31dcb76da4b9d3d4feaea0d772ff7bbd7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9304</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for xorg-x11-server-Xwayland.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Xwayland is an X server for running X clients under Wayland.

Security Fix(es):

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors (CVE-2025-49175)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension (CVE-2025-49176)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode (CVE-2025-49177)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore (CVE-2025-49178)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension (CVE-2025-49179)

* xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension (CVE-2025-49180)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49175" id="CVE-2025-49175" type="cve" title="CVE-2025-49175" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49176" id="CVE-2025-49176" type="cve" title="CVE-2025-49176" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49177" id="CVE-2025-49177" type="cve" title="CVE-2025-49177" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49178" id="CVE-2025-49178" type="cve" title="CVE-2025-49178" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49179" id="CVE-2025-49179" type="cve" title="CVE-2025-49179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49180" id="CVE-2025-49180" type="cve" title="CVE-2025-49180" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369947" id="2369947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369954" id="2369954" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369955" id="2369955" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369977" id="2369977" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369978" id="2369978" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369981" id="2369981" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9304" id="RLSA-2025:9304" type="self" title="RLSA-2025:9304" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="xorg-x11-server-Xwayland" arch="aarch64" epoch="0" version="24.1.5" release="4.el10_0" src="xorg-x11-server-Xwayland-24.1.5-4.el10_0.src.rpm">
          <filename>xorg-x11-server-Xwayland-24.1.5-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ab5708c0db650688c39fe888a672b3fc749b62eef6a3dbf80c291eff86aa1a1c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9317</id>
    <title>Moderate: delve security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for delve.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. With that in mind, Delve should stay out of your way as much as possible.

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9317" id="RLSA-2025:9317" type="self" title="RLSA-2025:9317" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="delve" arch="aarch64" epoch="0" version="1.24.1" release="2.el10_0" src="delve-1.24.1-2.el10_0.src.rpm">
          <filename>delve-1.24.1-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">fbb44109671e3b8dc12519ae2492ac307c7cd4aabf06103531793422799c8467</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9307</id>
    <title>Moderate: freerdp security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for freerdp.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.

Security Fix(es):

* gnome-remote-desktop: freerdp: Unauthenticated RDP Packet Causes Segfault in FreeRDP Leading to Denial of Service (CVE-2025-4478)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4478" id="CVE-2025-4478" type="cve" title="CVE-2025-4478" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2365232" id="2365232" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9307" id="RLSA-2025:9307" type="self" title="RLSA-2025:9307" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="freerdp" arch="aarch64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>freerdp-3.10.3-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">bc3e15be3f4660526401034582822c7e5aa4e015b35a7c0c2f8e901423e8f828</sum>
        </package>
        <package name="freerdp-libs" arch="aarch64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>freerdp-libs-3.10.3-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4b94793f1cf0c4d0a2b9ab4ab885ed40624a4a8ba2e897a48f720ec9706ff8e3</sum>
        </package>
        <package name="libwinpr" arch="aarch64" epoch="2" version="3.10.3" release="3.el10_0" src="freerdp-3.10.3-3.el10_0.src.rpm">
          <filename>libwinpr-3.10.3-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e69a660618cf68be3b40ff89463868ec49575199a9d3d2700ab5c14a953f20b7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9328</id>
    <title>Important: libblockdev security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for libblockdev.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libblockdev packages provide a C library with GObject introspection support used for low-level operations on block devices. The library serves as a thin wrapper around plug-ins for specific functionality, such as LVM, Btrfs, LUKS, or MD RAID.

Security Fix(es):

* libblockdev: LPE from allow_active to root in libblockdev via udisks (CVE-2025-6019)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6019" id="CVE-2025-6019" type="cve" title="CVE-2025-6019" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2370051" id="2370051" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9328" id="RLSA-2025:9328" type="self" title="RLSA-2025:9328" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libblockdev" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c3d776f908ebc2dba71dba1781c382b5e946ab7fdbe09d305b57634cff770c10</sum>
        </package>
        <package name="libblockdev-crypto" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-crypto-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">abb72cd41e687dcf19231646cae5b88ad5862119df03dcf751c8b0f690f9cee2</sum>
        </package>
        <package name="libblockdev-dm" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-dm-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">da1942a432abbab9b588db736276f7635ee8a49249f2429e11630c1cdecfee9e</sum>
        </package>
        <package name="libblockdev-fs" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-fs-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a32268d30147949e0be26cda4397bea7aea2e55098c2f3a2c278b35e1065d5fa</sum>
        </package>
        <package name="libblockdev-loop" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-loop-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a7d6b0cae146bc1d426fdee4455bb322365744a3e599f66598c3a48a7ecc6d44</sum>
        </package>
        <package name="libblockdev-lvm" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-lvm-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">90f6c31ddbb4ed65832d878963030d5ceccdb0001bdcea16d2059b5d09d82a65</sum>
        </package>
        <package name="libblockdev-lvm-dbus" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-lvm-dbus-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">62ae6eb50c415016f24b5e017384854ca939e682c679af958380f6fb795cb772</sum>
        </package>
        <package name="libblockdev-mdraid" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-mdraid-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7c84153a33ffdb1c624fa7056b831cfeeaae5b8814e4660352c2a61b6b3eab76</sum>
        </package>
        <package name="libblockdev-mpath" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-mpath-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c74e745b5ce9136c7e8c2e4e3ec8ad7db50dd77b45e116b62c668677709d608f</sum>
        </package>
        <package name="libblockdev-nvdimm" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-nvdimm-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">85400b62388d1f6a7419963198ab32aaafafabad595a0f1836f89a2fbe18da44</sum>
        </package>
        <package name="libblockdev-nvme" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-nvme-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">ee9355921916a47355b9148ad8ccb9ad3ceb7aa29671b56a8c7ff3d2cf3a342e</sum>
        </package>
        <package name="libblockdev-part" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-part-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e43678f42ad500e2be7f4e88e9ad15c8588e11e69d83585ec7e681b6f428db69</sum>
        </package>
        <package name="libblockdev-plugins-all" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-plugins-all-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0e2b8af5dc7266fab04b83b93f7687cf81af142ce5ef3652fddabd8228cffea2</sum>
        </package>
        <package name="libblockdev-smart" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-smart-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8ce98f718db2c7240dce07d89d5899c2cc2c5b73cd56c8d15461280b9e3aee5a</sum>
        </package>
        <package name="libblockdev-smartmontools" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-smartmontools-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1f75e57154a087287eddb4092b464fffde9a9d4498327adaa1fe7979b66ebc3b</sum>
        </package>
        <package name="libblockdev-swap" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-swap-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">26678e6b11c2678750858b18ea322f91cd8b5b7674d87de36ea7e3b3bfa2dabb</sum>
        </package>
        <package name="libblockdev-tools" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-tools-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6c349faa5f35d23f4878eea30403afaf8b35686009375146fba6bdb9979c1b46</sum>
        </package>
        <package name="libblockdev-utils" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>libblockdev-utils-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8c14cca3c13d2d285d232ab3ee375d201afea7925350e52f91dc166d41b9bced</sum>
        </package>
        <package name="python3-blockdev" arch="aarch64" epoch="0" version="3.2.0" release="4.el10_0" src="libblockdev-3.2.0-4.el10_0.src.rpm">
          <filename>python3-blockdev-3.2.0-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">07ee873e954c6fc433fffae39c09a7615cca3d6ff586b0fac3258ca81187b3d8</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9466</id>
    <title>Moderate: mod_proxy_cluster security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_proxy_cluster.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_proxy_cluster module is a plugin for the Apache HTTP Server that provides load-balancer functionality.

Security Fix(es):

* mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests (CVE-2024-10306)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-10306" id="CVE-2024-10306" type="cve" title="CVE-2024-10306" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2321302" id="2321302" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9466" id="RLSA-2025:9466" type="self" title="RLSA-2025:9466" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_proxy_cluster" arch="aarch64" epoch="0" version="1.3.22" release="1.el10_0.2" src="mod_proxy_cluster-1.3.22-1.el10_0.2.src.rpm">
          <filename>mod_proxy_cluster-1.3.22-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">f98cabb7ed902267b4c42ff0b284957b492984a35684ff2bede485bea840ba57</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:9486</id>
    <title>Moderate: qt6-qtbase security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for qt6-qtbase.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Qt is a software toolkit for developing applications.  This package contains base tools, like string, xml, and network handling.

Security Fix(es):

* qt5: qt6: QtCore Assertion Failure Denial of Service (CVE-2025-5455)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5455" id="CVE-2025-5455" type="cve" title="CVE-2025-5455" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369722" id="2369722" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:9486" id="RLSA-2025:9486" type="self" title="RLSA-2025:9486" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="qt6-qtbase" arch="aarch64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-6.8.1-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">95d6015c0ea514bfa8d5f8711af4dc2beeeb6a41010618467db925e5b444ee0b</sum>
        </package>
        <package name="qt6-qtbase-common" arch="noarch" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-common-6.8.1-9.el10_0.noarch.rpm</filename>
          <sum type="sha256">1cb71dc28df65692eeb4c2716a3648f044980fa7291152664beaccd2b7f5185e</sum>
        </package>
        <package name="qt6-qtbase-devel" arch="aarch64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-devel-6.8.1-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8349d53861d311281d0a8ebf7cf510cb69e5db72f67e5949a705978e60c89931</sum>
        </package>
        <package name="qt6-qtbase-gui" arch="aarch64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-gui-6.8.1-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6b253de0506015aa884307280198e1cac7650238f7448c22d6d1b8a41470e989</sum>
        </package>
        <package name="qt6-qtbase-mysql" arch="aarch64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-mysql-6.8.1-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c1be7acb70544d4fb345034ede6d0607411032061b32ca61b910a6e6999bca06</sum>
        </package>
        <package name="qt6-qtbase-odbc" arch="aarch64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-odbc-6.8.1-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">77d9b789229ea721a392abeb8080ea829431cfcd8707968feb9a56ab0ea63626</sum>
        </package>
        <package name="qt6-qtbase-postgresql" arch="aarch64" epoch="0" version="6.8.1" release="9.el10_0" src="qt6-qtbase-6.8.1-9.el10_0.src.rpm">
          <filename>qt6-qtbase-postgresql-6.8.1-9.el10_0.aarch64.rpm</filename>
          <sum type="sha256">de7377b705467535876b141f243c930ca55c0ebe8857b1d95c5ea16cd59fb575</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10073</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:08" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Content-Disposition header ignored when a file is included in an embed or object tag (CVE-2025-6430)

* firefox: Use-after-free in FontFaceSet (CVE-2025-6424)

* firefox: Incorrect parsing of URLs could have allowed embedding of youtube.com (CVE-2025-6429)

* firefox: The WebCompat WebExtension shipped with Firefox exposed a persistent UUID (CVE-2025-6425)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6424" id="CVE-2025-6424" type="cve" title="CVE-2025-6424" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6425" id="CVE-2025-6425" type="cve" title="CVE-2025-6425" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6429" id="CVE-2025-6429" type="cve" title="CVE-2025-6429" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6430" id="CVE-2025-6430" type="cve" title="CVE-2025-6430" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374555" id="2374555" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374559" id="2374559" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374561" id="2374561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374562" id="2374562" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10073" id="RLSA-2025:10073" type="self" title="RLSA-2025:10073" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="128.12.0" release="1.el10_0" src="firefox-128.12.0-1.el10_0.src.rpm">
          <filename>firefox-128.12.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d1ed13f1479697b51679f74af77f3576692e98c1fd135e48e195e4fd4717cade</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10195</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* thunderbird: Unsolicited File Download, Disk Space Exhaustion, and Credential Leakage via mailbox:/// Links (CVE-2025-5986)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5986" id="CVE-2025-5986" type="cve" title="CVE-2025-5986" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6424" id="CVE-2025-6424" type="cve" title="CVE-2025-6424" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6425" id="CVE-2025-6425" type="cve" title="CVE-2025-6425" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6429" id="CVE-2025-6429" type="cve" title="CVE-2025-6429" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6430" id="CVE-2025-6430" type="cve" title="CVE-2025-6430" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2372281" id="2372281" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374555" id="2374555" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374559" id="2374559" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374561" id="2374561" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374562" id="2374562" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10195" id="RLSA-2025:10195" type="self" title="RLSA-2025:10195" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="128.12.0" release="1.el10_0" src="thunderbird-128.12.0-1.el10_0.src.rpm">
          <filename>thunderbird-128.12.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">fed366e1f80fcb4b2ccba049e424ec7bcf035e10214dc78d2c7e6aeaf56c464e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10549</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: podman missing TLS verification (CVE-2025-6032)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-6032" id="CVE-2025-6032" type="cve" title="CVE-2025-6032" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2372501" id="2372501" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10549" id="RLSA-2025:10549" type="self" title="RLSA-2025:10549" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman" arch="aarch64" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-5.4.0-12.el10_0.aarch64.rpm</filename>
          <sum type="sha256">06efffc4dddaaa33508de3103d8f541200e1cbfd6201bfdc1606f442cc00a0f0</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-12.el10_0.noarch.rpm</filename>
          <sum type="sha256">50e57d06c0b4b9b5f81adc49cece6f8a36edbae57426c6f6b3b6cf9939b0ab15</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="6" version="5.4.0" release="12.el10_0" src="podman-5.4.0-12.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-12.el10_0.aarch64.rpm</filename>
          <sum type="sha256">71cea8fe64c8e8dbc61efc9a09313b5e516579671afbb477e47f324401b39996</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10635</id>
    <title>Moderate: gnome-remote-desktop security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gnome-remote-desktop.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.

Security Fix(es):

* gnome-remote-desktop: Uncontrolled Resource Consumption due to Malformed RDP PDUs (CVE-2025-5024)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5024" id="CVE-2025-5024" type="cve" title="CVE-2025-5024" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2367717" id="2367717" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10635" id="RLSA-2025:10635" type="self" title="RLSA-2025:10635" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gnome-remote-desktop" arch="aarch64" epoch="0" version="47.3" release="2.el10_0" src="gnome-remote-desktop-47.3-2.el10_0.src.rpm">
          <filename>gnome-remote-desktop-47.3-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">830e187f28a75a2bf54f6cf634b023559d0191ae78e3aae39991a61a191c6d07</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10677</id>
    <title>Moderate: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:09" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4673" id="CVE-2025-4673" type="cve" title="CVE-2025-4673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373305" id="2373305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10677" id="RLSA-2025:10677" type="self" title="RLSA-2025:10677" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang" arch="aarch64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-1.24.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">980e55d2e8a9c353c0a3ec784b14dff052b76e4c40e21e1305bd7b45347efc6d</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-bin-1.24.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">23ba13ceb85b13980a440e73e3364973a8efee54334c44a4e3bf8e478064ba57</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-docs-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f55ec9fb24d751ffe3187f8ca6c2726708bdf26cc2e04ed86d7500edf65a2eb9</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-misc-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c34922495aa0d17cd7ea49e63ba69169799423420eaf62cebd336663b16ba28a</sum>
        </package>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-race-1.24.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">413b128c46d0daea5e4e55e946192c83007424acad4e5932d0611b6038055079</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-src-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">f49a704a94a6fae26328780398d8a6f588082da9aa5dafa3d777cf1a0eb27434</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>golang-tests-1.24.4-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e2ce7eb27332c70ecc199fc129838f7f8b37a285a616b50b04779e5e62e0c77f</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.24.4" release="1.el10_0" src="golang-1.24.4-1.el10_0.src.rpm">
          <filename>go-toolset-1.24.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a3f0d12fa45db2c0b0f0f929e2c0540a763a78519ed78a43c01561d6c86acb02</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:10873</id>
    <title>Important: java-21-openjdk security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for java-21-openjdk.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The OpenJDK 21 packages provide the OpenJDK 21 Java Runtime Environment and the OpenJDK 21 Java Software Development Kit.

Security Fix(es):

* JDK: Better Glyph drawing (CVE-2025-30749)
* JDK: Enhance TLS protocol support (CVE-2025-30754)
* JDK: Improve HTTP client header handling (CVE-2025-50059)
* JDK: Better Glyph drawing redux (CVE-2025-50106)

Bug Fix(es):

* In Rocky Linux 9 and Rocky Linux 10 systems, the default graphical display system is Wayland. The use of Wayland in these systems causes a failure in the traditional X11 method that java.awt.Robot uses to take a screen capture, producing a blank image. With this update, the RPM now recommends installing the PipeWire package, which the JDK can use to take screen captures in Wayland systems (Rocky Linux-102683, Rocky Linux-102684, Rocky Linux-102685)
* On NUMA systems, the operating system can choose to migrate a task from one NUMA node to another. In the G1 garbage collector, G1AllocRegion objects are associated with NUMA nodes. The G1Allocator code assumes that obtaining the G1AllocRegion object for the current thread is sufficient, but OS scheduling can lead to arbitrary changes in the NUMA-to-thread association. This can cause crashes when the G1AllocRegion being used changes mid-operation. This update resolves this issue by always using the same NUMA node and associated G1AllocRegion object throughout an operation. (Rocky Linux-90307, Rocky Linux-90308, Rocky Linux-90311)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30749" id="CVE-2025-30749" type="cve" title="CVE-2025-30749" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30754" id="CVE-2025-30754" type="cve" title="CVE-2025-30754" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50059" id="CVE-2025-50059" type="cve" title="CVE-2025-50059" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50106" id="CVE-2025-50106" type="cve" title="CVE-2025-50106" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376783" id="2376783" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376784" id="2376784" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376785" id="2376785" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379031" id="2379031" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:10873" id="RLSA-2025:10873" type="self" title="RLSA-2025:10873" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="java-21-openjdk" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">d8f41de4e9daeff92c9c05033361120f8b108357537af9e957efa62e33e74b0c</sum>
        </package>
        <package name="java-21-openjdk-demo" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-demo-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">54557fa28bdd6339b3eb2cdd3fca2ca3355ee7c4537aa68bccdbda46dc50dafa</sum>
        </package>
        <package name="java-21-openjdk-devel" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-devel-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">cf06081c0208a031eac2898d713c808111e1e3cf20e68c0a1f2546a55cb40391</sum>
        </package>
        <package name="java-21-openjdk-headless" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-headless-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">dd2e64fafc8ddd4be6208bff883e5d81b2bb5775eba54d4b53c27bce8614c498</sum>
        </package>
        <package name="java-21-openjdk-javadoc" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-javadoc-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">e2af22fad19e7ec43e0e26cc89a82428740e4c57511be405343367aca02a4ca0</sum>
        </package>
        <package name="java-21-openjdk-javadoc-zip" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-javadoc-zip-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">220021d27900977a1fc90e5c554b4fe3da03d47f777475bf9d392d4ba9e029f4</sum>
        </package>
        <package name="java-21-openjdk-jmods" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-jmods-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">4d9847a358e92f9cfac08a95f628af3658fe1b1ff3f441e6ab883d0047c5de0c</sum>
        </package>
        <package name="java-21-openjdk-src" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-src-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">5094731d64fc7427cc485c30a2beec31fc2d45307f44c1b4bbc8fbd894bd99b4</sum>
        </package>
        <package name="java-21-openjdk-static-libs" arch="aarch64" epoch="1" version="21.0.8.0.9" release="1.el10" src="java-21-openjdk-21.0.8.0.9-1.el10.src.rpm">
          <filename>java-21-openjdk-static-libs-21.0.8.0.9-1.el10.aarch64.rpm</filename>
          <sum type="sha256">aa68c5bc3ed6b3f9f8e7f7dac68be1ff434dd877e5d0194e2dcb1a38e4159c7b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11332</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation (CVE-2024-56337)

* tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame (CVE-2025-31650)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56337" id="CVE-2024-56337" type="cve" title="CVE-2024-56337" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31650" id="CVE-2025-31650" type="cve" title="CVE-2025-31650" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2333521" id="2333521" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2362783" id="2362783" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11332" id="RLSA-2025:11332" type="self" title="RLSA-2025:11332" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">7c11353e58e4822db9739e90e1b99462f3be11ed491be1beb1be7807545181bd</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">3d6851aa27bf852945314cbad8a11ba59df3e3cbe7ed6ac0e5a5f29c58225d40</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">a9f4d0eeabb6df8ffa9e7a332446f5a161ada29c77a0d38fb801fc826504e033</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">38b76b62dec96d2400b4a5030c61a93d6865897a63fd032a2b9f1076eafe9c2d</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">cf01a3d83ada8424330926b49aaa536c4dfb24576f057cc989a0b3a14c441883</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">29e509374ef0700c32eb589736d9d80bddbe255b252cd9f927e1e3f21bf5ec3e</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">0ca600cd745cbb59544aafe2278a75381d4da269d7ac01aaeb9b61eba69210df</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.1" src="tomcat9-9.0.87-5.el10_0.1.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.1.noarch.rpm</filename>
          <sum type="sha256">f5b988b6558b3992d98428ec7af5cf620fc24157d925e3ab1cb9fa27488fa459</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11401</id>
    <title>Important: valkey security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for valkey.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Valkey is an advanced key-value store. It is often referred to as a data structure server since keys can contain strings, hashes, lists, sets and sorted sets.  You can run atomic operations on these types, like appending to a string; incrementing the value in a hash; pushing to a list; computing set intersection, union and difference; or getting the member with highest ranking in a sorted set.  In order to achieve its outstanding performance, Valkey works with an in-memory dataset. Depending on your use case, you can persist it either by dumping the dataset to disk every once in a while, or by appending each command to a log.  Valkey also supports trivial-to-setup master-slave replication, with very fast non-blocking first synchronization, auto-reconnection on net split and so forth.  Other features include Transactions, Pub/Sub, Lua scripting, Keys with a limited time-to-live, and configuration settings to make Valkey behave like a cache.  You can use Valkey from most programming languages also.

Security Fix(es):

* redis: Redis Stack Buffer Overflow (CVE-2025-27151)

* redis: Redis Unauthenticated Denial of Service (CVE-2025-48367)

* redis: Redis Hyperloglog Out-of-Bounds Write Vulnerability (CVE-2025-32023)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-27151" id="CVE-2025-27151" type="cve" title="CVE-2025-27151" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-32023" id="CVE-2025-32023" type="cve" title="CVE-2025-32023" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48367" id="CVE-2025-48367" type="cve" title="CVE-2025-48367" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369153" id="2369153" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376857" id="2376857" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2376858" id="2376858" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11401" id="RLSA-2025:11401" type="self" title="RLSA-2025:11401" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="valkey" arch="aarch64" epoch="0" version="8.0.4" release="1.el10_0" src="valkey-8.0.4-1.el10_0.src.rpm">
          <filename>valkey-8.0.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f05d1299c00a25bcfbb9b0d475a9b418bf58732acd4f4afc527bf4cdfef1d9ee</sum>
        </package>
        <package name="valkey-devel" arch="aarch64" epoch="0" version="8.0.4" release="1.el10_0" src="valkey-8.0.4-1.el10_0.src.rpm">
          <filename>valkey-devel-8.0.4-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6b8c08f6f477ec956d4601cb59b8a771e6e67bec467e0c5e24bef678e84d34f4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:11797</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:10" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

* firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

* firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

* firefox: Memory safety bugs (CVE-2025-8034)

* firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

* firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8027" id="CVE-2025-8027" type="cve" title="CVE-2025-8027" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8028" id="CVE-2025-8028" type="cve" title="CVE-2025-8028" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8029" id="CVE-2025-8029" type="cve" title="CVE-2025-8029" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8030" id="CVE-2025-8030" type="cve" title="CVE-2025-8030" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8031" id="CVE-2025-8031" type="cve" title="CVE-2025-8031" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8032" id="CVE-2025-8032" type="cve" title="CVE-2025-8032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8033" id="CVE-2025-8033" type="cve" title="CVE-2025-8033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8034" id="CVE-2025-8034" type="cve" title="CVE-2025-8034" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8035" id="CVE-2025-8035" type="cve" title="CVE-2025-8035" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382701" id="2382701" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382703" id="2382703" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382704" id="2382704" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382707" id="2382707" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382710" id="2382710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382711" id="2382711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382717" id="2382717" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382718" id="2382718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382720" id="2382720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:11797" id="RLSA-2025:11797" type="self" title="RLSA-2025:11797" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="128.13.0" release="1.el10_0" src="firefox-128.13.0-1.el10_0.src.rpm">
          <filename>firefox-128.13.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">11493c038658b01fc58838ea15239b682a0b9fdbef8850d4f1a88204dff20c85</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12056</id>
    <title>Moderate: perl security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for perl.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Perl is a high-level programming language that is commonly used for system administration utilities and web programming.

Security Fix(es):

* perl: Perl threads have a working directory race condition where file operations may target unintended paths (CVE-2025-40909)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-40909" id="CVE-2025-40909" type="cve" title="CVE-2025-40909" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2369407" id="2369407" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12056" id="RLSA-2025:12056" type="self" title="RLSA-2025:12056" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="perl" arch="aarch64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-5.40.2-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7948ba076307dcfc2f479983f7888a4a949d9c56dd2b5434ce259f4460e7ea6b</sum>
        </package>
        <package name="perl-Attribute-Handlers" arch="noarch" epoch="0" version="1.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Attribute-Handlers-1.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a50a47c9c8189cf7eec48d586f8816aa6273e5a84e24c8b38c98b3396378e0d7</sum>
        </package>
        <package name="perl-AutoLoader" arch="noarch" epoch="0" version="5.74" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-AutoLoader-5.74-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d11dee873d7d98224cb8b63b805b266025ff6e7a7c0bbddea102a1aef6b4c1ef</sum>
        </package>
        <package name="perl-AutoSplit" arch="noarch" epoch="0" version="5.74" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-AutoSplit-5.74-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">fc83da5b9f60869db73ea9335d11b087da8977bab44b669d2fc21d5ce7eedbdf</sum>
        </package>
        <package name="perl-autouse" arch="noarch" epoch="0" version="1.11" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-autouse-1.11-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">022a86f3a5975a041799ad17b807e59e335f57a29b3fcd9e7624ae13d9fc343f</sum>
        </package>
        <package name="perl-B" arch="aarch64" epoch="0" version="1.89" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-B-1.89-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7fa5aa568d2d4b9a07c05cc74c1062e56a8ee638d296875d43135cb761420c21</sum>
        </package>
        <package name="perl-base" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-base-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">23294c4ee06f04f99e734a520e7118b3f69b4e973afdcfa435e7fdffacb6cb30</sum>
        </package>
        <package name="perl-Benchmark" arch="noarch" epoch="0" version="1.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Benchmark-1.25-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7f17cc9401a6998858fbfc634fd8cacb305dd95c5557fa60dd1efc7f9e40dd6c</sum>
        </package>
        <package name="perl-blib" arch="noarch" epoch="0" version="1.07" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-blib-1.07-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">26f1caf1fa8a54fea467f5e126a8b9d295cc763ee5e84029137ee6dd9ad12668</sum>
        </package>
        <package name="perl-Class-Struct" arch="noarch" epoch="0" version="0.68" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Class-Struct-0.68-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">142b33b254ad949b08e59aa746019c53c09a6f9b1e8f16612c23a2222c7890bd</sum>
        </package>
        <package name="perl-Config-Extensions" arch="noarch" epoch="0" version="0.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Config-Extensions-0.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">088dd306bf83eb27d4800a7dc8a74248a7655b27025f6a1096a32664ad3f7e71</sum>
        </package>
        <package name="perl-DBM_Filter" arch="noarch" epoch="0" version="0.06" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DBM_Filter-0.06-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">594a8f1acb1be8bea0d80d76529e16e209ab76632573ec320a3a255c1d93030d</sum>
        </package>
        <package name="perl-debugger" arch="noarch" epoch="0" version="1.60" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-debugger-1.60-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">116632d66aecb227ec01b561039c998967e38b11605a08c26c6975f100d3f363</sum>
        </package>
        <package name="perl-deprecate" arch="noarch" epoch="0" version="0.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-deprecate-0.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">f9b6c6d93abe972e0898aed2bd517c9dd7492b589cc43f0f542ef879705eaa16</sum>
        </package>
        <package name="perl-devel" arch="aarch64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-devel-5.40.2-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d51ade732713ecbca1918c4a1b36775e4ec6a69c666dd8505c0a8d289fdade5b</sum>
        </package>
        <package name="perl-Devel-Peek" arch="aarch64" epoch="0" version="1.34" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Devel-Peek-1.34-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a7e45143c7832b91e0d7819674182a02d612a88220a219ff8c6f07a3a7eac38b</sum>
        </package>
        <package name="perl-Devel-SelfStubber" arch="noarch" epoch="0" version="1.06" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Devel-SelfStubber-1.06-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3333f3ddba623e1659029a71773b6fdd8b06009f52f630c617f5f06869d193ab</sum>
        </package>
        <package name="perl-diagnostics" arch="noarch" epoch="0" version="1.40" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-diagnostics-1.40-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">391498cf663012d9ec9bd910b4bf53cf4234304cea25b142debbb91bda3c79ba</sum>
        </package>
        <package name="perl-DirHandle" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DirHandle-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3b7143910af7251015a7a91b80280ebe2390424ccb7e1ce5172d6fe3a2b579a7</sum>
        </package>
        <package name="perl-doc" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-doc-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">1f2e5dc38f4e1c91f43dac6269bb11d7c025b27eb55e7f4eb6461ea0220704ac</sum>
        </package>
        <package name="perl-Dumpvalue" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Dumpvalue-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4e035ced3d3eae3c988ec32be73475af7f253d99e8fe456d829cbca7887fd3e6</sum>
        </package>
        <package name="perl-DynaLoader" arch="aarch64" epoch="0" version="1.56" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-DynaLoader-1.56-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b69a39827da36b95969b4531d6a7b02be03d6cb1723bb7ffa30fff29e985b6e3</sum>
        </package>
        <package name="perl-encoding-warnings" arch="noarch" epoch="0" version="0.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-encoding-warnings-0.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e0901d24894adcac12d89343604cf3e8775024483b6a83d3d5913153c41faf8a</sum>
        </package>
        <package name="perl-English" arch="noarch" epoch="0" version="1.11" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-English-1.11-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">cace3f6ec93d1dddf2a3880e90a746967df8ad4b18c65e3fab3d6d2837962a59</sum>
        </package>
        <package name="perl-Errno" arch="aarch64" epoch="0" version="1.38" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Errno-1.38-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d4ac06dc6ef634652523029e15928e4fe98a8f716017f9e52af3dc30500856c4</sum>
        </package>
        <package name="perl-ExtUtils-Constant" arch="noarch" epoch="0" version="0.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Constant-0.25-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a5254c20224062ab3e006e8a816d71f6a6f7c392afebeaf67c08189a04820674</sum>
        </package>
        <package name="perl-ExtUtils-Embed" arch="noarch" epoch="0" version="1.35" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Embed-1.35-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a3a81991583e28184db2748eb512c1a95788568a6da7aafaa5ec0fc4a39b594d</sum>
        </package>
        <package name="perl-ExtUtils-Miniperl" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ExtUtils-Miniperl-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bff285dd9b50eac452554962e9533a81440ab5b293a5f8a131ed217e159b4abd</sum>
        </package>
        <package name="perl-Fcntl" arch="aarch64" epoch="0" version="1.18" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Fcntl-1.18-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7594a2b1928b3401459544d90574fa6772d2cb14a3ea7730ffa853d998694169</sum>
        </package>
        <package name="perl-fields" arch="noarch" epoch="0" version="2.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-fields-2.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a5185e8c106dd42e6900b9594a894c8640301c4454d6e9130996d1d2c6619743</sum>
        </package>
        <package name="perl-File-Basename" arch="noarch" epoch="0" version="2.86" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Basename-2.86-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">0e52e24b6fe11614f52f85fac01887550aca5af48322b7297add18f8bae07af8</sum>
        </package>
        <package name="perl-FileCache" arch="noarch" epoch="0" version="1.10" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FileCache-1.10-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">ddcec09ad7b7e78312d597efb775fd0795aca5064ba933ac3ba53de6ffb70ed3</sum>
        </package>
        <package name="perl-File-Compare" arch="noarch" epoch="0" version="1.100.800" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Compare-1.100.800-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">36d9a304d4513dd8ab9b8e98d02cc609541bdbba22be1ea88b247e37ca61671f</sum>
        </package>
        <package name="perl-File-Copy" arch="noarch" epoch="0" version="2.41" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Copy-2.41-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">eed099e78ffcf4332ed8a29bfb6ea948717fc3b61b312e205a8a3bb3783abcb0</sum>
        </package>
        <package name="perl-File-DosGlob" arch="aarch64" epoch="0" version="1.12" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-DosGlob-1.12-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9b685dfaddf72186b02a525c11b23d8c172f706aa07f52d2b3ef31c695f3dc52</sum>
        </package>
        <package name="perl-File-Find" arch="noarch" epoch="0" version="1.44" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-Find-1.44-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">1d72ea44720cc2edbea27771dd5708935c2b1f1165c12b7bd8053a281e31bff8</sum>
        </package>
        <package name="perl-FileHandle" arch="noarch" epoch="0" version="2.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FileHandle-2.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">da293f041854918ba2ed671bc86e0fa2495c7c6bb6bb4ae6c1d1555aa0543ccf</sum>
        </package>
        <package name="perl-File-stat" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-File-stat-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e68ec3b54e4a04236a01260f76f52453974a71e4ba14a85a92357e611f8f0307</sum>
        </package>
        <package name="perl-filetest" arch="noarch" epoch="0" version="1.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-filetest-1.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d722cf0a055e441a8e7f804a6cb287f292ea823b01ffa0fd6aa6b9232d28a82b</sum>
        </package>
        <package name="perl-FindBin" arch="noarch" epoch="0" version="1.54" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-FindBin-1.54-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">309befe99d17047346772695df54eb58575c000cd4da46652dfc56edc7da597f</sum>
        </package>
        <package name="perl-GDBM_File" arch="aarch64" epoch="1" version="1.24" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-GDBM_File-1.24-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">c6198178d2a20d29e9bb21aa01c483854c8e5f7ad1403f2ef0ee2ac5b4d96d12</sum>
        </package>
        <package name="perl-Getopt-Std" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Getopt-Std-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4c704ab2ee391d717797366dd5ed6e0b4972c6915dbaf0ed0079f4cb23dd2fb3</sum>
        </package>
        <package name="perl-Hash-Util" arch="aarch64" epoch="0" version="0.32" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Hash-Util-0.32-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a385e0c59b1002bd94b0bdb03d74e8cd12f23f60247e272c2429be4b5c10592b</sum>
        </package>
        <package name="perl-if" arch="noarch" epoch="0" version="0.61.000" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-if-0.61.000-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">5f355e52e71146d71223f34451b5ff1c11bc471ae8eeb0a1a84258d15c32594f</sum>
        </package>
        <package name="perl-Hash-Util-FieldHash" arch="aarch64" epoch="0" version="1.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Hash-Util-FieldHash-1.27-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0ca9d9424dd9cbccea743ee91fcfbc6d4811be0c6dfd4781212fe8ebcea20805</sum>
        </package>
        <package name="perl-I18N-Collate" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-Collate-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bcba8afa4f930466ff0b74cd168d0223e120524176ce70249b765a1b1b7dd280</sum>
        </package>
        <package name="perl-I18N-Langinfo" arch="aarch64" epoch="0" version="0.24" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-Langinfo-0.24-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">bc9c9667e65d31825104919960b5459ee7874e970a1c9a1f9ed1bc02c3c5de6c</sum>
        </package>
        <package name="perl-I18N-LangTags" arch="noarch" epoch="0" version="0.45" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-I18N-LangTags-0.45-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">76f6d8df29b37d36d869d540fe00fab661009cb9985b188caf23892bad7b52a8</sum>
        </package>
        <package name="perl-interpreter" arch="aarch64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-interpreter-5.40.2-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a9851763a8da1f4a639dcb654aeefbe2a9112fc0e691b3fa0ae061081857f389</sum>
        </package>
        <package name="perl-IO" arch="aarch64" epoch="0" version="1.55" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-IO-1.55-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7276cb0bf769d5333463a77d55d39bb1fbf4c1b0e3595261c2b3131793ed49a2</sum>
        </package>
        <package name="perl-IPC-Open3" arch="noarch" epoch="0" version="1.22" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-IPC-Open3-1.22-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">86b148a2756784bdcbdaff5cff28c5393ac52f4bf0216907756b57a5ba5ca92b</sum>
        </package>
        <package name="perl-less" arch="noarch" epoch="0" version="0.03" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-less-0.03-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b5e848124b09387112c1d4231c76c8def385bc0538c73b2c6ec9aa685fa9200d</sum>
        </package>
        <package name="perl-lib" arch="aarch64" epoch="0" version="0.65" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-lib-0.65-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2e52144d22a3433b883b64c5e4466d57302c63ad36e73907e172164b1019bca5</sum>
        </package>
        <package name="perl-libnetcfg" arch="noarch" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-libnetcfg-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7efe3f4939bc66049dfb3820be0b55a361dfc104ba96d7878399dee3e3d68a5d</sum>
        </package>
        <package name="perl-libs" arch="aarch64" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-libs-5.40.2-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">2f3935015b179b436c28850455f7dc954d9a5c432222102fd097a53f0641960d</sum>
        </package>
        <package name="perl-locale" arch="noarch" epoch="0" version="1.12" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-locale-1.12-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a9a3b66e223867d6208946406f5b1edf6726034cdb86c60594d1d1df8381fa18</sum>
        </package>
        <package name="perl-Locale-Maketext-Simple" arch="noarch" epoch="1" version="0.21" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Locale-Maketext-Simple-0.21-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">39e29184aa99c21e97a57e97dc02717f90d377f12a3202b0e93b71ce1ff113c6</sum>
        </package>
        <package name="perl-macros" arch="noarch" epoch="4" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-macros-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">c338c5d3a9bd8a1c1235f1c8da239f29b9d62bf58788f9983355db0106722eaf</sum>
        </package>
        <package name="perl-Math-Complex" arch="noarch" epoch="0" version="1.62" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Math-Complex-1.62-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6be88deaf0001307cb42142a066d5bbb8355ca3c066f287cc1dfb6c70135de31</sum>
        </package>
        <package name="perl-Memoize" arch="noarch" epoch="0" version="1.16" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Memoize-1.16-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">a8b43a7f26e0da134f559117be6ec1246f4403594c78bd2c028b93ee08086207</sum>
        </package>
        <package name="perl-meta-notation" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-meta-notation-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e1de3da0d11590cde4c2f31ea22160f937639c4cb14852569b46be28b046c8ee</sum>
        </package>
        <package name="perl-Module-Loaded" arch="noarch" epoch="1" version="0.08" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Module-Loaded-0.08-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">3639e9e7b65277a67c7409fe4f020b3913c7ef6b948bf577ed1ae9aa34f71efc</sum>
        </package>
        <package name="perl-mro" arch="aarch64" epoch="0" version="1.29" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-mro-1.29-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">21dc14812bb8301c026a0e1463785ddac818d2a445b5ebdc202b95ab7de783d9</sum>
        </package>
        <package name="perl-NDBM_File" arch="aarch64" epoch="0" version="1.17" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-NDBM_File-1.17-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0af6555aed977f6ffb264dfed57449b1f6fec73d5f4613ff02c6383046a9ce9d</sum>
        </package>
        <package name="perl-Net" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Net-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">589d4504637d13e2435420455917884df8727581aa80fae5b51020650ac8169f</sum>
        </package>
        <package name="perl-NEXT" arch="noarch" epoch="0" version="0.69" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-NEXT-0.69-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6cf667a4e215805092c31399b07088b9b53ac30571429737c26ff5633c93f107</sum>
        </package>
        <package name="perl-ODBM_File" arch="aarch64" epoch="0" version="1.18" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ODBM_File-1.18-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">a6c86cc35741c32f00e548e37b834fcc2d7359a1ed524a9bc303601117040921</sum>
        </package>
        <package name="perl-Opcode" arch="aarch64" epoch="0" version="1.65" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Opcode-1.65-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">85ac36e06f9409698d9f00a3c5d0880a47180a2eb0051684f725a3cf1f3bd994</sum>
        </package>
        <package name="perl-open" arch="noarch" epoch="0" version="1.13" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-open-1.13-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e6faf552b3ef8663aa5c008bb0170bd1937c21b052e19b38338b17af0140a2fa</sum>
        </package>
        <package name="perl-overload" arch="noarch" epoch="0" version="1.37" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-overload-1.37-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">ef05e1e0a8d4186fd2b5fc8e9726345b0d14a30e4a7eb7a66943aa51c6032a4f</sum>
        </package>
        <package name="perl-overloading" arch="noarch" epoch="0" version="0.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-overloading-0.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">418913e1c6335e9aa8f039fa6903dbba59d713bc902191272692c655b2d8f63b</sum>
        </package>
        <package name="perl-ph" arch="aarch64" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-ph-5.40.2-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">22e97580f74820a2b1d63970c46faaed8b5b2544aa117f6e35ee650c1c3fb836</sum>
        </package>
        <package name="perl-Pod-Functions" arch="noarch" epoch="0" version="1.14" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Pod-Functions-1.14-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9544e913bae26609c973b6fac8ef231fa230e79b79966696f27dc6169b0cce16</sum>
        </package>
        <package name="perl-Pod-Html" arch="noarch" epoch="0" version="1.35" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Pod-Html-1.35-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">56640ad227c8fb21e7f72fde247757f01d905d585bea3ede000adc8db4072b87</sum>
        </package>
        <package name="perl-POSIX" arch="aarch64" epoch="0" version="2.20" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-POSIX-2.20-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">27c6ea27094bf56bb74de3ab820198d953163372c546871f620ef1d9a791cc52</sum>
        </package>
        <package name="perl-Safe" arch="noarch" epoch="0" version="2.46" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Safe-2.46-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d8b10fade999abb3271355112bd700b47920bc3556996606e99cc4ac445e682d</sum>
        </package>
        <package name="perl-Search-Dict" arch="noarch" epoch="0" version="1.07" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Search-Dict-1.07-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7a93698979506fa211d4570b90132e5368cc45829985baec494f877a38ec0061</sum>
        </package>
        <package name="perl-SelectSaver" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-SelectSaver-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4971816006a6fd214274853c95c74c1e4af34acb2fa145d7c36d3533f115969d</sum>
        </package>
        <package name="perl-SelfLoader" arch="noarch" epoch="0" version="1.27" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-SelfLoader-1.27-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">15a01d37dcd6c51415b3d2eb973d5e64ffe93455587282661129f31e39a37164</sum>
        </package>
        <package name="perl-sigtrap" arch="noarch" epoch="0" version="1.10" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-sigtrap-1.10-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">d322121627446cea0a0ce9a162ac1e5cbc3c21fed5454a614f9f3231bcd6e819</sum>
        </package>
        <package name="perl-sort" arch="noarch" epoch="0" version="2.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-sort-2.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9a656d27009bec4a4203f84e041407805e48189799413db9637a51d307666867</sum>
        </package>
        <package name="perl-subs" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-subs-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">6f51e398f25184efd9fa656c36b32f4a66b84db33473a0084c09d2564b1fa173</sum>
        </package>
        <package name="perl-Symbol" arch="noarch" epoch="0" version="1.09" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Symbol-1.09-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">e44ddbdba11f7108309e1e8268ded90b30b45d4559d329b7598c194491e65cb7</sum>
        </package>
        <package name="perl-Sys-Hostname" arch="aarch64" epoch="0" version="1.25" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Sys-Hostname-1.25-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7baff002fb0be478168ba578e78d829393e5fc5ffe6c67d17ceb20864b8af143</sum>
        </package>
        <package name="perl-Term-Complete" arch="noarch" epoch="0" version="1.403" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Term-Complete-1.403-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">bca25218698dc5bec307ab2833f95c80979801a3a50bde8578e87f5b0a9e9c6e</sum>
        </package>
        <package name="perl-Term-ReadLine" arch="noarch" epoch="0" version="1.17" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Term-ReadLine-1.17-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">eacdcb68a50137a0b436f0c843963dd397f6a08953c66383e62b6cc416203cf0</sum>
        </package>
        <package name="perl-Test" arch="noarch" epoch="0" version="1.31" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Test-1.31-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">7e9be4015583373451563d4ec380e02dd4acceb46311be07128844cee2bd3c99</sum>
        </package>
        <package name="perl-Text-Abbrev" arch="noarch" epoch="0" version="1.02" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Text-Abbrev-1.02-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">25b62a751bb2a0357cfcf9b4a9e159bbacbefd6cfe0748265e62219dc9683586</sum>
        </package>
        <package name="perl-Thread" arch="noarch" epoch="0" version="3.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Thread-3.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">491d0f80e3d887e45c217e46256d581c90fb3cb07830cc546e2a6f5691b629f6</sum>
        </package>
        <package name="perl-Thread-Semaphore" arch="noarch" epoch="0" version="2.13" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Thread-Semaphore-2.13-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">638204720d76bfff46b4232b6bac608876be8f587b9c7f3d1009e3dedf806dcb</sum>
        </package>
        <package name="perl-Tie" arch="noarch" epoch="0" version="4.6" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-4.6-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">5c0753c9b84119f97ee29a79a6f85d2b9b8e7b43e7ccceff30076e592529fb4e</sum>
        </package>
        <package name="perl-Tie-File" arch="noarch" epoch="0" version="1.09" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-File-1.09-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">979470cf5a306f3c4dea61028b98b449ca8befcfe02987ef6e147c7321f6d3fa</sum>
        </package>
        <package name="perl-Tie-Memoize" arch="noarch" epoch="0" version="1.1" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Tie-Memoize-1.1-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">caab07ab606928b27eff25c56d245649147171e90b94c8f4ebc6168c2c04d1a6</sum>
        </package>
        <package name="perl-Time" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Time-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">9f0208c626290f1e4e435ec425e901cb8c2db44c8e1caa64fc244a9172006d4f</sum>
        </package>
        <package name="perl-Time-Piece" arch="aarch64" epoch="0" version="1.3401" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Time-Piece-1.3401-512.2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">af73491311a4636cc0421836471909daf4e99144a50192a9fc567d7a15d02147</sum>
        </package>
        <package name="perl-Unicode-UCD" arch="noarch" epoch="0" version="0.78" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-Unicode-UCD-0.78-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">8127dfa5d5006949b78316bea4cd438b83f616dbb2c9160dee0d3c88dd354d8e</sum>
        </package>
        <package name="perl-User-pwent" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-User-pwent-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">61be0c87a8ef400af759697ab882a54dc62018958aa86f3a3f6a2bac93666b68</sum>
        </package>
        <package name="perl-utils" arch="noarch" epoch="0" version="5.40.2" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-utils-5.40.2-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">c89e6e8052e14ed8e1c2d3c9c09ef67d1f90be7705d624293c916ee926fd4ae8</sum>
        </package>
        <package name="perl-vars" arch="noarch" epoch="0" version="1.05" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-vars-1.05-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">877c2bdd38a85c3510e06a9a271b5badc4b80c917109f39f65f3ca4796eca380</sum>
        </package>
        <package name="perl-vmsish" arch="noarch" epoch="0" version="1.04" release="512.2.el10_0" src="perl-5.40.2-512.2.el10_0.src.rpm">
          <filename>perl-vmsish-1.04-512.2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b2e68ff6ffa4970afdeff6e1d9988decbf7cabe45d08dabee3d6b41284f869d7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12064</id>
    <title>Important: unbound security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for unbound.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. 

Security Fix(es):

* unbound: Unbound Cache poisoning (CVE-2025-5994)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5994" id="CVE-2025-5994" type="cve" title="CVE-2025-5994" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380949" id="2380949" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12064" id="RLSA-2025:12064" type="self" title="RLSA-2025:12064" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="python3-unbound" arch="aarch64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>python3-unbound-1.20.0-12.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1370cfd438a1ead65254034ff22f42341a9cd37994c533f8093bbddfeb0bfcc8</sum>
        </package>
        <package name="unbound" arch="aarch64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-1.20.0-12.el10_0.aarch64.rpm</filename>
          <sum type="sha256">dbcd0ba597e2da1a185f6534aa7a42e63ddbc9743429b000051db0d33c781787</sum>
        </package>
        <package name="unbound-anchor" arch="aarch64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-anchor-1.20.0-12.el10_0.aarch64.rpm</filename>
          <sum type="sha256">eb243da277db7cc9f15bca492e32ea78224d599af6c4fc65a95799742a1bbc41</sum>
        </package>
        <package name="unbound-dracut" arch="aarch64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-dracut-1.20.0-12.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e5a245971fe91032608d7a4face7670c8860ab4450a3f19cfc23541966aad76c</sum>
        </package>
        <package name="unbound-libs" arch="aarch64" epoch="0" version="1.20.0" release="12.el10_0" src="unbound-1.20.0-12.el10_0.src.rpm">
          <filename>unbound-libs-1.20.0-12.el10_0.aarch64.rpm</filename>
          <sum type="sha256">450c1635f509aa9b4c4ec07883f5aa523e32d990e70c7d09fabb2f476fa46b55</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12188</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Large branch table could lead to truncated instruction (CVE-2025-8028)

* firefox: thunderbird: Memory safety bugs (CVE-2025-8035)

* firefox: thunderbird: Incorrect URL stripping in CSP reports (CVE-2025-8031)

* firefox: thunderbird: JavaScript engine only wrote partial return value to stack (CVE-2025-8027)

* firefox: thunderbird: Potential user-assisted code execution in ?Copy as cURL? command (CVE-2025-8030)

* firefox: Memory safety bugs (CVE-2025-8034)

* firefox: thunderbird: Incorrect JavaScript state machine for generators (CVE-2025-8033)

* firefox: thunderbird: XSLT documents could bypass CSP (CVE-2025-8032)

* firefox: thunderbird: javascript: URLs executed on object and embed tags (CVE-2025-8029)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8027" id="CVE-2025-8027" type="cve" title="CVE-2025-8027" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8028" id="CVE-2025-8028" type="cve" title="CVE-2025-8028" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8029" id="CVE-2025-8029" type="cve" title="CVE-2025-8029" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8030" id="CVE-2025-8030" type="cve" title="CVE-2025-8030" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8031" id="CVE-2025-8031" type="cve" title="CVE-2025-8031" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8032" id="CVE-2025-8032" type="cve" title="CVE-2025-8032" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8033" id="CVE-2025-8033" type="cve" title="CVE-2025-8033" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8034" id="CVE-2025-8034" type="cve" title="CVE-2025-8034" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8035" id="CVE-2025-8035" type="cve" title="CVE-2025-8035" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382701" id="2382701" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382703" id="2382703" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382704" id="2382704" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382707" id="2382707" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382710" id="2382710" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382711" id="2382711" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382717" id="2382717" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382718" id="2382718" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2382720" id="2382720" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12188" id="RLSA-2025:12188" type="self" title="RLSA-2025:12188" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="128.13.0" release="3.el10_0" src="thunderbird-128.13.0-3.el10_0.src.rpm">
          <filename>thunderbird-128.13.0-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">72301ddc442e46f2e4bbcacd1ad46a528f321c82928095195d8c4768ec0792f2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12850</id>
    <title>Moderate: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-22871" id="CVE-2025-22871" type="cve" title="CVE-2025-22871" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2358493" id="2358493" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12850" id="RLSA-2025:12850" type="self" title="RLSA-2025:12850" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="aarch64" epoch="0" version="0.127.0" release="1.el10_0" src="opentelemetry-collector-0.127.0-1.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.127.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">10803eb9084883de2678d983a79c8b57997f2993f1a7089f6fc3f22a33f27d69</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:12862</id>
    <title>Moderate: gdk-pixbuf2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:11" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for gdk-pixbuf2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The gdk-pixbuf2 packages provide an image loading library that can be extended by loadable modules for new image formats. It is used by toolkits such as GTK+ or clutter.

Security Fix(es):

* gdk?pixbuf: Heap?buffer?overflow in gdk?pixbuf (CVE-2025-7345)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-7345" id="CVE-2025-7345" type="cve" title="CVE-2025-7345" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2377063" id="2377063" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:12862" id="RLSA-2025:12862" type="self" title="RLSA-2025:12862" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="gdk-pixbuf2" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-2.42.12-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">bd44c505cf720205e8221654c6dcf3035e5d4d9b57dd5800f78a3763b1801c7c</sum>
        </package>
        <package name="gdk-pixbuf2-devel" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-devel-2.42.12-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d33cb7dc0fd2cf6a8ef78fd6a1f5f9be9e22d5099a6f91a1b387b4a5e98cf689</sum>
        </package>
        <package name="gdk-pixbuf2-modules" arch="aarch64" epoch="0" version="2.42.12" release="4.el10_0" src="gdk-pixbuf2-2.42.12-4.el10_0.src.rpm">
          <filename>gdk-pixbuf2-modules-2.42.12-4.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5dea460b53ee2e034aa08c6a2bf28bccec8b55d03e3602e94ab4b9d196c9ef26</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13674</id>
    <title>Important: toolbox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for toolbox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and other standard container technologies from OCI.

Security Fix(es):

* nvidia-container-toolkit: Privilege Escalation via Hook Initialization in NVIDIA Container Toolkit (CVE-2025-23266)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23266" id="CVE-2025-23266" type="cve" title="CVE-2025-23266" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2381794" id="2381794" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13674" id="RLSA-2025:13674" type="self" title="RLSA-2025:13674" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="toolbox" arch="aarch64" epoch="0" version="0.2" release="1.el10_0" src="toolbox-0.2-1.el10_0.src.rpm">
          <filename>toolbox-0.2-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">639c7133a6d4af439f5eecb2d41d37a4b71da036189ad7828cfc641e07ce261b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13941</id>
    <title>Important: golang security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for golang.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The golang packages provide the Go programming language compiler.

Security Fix(es):

* cmd/go: Go VCS Command Execution Vulnerability (CVE-2025-4674)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4674" id="CVE-2025-4674" type="cve" title="CVE-2025-4674" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2384329" id="2384329" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13941" id="RLSA-2025:13941" type="self" title="RLSA-2025:13941" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="golang" arch="aarch64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-1.24.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">59c4a451d7e6bc7ba104db85f1cd04335fd889acf03c1a8caa202df30ea0fd19</sum>
        </package>
        <package name="golang-bin" arch="aarch64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-bin-1.24.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1addd829d2a39b4f5d084e7c3e491f3295c8bb371eeff61b8b797bfdda6d755c</sum>
        </package>
        <package name="golang-docs" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-docs-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">c8015b335c5881328c5e1ea21aab8e9487e278ded209f83b111b0a870925aea1</sum>
        </package>
        <package name="golang-misc" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-misc-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">9d833125417d6f49f9dc2a9c19bf9454ea27c78b6d319168faff5c6491b640b7</sum>
        </package>
        <package name="golang-race" arch="aarch64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-race-1.24.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">5d1a671f785bb5cd44206e06a59fd343c9068187a5c579e69090637f64b33b2b</sum>
        </package>
        <package name="golang-src" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-src-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">aace02df66e63925e08917bd1704188ea6726490a414e5f5f1f5b9b0ff6051c9</sum>
        </package>
        <package name="golang-tests" arch="noarch" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>golang-tests-1.24.6-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">e7152f56606fe5f068a38d2d2e40d491f9670cc56cb216e7c1d8fc558ffd4491</sum>
        </package>
        <package name="go-toolset" arch="aarch64" epoch="0" version="1.24.6" release="1.el10_0" src="golang-1.24.6-1.el10_0.src.rpm">
          <filename>go-toolset-1.24.6-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">d61fdb69cf82dacd7aef544a67bcd589059558cf5a0caa2a1b6bbe641b2d6433</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:13944</id>
    <title>Important: openjpeg2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for openjpeg2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>OpenJPEG is an open source library for reading and writing image files in JPEG2000 format.

Security Fix(es):

* openjpeg: OpenJPEG OOB heap memory write (CVE-2025-54874)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54874" id="CVE-2025-54874" type="cve" title="CVE-2025-54874" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2386543" id="2386543" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:13944" id="RLSA-2025:13944" type="self" title="RLSA-2025:13944" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="openjpeg2" arch="aarch64" epoch="0" version="2.5.2" release="4.el10_0.1" src="openjpeg2-2.5.2-4.el10_0.1.src.rpm">
          <filename>openjpeg2-2.5.2-4.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">4e609ec883b5b2f0e00d991afc56c60e88c8c6e600d5bc065a92f32512084c84</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14178</id>
    <title>Important: tomcat9 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat9.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process.  Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.

Security Fix(es):

* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

* tomcat: Apache Tomcat denial of service (CVE-2025-52520)

* tomcat: Apache Tomcat denial of service (CVE-2025-52434)

* tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48976" id="CVE-2025-48976" type="cve" title="CVE-2025-48976" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48988" id="CVE-2025-48988" type="cve" title="CVE-2025-48988" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989" id="CVE-2025-48989" type="cve" title="CVE-2025-48989" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49125" id="CVE-2025-49125" type="cve" title="CVE-2025-49125" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52434" id="CVE-2025-52434" type="cve" title="CVE-2025-52434" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520" id="CVE-2025-52520" type="cve" title="CVE-2025-52520" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" id="CVE-2025-53506" type="cve" title="CVE-2025-53506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373015" id="2373015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373018" id="2373018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373020" id="2373020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373309" id="2373309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379374" id="2379374" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379382" id="2379382" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379386" id="2379386" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14178" id="RLSA-2025:14178" type="self" title="RLSA-2025:14178" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat9" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">74e2a6fbef93fe6dada5062baa99ea2ae81539c66150c379e326ceff3d5f00ae</sum>
        </package>
        <package name="tomcat9-admin-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-admin-webapps-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">d5991ed5ea05046e1b9ded1ee71728137bf6cd5265e7a85fd43cc234b4a63cf1</sum>
        </package>
        <package name="tomcat9-docs-webapp" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-docs-webapp-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">27e9f00f4b4db5a618c88766816ea04e334e413b81d6df87309f92e797f2af01</sum>
        </package>
        <package name="tomcat9-el-3.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-el-3.0-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">661c5eb96bedd37e4dd1988be1912a09dfb4246df01619be0a95decb6a739a0a</sum>
        </package>
        <package name="tomcat9-jsp-2.3-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-jsp-2.3-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">d564b100d3af37696d23407cbec19f38dc10d5f263bc6463526307f297f9e751</sum>
        </package>
        <package name="tomcat9-lib" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-lib-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">56221df788f2fd94b729cbc24645ef14577c2a60e21394c4ccebbe3c466e437a</sum>
        </package>
        <package name="tomcat9-servlet-4.0-api" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-servlet-4.0-api-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">197343759673b4df77e1cd4b653ff18640c1145a111abcf65f293bdf2cd640b3</sum>
        </package>
        <package name="tomcat9-webapps" arch="noarch" epoch="1" version="9.0.87" release="5.el10_0.3" src="tomcat9-9.0.87-5.el10_0.3.src.rpm">
          <filename>tomcat9-webapps-9.0.87-5.el10_0.3.noarch.rpm</filename>
          <sum type="sha256">a92fb0bc741de5bed29ded39ffc1090c13d44d8e4663ed876455b9ec62dc79f0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14179</id>
    <title>Important: tomcat security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for tomcat.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies.

Security Fix(es):

* tomcat: Apache Tomcat DoS in multipart upload (CVE-2025-48988)

* tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources (CVE-2025-49125)

* apache-commons-fileupload: Apache Commons FileUpload DoS via part headers (CVE-2025-48976)

* tomcat: http/2 "MadeYouReset" DoS attack through HTTP/2 control frames (CVE-2025-48989)

* tomcat: Apache Tomcat denial of service (CVE-2025-52520)

* tomcat: Apache Tomcat denial of service (CVE-2025-53506)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48976" id="CVE-2025-48976" type="cve" title="CVE-2025-48976" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48988" id="CVE-2025-48988" type="cve" title="CVE-2025-48988" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48989" id="CVE-2025-48989" type="cve" title="CVE-2025-48989" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49125" id="CVE-2025-49125" type="cve" title="CVE-2025-49125" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-52520" id="CVE-2025-52520" type="cve" title="CVE-2025-52520" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53506" id="CVE-2025-53506" type="cve" title="CVE-2025-53506" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373015" id="2373015" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373018" id="2373018" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373020" id="2373020" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373309" id="2373309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379374" id="2379374" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2379386" id="2379386" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14179" id="RLSA-2025:14179" type="self" title="RLSA-2025:14179" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="tomcat" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">ecb917e318806b30780490e980d3321c09c3a9d0a55191e03a6e6aa155bb2f9b</sum>
        </package>
        <package name="tomcat-admin-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-admin-webapps-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">a170a83d4db067f3716cc75b312457ae573a69b8abc08e35bf067456dd8d6556</sum>
        </package>
        <package name="tomcat-docs-webapp" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-docs-webapp-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">afc999a8b23e6e5bcd6fa3cb5dd0cec0c53b7092bdb3c8f5763ba7523102d44c</sum>
        </package>
        <package name="tomcat-el-5.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-el-5.0-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">d74a96e6451c0457caf006ecf5cb3f9c05a335f5155526ff7e43ea76d96de5ec</sum>
        </package>
        <package name="tomcat-jsp-3.1-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-jsp-3.1-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">40f0d2b7943d8439b32a461f3b324e8add8d7a2eb2989ca4c685b0a4ff0806bd</sum>
        </package>
        <package name="tomcat-lib" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-lib-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">ae430958b25c1ff702c75b963827c5cd5c79c9d0e1b7cc97c10a86e80c3e2625</sum>
        </package>
        <package name="tomcat-servlet-6.0-api" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-servlet-6.0-api-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">eafac0514a1c171b579247cb0bd32de6b9e6446344213797e664d21eb1f5ee3f</sum>
        </package>
        <package name="tomcat-webapps" arch="noarch" epoch="1" version="10.1.36" release="1.el10_0.2" src="tomcat-10.1.36-1.el10_0.2.src.rpm">
          <filename>tomcat-webapps-10.1.36-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">b7378649e8898b6bbbbaaf8633261fdfb57139d41c243d6269728b2a2ecaf834</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14417</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)

* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)

* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)

* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9179" id="CVE-2025-9179" type="cve" title="CVE-2025-9179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9180" id="CVE-2025-9180" type="cve" title="CVE-2025-9180" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9181" id="CVE-2025-9181" type="cve" title="CVE-2025-9181" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9182" id="CVE-2025-9182" type="cve" title="CVE-2025-9182" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9185" id="CVE-2025-9185" type="cve" title="CVE-2025-9185" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389575" id="2389575" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389580" id="2389580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389581" id="2389581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389583" id="2389583" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389584" id="2389584" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14417" id="RLSA-2025:14417" type="self" title="RLSA-2025:14417" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="128.14.0" release="2.el10_0" src="firefox-128.14.0-2.el10_0.src.rpm">
          <filename>firefox-128.14.0-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8021d23980e6eaf4d756b751caba4f8e299816ed4d5872891a6b8298ac454d93</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14592</id>
    <title>Important: aide security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for aide.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Advanced Intrusion Detection Environment (AIDE) is a utility that creates a database of files on the system, and then uses that database to ensure file integrity and detect system intrusions.

Security Fix(es):

* aide: improper output neutralization enables bypassing (CVE-2025-54389)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-54389" id="CVE-2025-54389" type="cve" title="CVE-2025-54389" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388019" id="2388019" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14592" id="RLSA-2025:14592" type="self" title="RLSA-2025:14592" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="aide" arch="aarch64" epoch="0" version="0.18.6" release="8.el10_0.2" src="aide-0.18.6-8.el10_0.2.src.rpm">
          <filename>aide-0.18.6-8.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">31c3c97e21cf56d8aa6416f5084fbb010eb003765b5e8fbfe57073c1f13aaf61</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14625</id>
    <title>Moderate: mod_http2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mod_http2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The mod_h2 Apache httpd module implements the HTTP2 protocol (h2+h2c) on top of libnghttp2 for httpd 2.4 servers.

Security Fix(es):

* httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49630" id="CVE-2025-49630" type="cve" title="CVE-2025-49630" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374578" id="2374578" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14625" id="RLSA-2025:14625" type="self" title="RLSA-2025:14625" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mod_http2" arch="aarch64" epoch="0" version="2.0.29" release="2.el10_0.1" src="mod_http2-2.0.29-2.el10_0.1.src.rpm">
          <filename>mod_http2-2.0.29-2.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">b6d8d920e34e84024b1ddee381bc1ae8530e1c65de09c17aa73e349bfab8e866</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14826</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for postgresql16.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system.  These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection.  The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL executes arbitrary code in restore operation (CVE-2025-8715)

* postgresql: PostgreSQL code execution in restore operation (CVE-2025-8714)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8714" id="CVE-2025-8714" type="cve" title="CVE-2025-8714" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8715" id="CVE-2025-8715" type="cve" title="CVE-2025-8715" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388551" id="2388551" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388553" id="2388553" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14826" id="RLSA-2025:14826" type="self" title="RLSA-2025:14826" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="postgresql" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6fffa109992b6454304b1d391ba602e5f28410bc97766498ddb55fe024ce53df</sum>
        </package>
        <package name="postgresql-contrib" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-contrib-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">7ca2027c04188036e6a035e6016a6c4ebecf6b35ba301c8f38e6fdd3aec1325d</sum>
        </package>
        <package name="postgresql-docs" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-docs-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4cecd69122d8c9ab4d78e5c69f1e5057aa29dd1459d7823c0819fdfc76167e87</sum>
        </package>
        <package name="postgresql-plperl" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-plperl-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">da5043babcfae9dfa958426dee7a19fa1cc2a618b7684986eeab66de87cac094</sum>
        </package>
        <package name="postgresql-plpython3" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-plpython3-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9a9e2fcc50ea01f044d0e5629201d6f2ca40ab7ef10752da32b418d7e35f830f</sum>
        </package>
        <package name="postgresql-pltcl" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-pltcl-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">78d3444758c3b1cc167b979457fbbcb9de80f29c96de4d4f67f6e4929472c256</sum>
        </package>
        <package name="postgresql-private-devel" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-private-devel-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0b2e016dd46a800371eb71c1939c40e6d172038e9a962ce07370b598c9f6db96</sum>
        </package>
        <package name="postgresql-private-libs" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-private-libs-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">f28d394ad17a0fb46a3aa8b0c68037aa80307dddb12d414980d8667debbe8344</sum>
        </package>
        <package name="postgresql-server" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-server-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">4c475ef0f895d22b7404a4a4ec0fdb6f5146bd16e60c93ec312f3505cfdc0225</sum>
        </package>
        <package name="postgresql-server-devel" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-server-devel-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">89ff8d4e1082e7af2a4ca47246a0e9e5501cebe5f9537737322b55c32cecd185</sum>
        </package>
        <package name="postgresql-static" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-static-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">541ce40e8b5854fd4be38b2235915cd55825791ff61cc28c63d568c01ac1e464</sum>
        </package>
        <package name="postgresql-test" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-test-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b089517a0cc70ad45209bb96927af55990fb39cff829f60cb5ca0c09109947af</sum>
        </package>
        <package name="postgresql-upgrade" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-upgrade-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">6248863faf3daff9633b7fb37c0c0e835999f3f74e6300666a2ed3f58489d483</sum>
        </package>
        <package name="postgresql-upgrade-devel" arch="aarch64" epoch="0" version="16.10" release="1.el10_0" src="postgresql16-16.10-1.el10_0.src.rpm">
          <filename>postgresql-upgrade-devel-16.10-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">e712801f63431317bca28ca4cc74b9cdb72d9500e7c2c989c2fda312f302bb56</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:14844</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:12" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Denial-of-service due to out-of-memory in the Graphics: WebRender component (CVE-2025-9182)

* thunderbird: firefox: Sandbox escape due to invalid pointer in the Audio/Video: GMP component (CVE-2025-9179)

* thunderbird: firefox: Same-origin policy bypass in the Graphics: Canvas2D component (CVE-2025-9180)

* thunderbird: firefox: Uninitialized memory in the JavaScript Engine component (CVE-2025-9181)

* thunderbird: firefox: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 (CVE-2025-9185)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9179" id="CVE-2025-9179" type="cve" title="CVE-2025-9179" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9180" id="CVE-2025-9180" type="cve" title="CVE-2025-9180" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9181" id="CVE-2025-9181" type="cve" title="CVE-2025-9181" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9182" id="CVE-2025-9182" type="cve" title="CVE-2025-9182" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9185" id="CVE-2025-9185" type="cve" title="CVE-2025-9185" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389575" id="2389575" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389580" id="2389580" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389581" id="2389581" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389583" id="2389583" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2389584" id="2389584" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:14844" id="RLSA-2025:14844" type="self" title="RLSA-2025:14844" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="128.14.0" release="3.el10_0" src="thunderbird-128.14.0-3.el10_0.src.rpm">
          <filename>thunderbird-128.14.0-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">740a1e1c00ccd393792876da789b99894f6702351d1ed5d18a76e7d0b7d82760</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15020</id>
    <title>Important: udisks2 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for udisks2.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The Udisks project provides a daemon, tools, and libraries to access and manipulate disks, storage devices, and technologies.

Security Fix(es):

* udisks: Out-of-bounds read in UDisks Daemon (CVE-2025-8067)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8067" id="CVE-2025-8067" type="cve" title="CVE-2025-8067" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2388623" id="2388623" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15020" id="RLSA-2025:15020" type="self" title="RLSA-2025:15020" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libudisks2" arch="aarch64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>libudisks2-2.10.90-5.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">0576af01bfa34f97811294dd23649d946e67255b5e30f3e3684dd32e175f6fd0</sum>
        </package>
        <package name="udisks2" arch="aarch64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-2.10.90-5.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">7077c6062ab0878227b0dc981b6396c7ec6964d1f666d4fca42a9a7851999d65</sum>
        </package>
        <package name="udisks2-iscsi" arch="aarch64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-iscsi-2.10.90-5.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">a4eff6d0580b9a043c2fff9a6d8e229565fb613615167bb049d7c3e26fc7aa5e</sum>
        </package>
        <package name="udisks2-lsm" arch="aarch64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-lsm-2.10.90-5.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">0a5578d363ffbf45779aec5fb24d000b5e950f4de4a72ec5eedc83f9868ce725</sum>
        </package>
        <package name="udisks2-lvm2" arch="aarch64" epoch="0" version="2.10.90" release="5.el10_0.1" src="udisks2-2.10.90-5.el10_0.1.src.rpm">
          <filename>udisks2-lvm2-2.10.90-5.el10_0.1.aarch64.rpm</filename>
          <sum type="sha256">5eed3dffdec9ade14c3424fc71e46b97258410ca2d4f95e11e75d3e0d9cb0e13</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15095</id>
    <title>Moderate: httpd security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for httpd.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252)

* httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048)

* httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47252" id="CVE-2024-47252" type="cve" title="CVE-2024-47252" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-23048" id="CVE-2025-23048" type="cve" title="CVE-2025-23048" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49812" id="CVE-2025-49812" type="cve" title="CVE-2025-49812" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374571" id="2374571" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374576" id="2374576" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2374580" id="2374580" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15095" id="RLSA-2025:15095" type="self" title="RLSA-2025:15095" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="httpd" arch="aarch64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">6cea1701c9dae5042886268c3d16dd16eb74f687cbbf81bb359c3122d71ca8ab</sum>
        </package>
        <package name="httpd-core" arch="aarch64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-core-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">3bc795192ef970272157cb8f0ee59091f94e1459e646481fa715f0b1f19069e0</sum>
        </package>
        <package name="httpd-devel" arch="aarch64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-devel-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">f31cb41a72f691d39906d2ed904f58855cf86e69802da581511a8cf893155e37</sum>
        </package>
        <package name="httpd-filesystem" arch="noarch" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-filesystem-2.4.63-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">5be7b3a8027ace91358c2f798e53f4dcc46b2e434314f8c1cca16d3d37b96673</sum>
        </package>
        <package name="httpd-manual" arch="noarch" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-manual-2.4.63-1.el10_0.2.noarch.rpm</filename>
          <sum type="sha256">f55510c6628918f1cb42924ddff3203f84c000b1cd1e4db33205dc9ed5d67887</sum>
        </package>
        <package name="httpd-tools" arch="aarch64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>httpd-tools-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">7556909c3606c7a8436c962294c9abd4f7195b88aad4e5c0c7f7ae11d7d1813a</sum>
        </package>
        <package name="mod_ldap" arch="aarch64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_ldap-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">a4f0d41ba3250620e7d50196347cee63bcf6eb1d8f2b608a12f4c97f6e2aadc2</sum>
        </package>
        <package name="mod_lua" arch="aarch64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_lua-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">9e6193fb99115fab98a16df8ce3e000638ad92a254b0eee086ceef4eab92fa6b</sum>
        </package>
        <package name="mod_proxy_html" arch="aarch64" epoch="1" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_proxy_html-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">bf06e5422ccff323dc4206d297cb640f420668ec2fd3cc48792e2ce774bec0d5</sum>
        </package>
        <package name="mod_session" arch="aarch64" epoch="0" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_session-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">33f6fc88db7abf9f03897c609e8bb731b3dddb06abd29f90a63923bb0dbdf872</sum>
        </package>
        <package name="mod_ssl" arch="aarch64" epoch="1" version="2.4.63" release="1.el10_0.2" src="httpd-2.4.63-1.el10_0.2.src.rpm">
          <filename>mod_ssl-2.4.63-1.el10_0.2.aarch64.rpm</filename>
          <sum type="sha256">e7397ecfd5a8c65afea39be46bdb4b456f118fd465023b063b24554e3b0ad0a2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15699</id>
    <title>Moderate: mysql-selinux and mysql8.4 security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for mysql8.4, mysql-selinux.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>MySQL is a multi-user, multi-threaded SQL database server. MySQL is a client/server implementation consisting of a server daemon (mysqld) and many different client programs and libraries. The base package contains the standard MySQL client programs and generic MySQL files.

Security Fix(es):

* openssl: Timing side-channel in ECDSA signature computation (CVE-2024-13176)

* mysql: mysqldump unspecified vulnerability (CPU Apr 2025) (CVE-2025-30722)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30688)

* mysql: Stored Procedure unspecified vulnerability (CPU Apr 2025) (CVE-2025-30699)

* mysql: UDF unspecified vulnerability (CPU Apr 2025) (CVE-2025-30721)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30682)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30683)

* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30715)

* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21574)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21585)

* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21588)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30681)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-21577)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30687)

* mysql: DML unspecified vulnerability (CPU Apr 2025) (CVE-2025-21580)

* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30696)

* mysql: PS unspecified vulnerability (CPU Apr 2025) (CVE-2025-30705)

* mysql: Parser unspecified vulnerability (CPU Apr 2025) (CVE-2025-21575)

* mysql: Options unspecified vulnerability (CPU Apr 2025) (CVE-2025-21579)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30685)

* mysql: Components Services unspecified vulnerability (CPU Apr 2025) (CVE-2025-30704)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-21581)

* mysql: Optimizer unspecified vulnerability (CPU Apr 2025) (CVE-2025-30689)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30695)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30703)

* mysql: InnoDB unspecified vulnerability (CPU Apr 2025) (CVE-2025-30693)

* mysql: DDL unspecified vulnerability (CPU Apr 2025) (CVE-2025-21584)

* mysql: Replication unspecified vulnerability (CPU Apr 2025) (CVE-2025-30684)

* curl: libcurl: WebSocket endless loop (CVE-2025-5399)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50092)

* mysql: mysqldump unspecified vulnerability (CPU Jul 2025) (CVE-2025-50081)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50079)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50077)

* mysql: DML unspecified vulnerability (CPU Jul 2025) (CVE-2025-50078)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50091)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50101)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50093)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50099)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50085)

* mysql: Components Services unspecified vulnerability (CPU Jul 2025) (CVE-2025-50086)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50082)

* mysql: Encryption unspecified vulnerability (CPU Jul 2025) (CVE-2025-50097)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50104)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50087)

* mysql: Stored Procedure unspecified vulnerability (CPU Jul 2025) (CVE-2025-50080)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50088)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50083)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50084)

* mysql: Thread Pooling unspecified vulnerability (CPU Jul 2025) (CVE-2025-50100)

* mysql: DDL unspecified vulnerability (CPU Jul 2025) (CVE-2025-50094)

* mysql: Optimizer  unspecified vulnerability (CPU Jul 2025) (CVE-2025-50098)

* mysql: InnoDB unspecified vulnerability (CPU Jul 2025) (CVE-2025-50096)

* mysql: Optimizer unspecified vulnerability (CPU Jul 2025) (CVE-2025-50102)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13176" id="CVE-2024-13176" type="cve" title="CVE-2024-13176" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21574" id="CVE-2025-21574" type="cve" title="CVE-2025-21574" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21575" id="CVE-2025-21575" type="cve" title="CVE-2025-21575" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21577" id="CVE-2025-21577" type="cve" title="CVE-2025-21577" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21579" id="CVE-2025-21579" type="cve" title="CVE-2025-21579" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21580" id="CVE-2025-21580" type="cve" title="CVE-2025-21580" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21581" id="CVE-2025-21581" type="cve" title="CVE-2025-21581" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21584" id="CVE-2025-21584" type="cve" title="CVE-2025-21584" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21585" id="CVE-2025-21585" type="cve" title="CVE-2025-21585" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-21588" id="CVE-2025-21588" type="cve" title="CVE-2025-21588" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30681" id="CVE-2025-30681" type="cve" title="CVE-2025-30681" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30682" id="CVE-2025-30682" type="cve" title="CVE-2025-30682" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30683" id="CVE-2025-30683" type="cve" title="CVE-2025-30683" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30684" id="CVE-2025-30684" type="cve" title="CVE-2025-30684" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30685" id="CVE-2025-30685" type="cve" title="CVE-2025-30685" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30687" id="CVE-2025-30687" type="cve" title="CVE-2025-30687" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30688" id="CVE-2025-30688" type="cve" title="CVE-2025-30688" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30689" id="CVE-2025-30689" type="cve" title="CVE-2025-30689" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30693" id="CVE-2025-30693" type="cve" title="CVE-2025-30693" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30695" id="CVE-2025-30695" type="cve" title="CVE-2025-30695" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30696" id="CVE-2025-30696" type="cve" title="CVE-2025-30696" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30699" id="CVE-2025-30699" type="cve" title="CVE-2025-30699" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30703" id="CVE-2025-30703" type="cve" title="CVE-2025-30703" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30704" id="CVE-2025-30704" type="cve" title="CVE-2025-30704" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30705" id="CVE-2025-30705" type="cve" title="CVE-2025-30705" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30715" id="CVE-2025-30715" type="cve" title="CVE-2025-30715" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30721" id="CVE-2025-30721" type="cve" title="CVE-2025-30721" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-30722" id="CVE-2025-30722" type="cve" title="CVE-2025-30722" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50077" id="CVE-2025-50077" type="cve" title="CVE-2025-50077" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50078" id="CVE-2025-50078" type="cve" title="CVE-2025-50078" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50079" id="CVE-2025-50079" type="cve" title="CVE-2025-50079" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50080" id="CVE-2025-50080" type="cve" title="CVE-2025-50080" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50081" id="CVE-2025-50081" type="cve" title="CVE-2025-50081" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50082" id="CVE-2025-50082" type="cve" title="CVE-2025-50082" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50083" id="CVE-2025-50083" type="cve" title="CVE-2025-50083" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50084" id="CVE-2025-50084" type="cve" title="CVE-2025-50084" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50085" id="CVE-2025-50085" type="cve" title="CVE-2025-50085" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50086" id="CVE-2025-50086" type="cve" title="CVE-2025-50086" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50087" id="CVE-2025-50087" type="cve" title="CVE-2025-50087" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50088" id="CVE-2025-50088" type="cve" title="CVE-2025-50088" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50091" id="CVE-2025-50091" type="cve" title="CVE-2025-50091" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50092" id="CVE-2025-50092" type="cve" title="CVE-2025-50092" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50093" id="CVE-2025-50093" type="cve" title="CVE-2025-50093" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50094" id="CVE-2025-50094" type="cve" title="CVE-2025-50094" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50096" id="CVE-2025-50096" type="cve" title="CVE-2025-50096" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50097" id="CVE-2025-50097" type="cve" title="CVE-2025-50097" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50098" id="CVE-2025-50098" type="cve" title="CVE-2025-50098" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50099" id="CVE-2025-50099" type="cve" title="CVE-2025-50099" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50100" id="CVE-2025-50100" type="cve" title="CVE-2025-50100" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50101" id="CVE-2025-50101" type="cve" title="CVE-2025-50101" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50102" id="CVE-2025-50102" type="cve" title="CVE-2025-50102" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50104" id="CVE-2025-50104" type="cve" title="CVE-2025-50104" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-5399" id="CVE-2025-5399" type="cve" title="CVE-2025-5399" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2338999" id="2338999" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359885" id="2359885" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359888" id="2359888" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359892" id="2359892" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359894" id="2359894" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359895" id="2359895" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359899" id="2359899" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359900" id="2359900" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359902" id="2359902" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359903" id="2359903" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359911" id="2359911" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359918" id="2359918" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359920" id="2359920" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359924" id="2359924" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359928" id="2359928" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359930" id="2359930" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359932" id="2359932" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359934" id="2359934" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359938" id="2359938" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359940" id="2359940" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359943" id="2359943" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359944" id="2359944" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359945" id="2359945" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359947" id="2359947" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359950" id="2359950" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359963" id="2359963" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359964" id="2359964" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2359972" id="2359972" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2370920" id="2370920" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380264" id="2380264" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380273" id="2380273" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380274" id="2380274" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380278" id="2380278" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380280" id="2380280" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380283" id="2380283" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380284" id="2380284" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380290" id="2380290" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380291" id="2380291" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380295" id="2380295" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380298" id="2380298" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380306" id="2380306" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380308" id="2380308" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380309" id="2380309" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380310" id="2380310" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380312" id="2380312" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380313" id="2380313" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380320" id="2380320" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380321" id="2380321" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380322" id="2380322" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380326" id="2380326" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380327" id="2380327" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380334" id="2380334" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2380335" id="2380335" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15699" id="RLSA-2025:15699" type="self" title="RLSA-2025:15699" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="mysql8.4" arch="aarch64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-8.4.6-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">697d4d8ec6f4f03ac95959e09ff1df722284dc7d4d9efd405f98fe735d728101</sum>
        </package>
        <package name="mysql8.4-common" arch="noarch" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-common-8.4.6-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">b00f64905687fb131a234fa7eb8cfbf01c82d55158e117d99ce6b0f8dfff877c</sum>
        </package>
        <package name="mysql8.4-errmsg" arch="noarch" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-errmsg-8.4.6-2.el10_0.noarch.rpm</filename>
          <sum type="sha256">4e4119b62c7395860583065fc1a0792e5cf336b0e3820babc0b39cc7de6528f0</sum>
        </package>
        <package name="mysql8.4-libs" arch="aarch64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-libs-8.4.6-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0e8a8e33180134c110f049ed836265a2189c048e6b745871cc1f7a21bce6d8d7</sum>
        </package>
        <package name="mysql8.4-server" arch="aarch64" epoch="0" version="8.4.6" release="2.el10_0" src="mysql8.4-8.4.6-2.el10_0.src.rpm">
          <filename>mysql8.4-server-8.4.6-2.el10_0.aarch64.rpm</filename>
          <sum type="sha256">aa48465ce6e4fb50c8f06114894f5c2663a05689cf7717ef8dade8dd89c8828f</sum>
        </package>
        <package name="mysql-selinux" arch="noarch" epoch="0" version="1.0.14" release="1.el10_0" src="mysql-selinux-1.0.14-1.el10_0.src.rpm">
          <filename>mysql-selinux-1.0.14-1.el10_0.noarch.rpm</filename>
          <sum type="sha256">6e96fc73b86d1fcb2205efe0362501f06665351449502bf0ca4bd11e15c17025</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:15901</id>
    <title>Important: podman security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for podman.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.

Security Fix(es):

* podman: Podman kube play command may overwrite host files (CVE-2025-9566)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9566" id="CVE-2025-9566" type="cve" title="CVE-2025-9566" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2393152" id="2393152" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:15901" id="RLSA-2025:15901" type="self" title="RLSA-2025:15901" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="podman" arch="aarch64" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-5.4.0-13.el10_0.aarch64.rpm</filename>
          <sum type="sha256">8a80c615a19cddafc08963572e8f25bdf1fdc3169629e354ce3ccae869e3dfaa</sum>
        </package>
        <package name="podman-docker" arch="noarch" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-docker-5.4.0-13.el10_0.noarch.rpm</filename>
          <sum type="sha256">d244c5274a4dcfb729f6b4dbaa6d690299fe89c525f5c66f69555dfca5fe9963</sum>
        </package>
        <package name="podman-remote" arch="aarch64" epoch="6" version="5.4.0" release="13.el10_0" src="podman-5.4.0-13.el10_0.src.rpm">
          <filename>podman-remote-5.4.0-13.el10_0.aarch64.rpm</filename>
          <sum type="sha256">1af574e69db90adc73d42f81ac65965a1a5622c8a78c2c848b369eed974efd43</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16109</id>
    <title>Important: firefox security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:13" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for firefox.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)

* firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)

* firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)

* firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)

* firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527" id="CVE-2025-10527" type="cve" title="CVE-2025-10527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528" id="CVE-2025-10528" type="cve" title="CVE-2025-10528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529" id="CVE-2025-10529" type="cve" title="CVE-2025-10529" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532" id="CVE-2025-10532" type="cve" title="CVE-2025-10532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533" id="CVE-2025-10533" type="cve" title="CVE-2025-10533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536" id="CVE-2025-10536" type="cve" title="CVE-2025-10536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537" id="CVE-2025-10537" type="cve" title="CVE-2025-10537" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395745" id="2395745" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395754" id="2395754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395755" id="2395755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395756" id="2395756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395759" id="2395759" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395764" id="2395764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395766" id="2395766" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16109" id="RLSA-2025:16109" type="self" title="RLSA-2025:16109" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="firefox" arch="aarch64" epoch="0" version="140.3.0" release="1.el10_0" src="firefox-140.3.0-1.el10_0.src.rpm">
          <filename>firefox-140.3.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">b8d13747225299e999c26eac1088fe785b0460eb93f7e78e6e10796e4c5db3cf</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16157</id>
    <title>Important: thunderbird security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>An update is available for thunderbird.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Mozilla Thunderbird is a standalone mail and newsgroup client.

Security Fix(es):

* firefox: thunderbird: Sandbox escape due to use-after-free in the Graphics: Canvas2D component (CVE-2025-10527)

* firefox: thunderbird: Incorrect boundary conditions in the JavaScript: GC component (CVE-2025-10532)

* firefox: thunderbird: Sandbox escape due to undefined behavior, invalid pointer in the Graphics: Canvas2D component (CVE-2025-10528)

* firefox: thunderbird: Same-origin policy bypass in the Layout component (CVE-2025-10529)

* firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 140.3, Thunderbird ESR 140.3, Firefox 143 and Thunderbird 143 (CVE-2025-10537)

* firefox: thunderbird: Information disclosure in the Networking: Cache component (CVE-2025-10536)

* firefox: thunderbird: Integer overflow in the SVG component (CVE-2025-10533)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10527" id="CVE-2025-10527" type="cve" title="CVE-2025-10527" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10528" id="CVE-2025-10528" type="cve" title="CVE-2025-10528" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10529" id="CVE-2025-10529" type="cve" title="CVE-2025-10529" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10532" id="CVE-2025-10532" type="cve" title="CVE-2025-10532" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10533" id="CVE-2025-10533" type="cve" title="CVE-2025-10533" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10536" id="CVE-2025-10536" type="cve" title="CVE-2025-10536" />
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-10537" id="CVE-2025-10537" type="cve" title="CVE-2025-10537" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395745" id="2395745" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395754" id="2395754" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395755" id="2395755" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395756" id="2395756" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395759" id="2395759" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395764" id="2395764" type="bugzilla" title="" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2395766" id="2395766" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16157" id="RLSA-2025:16157" type="self" title="RLSA-2025:16157" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="thunderbird" arch="aarch64" epoch="0" version="140.3.0" release="1.el10_0" src="thunderbird-140.3.0-1.el10_0.src.rpm">
          <filename>thunderbird-140.3.0-1.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9b8038f0576d6d9138d123cf6e5ae82d622d4492cd344cdc572d50ad7a045d08</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16432</id>
    <title>Moderate: opentelemetry-collector security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for opentelemetry-collector.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/http: Sensitive headers not cleared on cross-origin redirect in net/http (CVE-2025-4673)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4673" id="CVE-2025-4673" type="cve" title="CVE-2025-4673" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2373305" id="2373305" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16432" id="RLSA-2025:16432" type="self" title="RLSA-2025:16432" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="opentelemetry-collector" arch="aarch64" epoch="0" version="0.127.0" release="3.el10_0" src="opentelemetry-collector-0.127.0-3.el10_0.src.rpm">
          <filename>opentelemetry-collector-0.127.0-3.el10_0.aarch64.rpm</filename>
          <sum type="sha256">9473a67556c27fd9cb2e81fce975b6ee3cf4b388830c31c03eca88212dc79f40</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="releng@rockylinux.org" status="final" type="security" version="2">
    <id>RLSA-2025:16428</id>
    <title>Moderate: libtpms security update</title>
    <issued date="2025-10-03 19:56:45" />
    <updated date="2025-10-17 08:18:14" />
    <rights>Copyright 2026 Rocky Enterprise Software Foundation</rights>
    <release>Rocky Linux 10</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>An update is available for libtpms.
This update affects Rocky Linux 10.
A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list</summary>
    <description>The libtpms is a library providing Trusted Platform Module (TPM) functionality for virtual machines.

Security Fix(es):

* libtpms: Libtpms Out-of-Bounds Read Vulnerability (CVE-2025-49133)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</description>
    <solution />
    <references>
      <reference href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-49133" id="CVE-2025-49133" type="cve" title="CVE-2025-49133" />
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2371585" id="2371585" type="bugzilla" title="" />
      <reference href="https://errata.rockylinux.org/RLSA-2025:16428" id="RLSA-2025:16428" type="self" title="RLSA-2025:16428" />
    </references>
    <pkglist>
      <collection short="rocky-linux-10-aarch64-appstream-rpms">
        <name>rocky-linux-10-aarch64-appstream-rpms</name>
        <package name="libtpms" arch="aarch64" epoch="0" version="0.9.6" release="11.el10_0" src="libtpms-0.9.6-11.el10_0.src.rpm">
          <filename>libtpms-0.9.6-11.el10_0.aarch64.rpm</filename>
          <sum type="sha256">0fbd2094685d8174e0296a6f7114216da3410a37a87cfb812b3b843e7124a1ae</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>