<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18142</id>
    <title>Low: NetworkManager security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Low</severity>
    <summary>NetworkManager security update</summary>
    <description>NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when available. Its capabilities include managing Ethernet, wireless, mobile broadband (WWAN), and PPPoE devices, as well as providing VPN integration with a variety of different VPN services.  

Security Fix(es):  

  * networkmanagr: NetworkManager File Access (CVE-2025-9615)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18142" id="RHSA-2026:18142" type="rhsa" title="RHSA-2026:18142"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-9615" id="CVE-2025-9615" type="cve" title="CVE-2025-9615"/>
      <reference href="https://bugzilla.redhat.com/2391503" id="2391503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18142.html" id="ALSA-2026:18142" type="self" title="ALSA-2026:18142"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="NetworkManager-libnm-devel" version="1.56.0" release="1.el10" epoch="1" arch="x86_64_v2" src="NetworkManager-1.56.0-1.el10.src.rpm">
          <filename>NetworkManager-libnm-devel-1.56.0-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">72234f557d5255325f40e174ab0f2063f048eaed12d59a6d3adac30cf4c806eb</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18326</id>
    <title>Moderate: libvirt security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:29:10"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libvirt security update</summary>
    <description>Kernel-based Virtual Machine (KVM) offers a full virtualization solution forLinux on numerous hardware platforms. The virt:rhel module contains packageswhich provide user-space components used to run virtual machines using KVM.The packages also provide APIs for managing and interacting with the virtualized systems.  

Security Fix(es):  

  * libvirt: Denial of service in XML parsing (CVE-2025-12748)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18326" id="RHSA-2026:18326" type="rhsa" title="RHSA-2026:18326"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-12748" id="CVE-2025-12748" type="cve" title="CVE-2025-12748"/>
      <reference href="https://bugzilla.redhat.com/2413801" id="2413801" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18326.html" id="ALSA-2026:18326" type="self" title="ALSA-2026:18326"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="libvirt-docs" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-docs-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">350938d9d9464c8e30536bf39887ac5bf38331c0cec47d8121b1a95f2d45e7e6</sum>
        </package>
        <package name="libvirt-daemon-plugin-sanlock" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-daemon-plugin-sanlock-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">b6bbbdbd5ca40c1ac7c1bab63962c8b99e7d52a0cf633e68f4ed1908ad490c6a</sum>
        </package>
        <package name="libvirt-devel" version="11.10.0" release="12.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="libvirt-11.10.0-12.el10_2.alma.1.src.rpm">
          <filename>libvirt-devel-11.10.0-12.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">de0c3c516a13e09fe77783a225566b61eb300aac3e4da266ccba992fe2aa728b</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18344</id>
    <title>Moderate: mingw-glib2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:32:05"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>mingw-glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: Integer overflow in in g_escape_uri_string() (CVE-2025-13601)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18344" id="RHSA-2026:18344" type="rhsa" title="RHSA-2026:18344"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13601" id="CVE-2025-13601" type="cve" title="CVE-2025-13601"/>
      <reference href="https://bugzilla.redhat.com/2416741" id="2416741" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18344.html" id="ALSA-2026:18344" type="self" title="ALSA-2026:18344"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="mingw64-glib2" version="2.87.0" release="1.el10" epoch="0" arch="noarch" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw64-glib2-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">42ed093bc3dc8f1fc68c689c21d0a4564f64be06967ea58288c572bee38fed74</sum>
        </package>
        <package name="mingw32-glib2" version="2.87.0" release="1.el10" epoch="0" arch="noarch" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw32-glib2-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">71f0696f3c21329d4b6bd97eac360cc9494b2a9a6514c8284de7460c2aebba0c</sum>
        </package>
        <package name="mingw32-glib2-static" version="2.87.0" release="1.el10" epoch="0" arch="noarch" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw32-glib2-static-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">bf1ab4eb25d4a23ceada04fabbab6ef9341eeea3e63c26dc72e5a48bf6396040</sum>
        </package>
        <package name="mingw64-glib2-static" version="2.87.0" release="1.el10" epoch="0" arch="noarch" src="mingw-glib2-2.87.0-1.el10.src.rpm">
          <filename>mingw64-glib2-static-2.87.0-1.el10.noarch.rpm</filename>
          <sum type="sha256">f037d4e7d160fa4ad0236a023dfa1dcfa15df8271ab9d34b0ff381254eec7224</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18421</id>
    <title>Moderate: luksmeta security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>luksmeta security update</summary>
    <description>LUKSMeta is a simple library for storing metadata in the LUKSv1 header. The luksmeta package is a dependency of the clevis and tang packages, together providing the Network Bound Disk Encryption (NBDE) in AlmaLinux.  

Security Fix(es):  

  * luksmeta: Data corruption when handling LUKS1 partitions with luksmeta (CVE-2025-11568)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18421" id="RHSA-2026:18421" type="rhsa" title="RHSA-2026:18421"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11568" id="CVE-2025-11568" type="cve" title="CVE-2025-11568"/>
      <reference href="https://bugzilla.redhat.com/2404244" id="2404244" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18421.html" id="ALSA-2026:18421" type="self" title="ALSA-2026:18421"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="libluksmeta-devel" version="10" release="1.el10" epoch="0" arch="x86_64_v2" src="luksmeta-10-1.el10.src.rpm">
          <filename>libluksmeta-devel-10-1.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">00807394e05fa9383262b51352ed8efa0cf117ea784bac47222deeab66951ab4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18465</id>
    <title>Important: edk2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:02"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>edk2 security update</summary>
    <description>EDK (Embedded Development Kit) is a project to enable UEFI support for Virtual Machines. This package contains a sample 64-bit UEFI firmware for QEMU and KVM.   

Security Fix(es):  

  * edk2: EDK2: Improper Input Validation allows arbitrary command execution (CVE-2025-2296)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18465" id="RHSA-2026:18465" type="rhsa" title="RHSA-2026:18465"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-2296" id="CVE-2025-2296" type="cve" title="CVE-2025-2296"/>
      <reference href="https://bugzilla.redhat.com/2420637" id="2420637" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18465.html" id="ALSA-2026:18465" type="self" title="ALSA-2026:18465"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="edk2-aarch64" version="20251114" release="5.el10_2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-aarch64-20251114-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">661e753247f1f87f60b2ab15a15e98b65bd5218f23543c33c5087b94428cc7aa</sum>
        </package>
        <package name="edk2-tools" version="20251114" release="5.el10_2" epoch="0" arch="x86_64_v2" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-tools-20251114-5.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ccb4c8f45fa79f2761aa1f16d9f60765f7503cd13fc10c192de1738bff66b7eb</sum>
        </package>
        <package name="edk2-tools-doc" version="20251114" release="5.el10_2" epoch="0" arch="noarch" src="edk2-20251114-5.el10_2.src.rpm">
          <filename>edk2-tools-doc-20251114-5.el10_2.noarch.rpm</filename>
          <sum type="sha256">e4125b18bdc63df22c74502b4db7c806c49d68b682c355411ff7150e30479c2e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:18556</id>
    <title>Moderate: unbound security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:11"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>unbound security update</summary>
    <description>The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver.   

Security Fix(es):  

  * unbound: DNSBomb vulnerability (CVE-2024-33655)
  * unbound: Unbound domain hijacking via promiscuous records (CVE-2025-11411)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.  

Additional Changes:  

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:18556" id="RHSA-2026:18556" type="rhsa" title="RHSA-2026:18556"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2024-33655" id="CVE-2024-33655" type="cve" title="CVE-2024-33655"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-11411" id="CVE-2025-11411" type="cve" title="CVE-2025-11411"/>
      <reference href="https://bugzilla.redhat.com/2279942" id="2279942" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2405706" id="2405706" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-18556.html" id="ALSA-2026:18556" type="self" title="ALSA-2026:18556"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="unbound-devel" version="1.24.2" release="7.el10" epoch="0" arch="x86_64_v2" src="unbound-1.24.2-7.el10.src.rpm">
          <filename>unbound-devel-1.24.2-7.el10.x86_64_v2.rpm</filename>
          <sum type="sha256">6578f1a467eb4da8681d778668699be324d0be60d116c82c1a51c53a184e8db3</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19009</id>
    <title>Important: postgresql18 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql18 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory (CVE-2026-2007)
  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19009" id="RHSA-2026:19009" type="rhsa" title="RHSA-2026:19009"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2007" id="CVE-2026-2007" type="cve" title="CVE-2026-2007"/>
      <reference href="https://bugzilla.redhat.com/2439320" id="2439320" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19009.html" id="ALSA-2026:19009" type="self" title="ALSA-2026:19009"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="postgresql18-test-rpm-macros" version="18.3" release="1.el10_2" epoch="0" arch="noarch" src="postgresql18-18.3-1.el10_2.src.rpm">
          <filename>postgresql18-test-rpm-macros-18.3-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">e9147c3a255628bd463c0f2320a7d06550e3494a0ceb08582a56325aabc74712</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19010</id>
    <title>Important: postgresql16 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:37"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>postgresql16 security update</summary>
    <description>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.  

Security Fix(es):  

  * postgresql: PostgreSQL oidvector discloses a few bytes of memory (CVE-2026-2003)
  * postgresql: PostgreSQL missing validation of multibyte character length executes arbitrary code (CVE-2026-2006)
  * postgresql: PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVE-2026-2004)
  * postgresql: PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVE-2026-2005)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19010" id="RHSA-2026:19010" type="rhsa" title="RHSA-2026:19010"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2003" id="CVE-2026-2003" type="cve" title="CVE-2026-2003"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2004" id="CVE-2026-2004" type="cve" title="CVE-2026-2004"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2005" id="CVE-2026-2005" type="cve" title="CVE-2026-2005"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2006" id="CVE-2026-2006" type="cve" title="CVE-2026-2006"/>
      <reference href="https://bugzilla.redhat.com/2439322" id="2439322" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439324" id="2439324" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439325" id="2439325" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2439326" id="2439326" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19010.html" id="ALSA-2026:19010" type="self" title="ALSA-2026:19010"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="postgresql-test-rpm-macros" version="16.13" release="1.el10_2" epoch="0" arch="noarch" src="postgresql16-16.13-1.el10_2.src.rpm">
          <filename>postgresql-test-rpm-macros-16.13-1.el10_2.noarch.rpm</filename>
          <sum type="sha256">d4481b8a457194d72857697fc9d4be3eea8b3c7d0946949734ed60169bef4a82</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19017</id>
    <title>Important: podman security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>podman security update</summary>
    <description>The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19017" id="RHSA-2026:19017" type="rhsa" title="RHSA-2026:19017"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34986" id="CVE-2026-34986" type="cve" title="CVE-2026-34986"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2455470" id="2455470" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19017.html" id="ALSA-2026:19017" type="self" title="ALSA-2026:19017"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="podman-tests" version="5.8.2" release="1.el10_2.alma.1" epoch="7" arch="x86_64_v2" src="podman-5.8.2-1.el10_2.alma.1.src.rpm">
          <filename>podman-tests-5.8.2-1.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4cd02d306ad8756ff8e8cd4886e0f5ad3e28083743ffda7f45f9ae2c5d7068d4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19019</id>
    <title>Important: python3.14 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:33:35"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.14 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * cpython: wsgiref.headers.Headers allows header newline injection in Python (CVE-2026-0865)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)
  * python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process. (CVE-2026-5713)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19019" id="RHSA-2026:19019" type="rhsa" title="RHSA-2026:19019"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0865" id="CVE-2026-0865" type="cve" title="CVE-2026-0865"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5713" id="CVE-2026-5713" type="cve" title="CVE-2026-5713"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2431367" id="2431367" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458239" id="2458239" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19019.html" id="ALSA-2026:19019" type="self" title="ALSA-2026:19019"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="python3.14-freethreading-tkinter" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-tkinter-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0763fb6ca90b83794300ef4a56ec142f7ddf4b81fe2e63613e9504aaba8e880d</sum>
        </package>
        <package name="python3.14-freethreading" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">093cab4b5e1c0c32cca057f505943424daa20310602b3288596138ec96a0d02c</sum>
        </package>
        <package name="python3.14-freethreading-debug" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-debug-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">482dc0a0d6f1118d59d1f8a12758e7ecf8de2fb8c3a848acb433c3e858e02a81</sum>
        </package>
        <package name="python3.14-freethreading-test" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-test-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">50b6b1b789288d67e40e01eef7098a4cf5f3bb6b210e3df976d46c16bcb7a71a</sum>
        </package>
        <package name="python3.14-freethreading-libs" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-libs-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">89c1297fbc62ddf1c541ab7755f3720257e25f6d1f576267b428c431ac79e748</sum>
        </package>
        <package name="python3.14-debug" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-debug-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">8d040b0b136c250c41ab3c5bf238494e99f18fd1e38ad566cdd1a6bf9d6fc5e4</sum>
        </package>
        <package name="python3.14-idle" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-idle-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">935f6c3c5edd43fc7a623c072f482bb06b80801783a0ecc6d4ca4a6a028d36d8</sum>
        </package>
        <package name="python3.14-freethreading-idle" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-idle-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">a13ebb0d6d1076be93e6a020f6377ba0a66f8b094a547e76c48aed506babf121</sum>
        </package>
        <package name="python3.14-freethreading-devel" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-freethreading-devel-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">c0bfb30ef666e7461864e6e16886501609332777e46cdc331a4e903aafed47bd</sum>
        </package>
        <package name="python3.14-test" version="3.14.4" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.14-3.14.4-2.el10_2.src.rpm">
          <filename>python3.14-test-3.14.4-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dc3ecf9949874b649940d0eb356f88fd3e5df4b4205edb55237b4c1372d5de27</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19024</id>
    <title>Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:14"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update</summary>
    <description>GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer.  

Security Fix(es):  

  * GStreamer: GStreamer: Arbitrary code execution via ASF file processing (CVE-2026-2920)
  * GStreamer: GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser (CVE-2026-3082)
  * GStreamer: GStreamer: Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay (CVE-2026-3085)
  * GStreamer: GStreamer: Arbitrary code execution via RIFF palette integer overflow in AVI file handling (CVE-2026-2921)
  * GStreamer: GStreamer: Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay (CVE-2026-3083)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer (CVE-2026-2922)
  * GStreamer: GStreamer: Remote Code Execution via out-of-bounds write in DVB Subtitles handling (CVE-2026-2923)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19024" id="RHSA-2026:19024" type="rhsa" title="RHSA-2026:19024"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2920" id="CVE-2026-2920" type="cve" title="CVE-2026-2920"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2921" id="CVE-2026-2921" type="cve" title="CVE-2026-2921"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2922" id="CVE-2026-2922" type="cve" title="CVE-2026-2922"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2923" id="CVE-2026-2923" type="cve" title="CVE-2026-2923"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3082" id="CVE-2026-3082" type="cve" title="CVE-2026-3082"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3083" id="CVE-2026-3083" type="cve" title="CVE-2026-3083"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3085" id="CVE-2026-3085" type="cve" title="CVE-2026-3085"/>
      <reference href="https://bugzilla.redhat.com/2447490" id="2447490" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447492" id="2447492" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447495" id="2447495" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447496" id="2447496" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447498" id="2447498" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447500" id="2447500" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2447503" id="2447503" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19024.html" id="ALSA-2026:19024" type="self" title="ALSA-2026:19024"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="gstreamer1-plugins-bad-free-devel" version="1.26.7" release="2.el10_2" epoch="0" arch="x86_64_v2" src="gstreamer1-plugins-bad-free-1.26.7-2.el10_2.src.rpm">
          <filename>gstreamer1-plugins-bad-free-devel-1.26.7-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5f0ef17c1ab398423e4da754337841e133df653cf973ac606a0a0587f457c6e5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19053</id>
    <title>Moderate: freeipmi security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:15"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>freeipmi security update</summary>
    <description>The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.  

Security Fix(es):  

  * freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19053" id="RHSA-2026:19053" type="rhsa" title="RHSA-2026:19053"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33554" id="CVE-2026-33554" type="cve" title="CVE-2026-33554"/>
      <reference href="https://bugzilla.redhat.com/2450778" id="2450778" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19053.html" id="ALSA-2026:19053" type="self" title="ALSA-2026:19053"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="freeipmi-devel" version="1.6.17" release="1.el10_2" epoch="0" arch="x86_64_v2" src="freeipmi-1.6.17-1.el10_2.src.rpm">
          <filename>freeipmi-devel-1.6.17-1.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">439acd15d8f6a5badbe683010be6d70da39ee0c84a2fe1f2d6317d4fb7289bd4</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19061</id>
    <title>Moderate: glibc security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:40"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glibc security update</summary>
    <description>The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.  

Security Fix(es):  

  * glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)
  * glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19061" id="RHSA-2026:19061" type="rhsa" title="RHSA-2026:19061"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4437" id="CVE-2026-4437" type="cve" title="CVE-2026-4437"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4438" id="CVE-2026-4438" type="cve" title="CVE-2026-4438"/>
      <reference href="https://bugzilla.redhat.com/2449777" id="2449777" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449783" id="2449783" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19061.html" id="ALSA-2026:19061" type="self" title="ALSA-2026:19061"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="nss_hesiod" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>nss_hesiod-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">39ecee7e62effed24b0e0bd0636d62cd0b0e3b8d4e618837a63d057988f02580</sum>
        </package>
        <package name="glibc-static" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-static-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">4bcba1d610549badc794d8f99413d51a4448b483dd760a883d052e28350df941</sum>
        </package>
        <package name="nss_db" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>nss_db-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">646a1344004fcc8593f701c9d4bb58698a744b15f5b7a107299bfa6b04b06611</sum>
        </package>
        <package name="glibc-nss-devel" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-nss-devel-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">67c437b44da1e2c59f1455c3f0414b5ecab6d25449e5302f29b46e59f888dae5</sum>
        </package>
        <package name="glibc-benchtests" version="2.39" release="121.el10_2.alma.1" epoch="0" arch="x86_64_v2" src="glibc-2.39-121.el10_2.alma.1.src.rpm">
          <filename>glibc-benchtests-2.39-121.el10_2.alma.1.x86_64_v2.rpm</filename>
          <sum type="sha256">aeda91b755e52c3aaeafbed521156337eec0018c4e0b4eb91616920db1c5bb82</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19064</id>
    <title>Important: python3.12 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:29:24"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>python3.12 security update</summary>
    <description>Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.  

Security Fix(es):  

  * expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing (CVE-2025-59375)
  * python: Quadratic complexity in os.path.expandvars() with user-controlled template (CVE-2025-6075)
  * cpython: Out-of-memory when loading Plist (CVE-2025-13837)
  * cpython: Header injection via newlines in data URL mediatype in Python (CVE-2025-15282)
  * cpython: Header injection in http.cookies.Morsel in Python (CVE-2026-0672)
  * cpython: CPython: Logging Bypass in Legacy .pyc File Handling (CVE-2026-2297)
  * cpython: Incomplete control character validation in http.cookies (CVE-2026-3644)
  * cpython: Stack overflow parsing XML with deeply nested DTD content models (CVE-2026-4224)
  * python: Python: Command-line option injection in webbrowser.open() via crafted URLs (CVE-2026-4519)
  * python: Python: HTTP header injection via CR/LF in proxy tunnel headers (CVE-2026-1502)
  * python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules (CVE-2026-6100)
  * python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API (CVE-2026-4786)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19064" id="RHSA-2026:19064" type="rhsa" title="RHSA-2026:19064"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-13837" id="CVE-2025-13837" type="cve" title="CVE-2025-13837"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-15282" id="CVE-2025-15282" type="cve" title="CVE-2025-15282"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59375" id="CVE-2025-59375" type="cve" title="CVE-2025-59375"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-6075" id="CVE-2025-6075" type="cve" title="CVE-2025-6075"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-0672" id="CVE-2026-0672" type="cve" title="CVE-2026-0672"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-1502" id="CVE-2026-1502" type="cve" title="CVE-2026-1502"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-2297" id="CVE-2026-2297" type="cve" title="CVE-2026-2297"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-3644" id="CVE-2026-3644" type="cve" title="CVE-2026-3644"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4224" id="CVE-2026-4224" type="cve" title="CVE-2026-4224"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4519" id="CVE-2026-4519" type="cve" title="CVE-2026-4519"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4786" id="CVE-2026-4786" type="cve" title="CVE-2026-4786"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-6100" id="CVE-2026-6100" type="cve" title="CVE-2026-6100"/>
      <reference href="https://bugzilla.redhat.com/2395108" id="2395108" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2408891" id="2408891" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2418084" id="2418084" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431366" id="2431366" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2431374" id="2431374" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2444691" id="2444691" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448168" id="2448168" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2448181" id="2448181" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2449649" id="2449649" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457409" id="2457409" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2457932" id="2457932" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458049" id="2458049" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19064.html" id="ALSA-2026:19064" type="self" title="ALSA-2026:19064"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="python3-test" version="3.12.13" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-test-3.12.13-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">0f64002959484d012d0bfc24827f036d809dd7e39333f36a736865543b22d3f7</sum>
        </package>
        <package name="python3-debug" version="3.12.13" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-debug-3.12.13-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">58c54d3cf70d6bbe9782055da1a70009fe3691065d62efe03440c0afa645f659</sum>
        </package>
        <package name="python3-idle" version="3.12.13" release="2.el10_2" epoch="0" arch="x86_64_v2" src="python3.12-3.12.13-2.el10_2.src.rpm">
          <filename>python3-idle-3.12.13-2.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">dcea26f416372f5adc2f1e79245a38987dea6df70638ac3cf6db878f679d82bc</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19074</id>
    <title>Important: kernel security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:29:29"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>kernel security update</summary>
    <description>The kernel packages contain the Linux kernel, the core of any Linux operating system.  

Security Fix(es):  

  * kernel: Linux kernel: Denial of Service in authencesn due to too-short AAD (CVE-2026-23060)
  * kernel: crypto: algif_aead - Revert to operating out-of-place (CVE-2026-31431)
  * kernel: crypto: af_alg - limit RX SG extraction by receive buffer budget (CVE-2026-31677)
  * kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-43284)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19074" id="RHSA-2026:19074" type="rhsa" title="RHSA-2026:19074"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23060" id="CVE-2026-23060" type="cve" title="CVE-2026-23060"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31431" id="CVE-2026-31431" type="cve" title="CVE-2026-31431"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-31677" id="CVE-2026-31677" type="cve" title="CVE-2026-31677"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-43284" id="CVE-2026-43284" type="cve" title="CVE-2026-43284"/>
      <reference href="https://bugzilla.redhat.com/2436779" id="2436779" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2460538" id="2460538" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2461763" id="2461763" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2467771" id="2467771" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19074.html" id="ALSA-2026:19074" type="self" title="ALSA-2026:19074"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="kernel-cross-headers" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-cross-headers-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">36353007bd2267fe558548f2439d287e9475eb9e422939df5b13897574ee708d</sum>
        </package>
        <package name="libperf" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>libperf-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">47bf8aeb5ab921dc022245373106ef3ec134589f0455a48e2afacc83ec7da23a</sum>
        </package>
        <package name="kernel-tools-libs-devel" version="6.12.0" release="211.7.3.el10_2" epoch="0" arch="x86_64_v2" src="kernel-6.12.0-211.7.3.el10_2.src.rpm">
          <filename>kernel-tools-libs-devel-6.12.0-211.7.3.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">726d2e253d3ad8102e5e6c3874cd4942a783b28c9b3e79d13b23a0d37aaf9ff5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19125</id>
    <title>Important: xorg-x11-server-Xwayland security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>xorg-x11-server-Xwayland security update</summary>
    <description>Xwayland is an X server for running X clients under Wayland.  

Security Fix(es):  

  * xorg: xwayland: X.Org X server: Denial of Service via integer underflow in XKB compatibility map handling (CVE-2026-33999)
  * xorg: xwayland: X.Org X server: Use-after-free vulnerability leads to server crash and potential memory corruption (CVE-2026-34001)
  * xorg: xwayland: X.Org X server: Information exposure and denial of service via out-of-bounds memory access (CVE-2026-34003)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19125" id="RHSA-2026:19125" type="rhsa" title="RHSA-2026:19125"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-33999" id="CVE-2026-33999" type="cve" title="CVE-2026-33999"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34001" id="CVE-2026-34001" type="cve" title="CVE-2026-34001"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-34003" id="CVE-2026-34003" type="cve" title="CVE-2026-34003"/>
      <reference href="https://bugzilla.redhat.com/2451106" id="2451106" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451109" id="2451109" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2451113" id="2451113" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19125.html" id="ALSA-2026:19125" type="self" title="ALSA-2026:19125"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="xorg-x11-server-Xwayland-devel" version="24.1.9" release="4.el10_2" epoch="0" arch="x86_64_v2" src="xorg-x11-server-Xwayland-24.1.9-4.el10_2.src.rpm">
          <filename>xorg-x11-server-Xwayland-devel-24.1.9-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">ad170b7558d038cf2b8943ad35d0dcc4383966e05aef6c5060382da5eea051d1</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19126</id>
    <title>Important: yggdrasil security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:18"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>yggdrasil security update</summary>
    <description>yggdrasil is a system daemon that subscribes to topics on an MQTT broker and routes any data received on the topics to an appropriate child "worker" process, exchanging data with its worker processes through a D-Bus message broker.  

Security Fix(es):  

  * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
  * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19126" id="RHSA-2026:19126" type="rhsa" title="RHSA-2026:19126"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-25679" id="CVE-2026-25679" type="cve" title="CVE-2026-25679"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-32283" id="CVE-2026-32283" type="cve" title="CVE-2026-32283"/>
      <reference href="https://bugzilla.redhat.com/2445356" id="2445356" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2456338" id="2456338" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19126.html" id="ALSA-2026:19126" type="self" title="ALSA-2026:19126"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="yggdrasil-devel" version="0.4.9" release="4.el10_2" epoch="0" arch="x86_64_v2" src="yggdrasil-0.4.9-4.el10_2.src.rpm">
          <filename>yggdrasil-devel-0.4.9-4.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">d0d891ea3455b06c0bf436e57499b66d113c5a431578887ab7a8d8bc15ec5eee</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19141</id>
    <title>Important: PackageKit security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:19"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>PackageKit security update</summary>
    <description>PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.  

Security Fix(es):  

  * PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19141" id="RHSA-2026:19141" type="rhsa" title="RHSA-2026:19141"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-41651" id="CVE-2026-41651" type="cve" title="CVE-2026-41651"/>
      <reference href="https://bugzilla.redhat.com/2460604" id="2460604" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19141.html" id="ALSA-2026:19141" type="self" title="ALSA-2026:19141"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="PackageKit-glib-devel" version="1.2.8" release="8.el10_2" epoch="0" arch="x86_64_v2" src="PackageKit-1.2.8-8.el10_2.src.rpm">
          <filename>PackageKit-glib-devel-1.2.8-8.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">5573d88df43d6b2c810d9484040f8b53a76b341f7af924142a999300bd6846a0</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19143</id>
    <title>Moderate: libsoup3 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:30:45"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>libsoup3 security update</summary>
    <description>Libsoup is an HTTP library implementation in C. It was originally part of a SOAP (Simple Object Access Protocol) implementation called Soup, but the SOAP and non-SOAP parts have now been split into separate packages. libsoup uses the Glib main loop and is designed to work well with GTK applications. This enables GNOME applications to access HTTP servers on the network in a completely asynchronous fashion, very similar to the Gtk+ programming model (a synchronous operation mode is also supported for those who want it), but the SOAP parts were removed long ago.  

Security Fix(es):  

  * libsoup: libsoup: Denial of Service via Use-After-Free in HTTP/2 server (CVE-2026-4271)
  * libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19143" id="RHSA-2026:19143" type="rhsa" title="RHSA-2026:19143"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4271" id="CVE-2026-4271" type="cve" title="CVE-2026-4271"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-5119" id="CVE-2026-5119" type="cve" title="CVE-2026-5119"/>
      <reference href="https://bugzilla.redhat.com/2448044" id="2448044" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452932" id="2452932" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19143.html" id="ALSA-2026:19143" type="self" title="ALSA-2026:19143"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="libsoup3-doc" version="3.6.5" release="3.el10_2.11" epoch="0" arch="noarch" src="libsoup3-3.6.5-3.el10_2.11.src.rpm">
          <filename>libsoup3-doc-3.6.5-3.el10_2.11.noarch.rpm</filename>
          <sum type="sha256">e9c9aacec423d69703716502eee70d36997b031b05b8cdd423d46cbd4cf7206c</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19148</id>
    <title>Moderate: glib2 security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:52"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Moderate</severity>
    <summary>glib2 security update</summary>
    <description>GLib provides the core application building blocks for libraries and applications written in C. It provides the core object system used in GNOME, the main loop implementation, and a large set of utility functions for strings and common data structures.  

Security Fix(es):  

  * glib: GLib: Buffer underflow in GVariant parser leads to heap corruption (CVE-2025-14087)
  * glib: Integer Overflow in GLib GIO Attribute Escaping Causes Heap Buffer Overflow (CVE-2025-14512)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19148" id="RHSA-2026:19148" type="rhsa" title="RHSA-2026:19148"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14087" id="CVE-2025-14087" type="cve" title="CVE-2025-14087"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-14512" id="CVE-2025-14512" type="cve" title="CVE-2025-14512"/>
      <reference href="https://bugzilla.redhat.com/2419093" id="2419093" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2421339" id="2421339" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19148.html" id="ALSA-2026:19148" type="self" title="ALSA-2026:19148"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="glib2-static" version="2.80.4" release="12.el10_2.13" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-static-2.80.4-12.el10_2.13.x86_64_v2.rpm</filename>
          <sum type="sha256">60baac00109d3b44a67e662765fc83cf9b217302d0ef1f7cbb26177242431b45</sum>
        </package>
        <package name="glib2-doc" version="2.80.4" release="12.el10_2.13" epoch="0" arch="x86_64_v2" src="glib2-2.80.4-12.el10_2.13.src.rpm">
          <filename>glib2-doc-2.80.4-12.el10_2.13.x86_64_v2.rpm</filename>
          <sum type="sha256">cefe109149f2c25733070c4867fe937ed798f90d46752fab7a123d2f3d3046e2</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19149</id>
    <title>Important: dovecot security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:20"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>dovecot security update</summary>
    <description>Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.   

Security Fix(es):  

  * dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
  * dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
  * dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19149" id="RHSA-2026:19149" type="rhsa" title="RHSA-2026:19149"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2025-59032" id="CVE-2025-59032" type="cve" title="CVE-2025-59032"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27857" id="CVE-2026-27857" type="cve" title="CVE-2026-27857"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-27858" id="CVE-2026-27858" type="cve" title="CVE-2026-27858"/>
      <reference href="https://bugzilla.redhat.com/2452172" id="2452172" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452175" id="2452175" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2452179" id="2452179" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19149.html" id="ALSA-2026:19149" type="self" title="ALSA-2026:19149"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="dovecot-devel" version="2.3.21" release="19.el10_2" epoch="1" arch="x86_64_v2" src="dovecot-2.3.21-19.el10_2.src.rpm">
          <filename>dovecot-devel-2.3.21-19.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">73ffb7b346dcf3e988acdaedd5c24d72433c19613925272faecbb866dbd8bba7</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19150</id>
    <title>Important: libtiff security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libtiff security update</summary>
    <description>The libtiff packages contain a library of functions for manipulating Tagged Image File Format (TIFF) files.  

Security Fix(es):  

  * libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing (CVE-2026-4775)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19150" id="RHSA-2026:19150" type="rhsa" title="RHSA-2026:19150"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-4775" id="CVE-2026-4775" type="cve" title="CVE-2026-4775"/>
      <reference href="https://bugzilla.redhat.com/2450768" id="2450768" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19150.html" id="ALSA-2026:19150" type="self" title="ALSA-2026:19150"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="libtiff-tools" version="4.6.0" release="8.el10_2.1" epoch="0" arch="x86_64_v2" src="libtiff-4.6.0-8.el10_2.1.src.rpm">
          <filename>libtiff-tools-4.6.0-8.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">3e8a921e64e43450eac840c58fe2c35d5d36fd4b0473d9287ee852bc357c2a1f</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19151</id>
    <title>Important: jq security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:21"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>jq security update</summary>
    <description>jq is a lightweight and flexible command-line JSON processor. jq is like sed for JSON data. You can use it to slice, filter, map, or transform structured data with the same ease that sed, awk, grep, or similar applications allow you to manipulate text.  

Security Fix(es):  

  * jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers (CVE-2026-39979)
  * jq: jq: Denial of Service via crafted JSON object causing hash collisions (CVE-2026-40164)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19151" id="RHSA-2026:19151" type="rhsa" title="RHSA-2026:19151"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-39979" id="CVE-2026-39979" type="cve" title="CVE-2026-39979"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-40164" id="CVE-2026-40164" type="cve" title="CVE-2026-40164"/>
      <reference href="https://bugzilla.redhat.com/2458077" id="2458077" type="bugzilla" title=""/>
      <reference href="https://bugzilla.redhat.com/2458084" id="2458084" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19151.html" id="ALSA-2026:19151" type="self" title="ALSA-2026:19151"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="jq-devel" version="1.7.1" release="11.el10_2.2" epoch="0" arch="x86_64_v2" src="jq-1.7.1-11.el10_2.2.src.rpm">
          <filename>jq-devel-1.7.1-11.el10_2.2.x86_64_v2.rpm</filename>
          <sum type="sha256">8bc066c4e711e0ed434a94bf07491caa52962579bedd2c17ca53ba811c000d0e</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19154</id>
    <title>Important: giflib security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:22"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>giflib security update</summary>
    <description>giflib is a library for reading and writing gif images.  

Security Fix(es):  

  * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19154" id="RHSA-2026:19154" type="rhsa" title="RHSA-2026:19154"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-23868" id="CVE-2026-23868" type="cve" title="CVE-2026-23868"/>
      <reference href="https://bugzilla.redhat.com/2446207" id="2446207" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19154.html" id="ALSA-2026:19154" type="self" title="ALSA-2026:19154"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="giflib-devel" version="5.2.1" release="24.el10_2" epoch="0" arch="x86_64_v2" src="giflib-5.2.1-24.el10_2.src.rpm">
          <filename>giflib-devel-5.2.1-24.el10_2.x86_64_v2.rpm</filename>
          <sum type="sha256">16874b0f403cb332c167f26bc54261844a9505c8b091e91af554cb9f853eb0a5</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19159</id>
    <title>Critical: nginx security update</title>
    <issued date="2026-05-19 00:00:00"/>
    <updated date="2026-05-26 12:28:23"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Critical</severity>
    <summary>nginx security update</summary>
    <description>nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage.   

Security Fix(es):  

  * nginx: NGINX: Arbitrary Code Execution Vulnerability (CVE-2026-42945)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19159" id="RHSA-2026:19159" type="rhsa" title="RHSA-2026:19159"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-42945" id="CVE-2026-42945" type="cve" title="CVE-2026-42945"/>
      <reference href="https://bugzilla.redhat.com/2477116" id="2477116" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19159.html" id="ALSA-2026:19159" type="self" title="ALSA-2026:19159"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="nginx-mod-devel" version="1.26.3" release="6.el10_2.3" epoch="2" arch="x86_64_v2" src="nginx-1.26.3-6.el10_2.3.src.rpm">
          <filename>nginx-mod-devel-1.26.3-6.el10_2.3.x86_64_v2.rpm</filename>
          <sum type="sha256">227fff7d92c6cce12cfcfe6047d33a914b9a2226e306fabb574016923e1e3017</sum>
        </package>
      </collection>
    </pkglist>
  </update>
  <update from="packager@almalinux.org" status="final" type="security" version="3">
    <id>ALSA-2026:19560</id>
    <title>Important: libsndfile security update</title>
    <issued date="2026-05-20 00:00:00"/>
    <updated date="2026-05-26 12:28:33"/>
    <rights>Copyright 2026 AlmaLinux OS</rights>
    <release>0</release>
    <pushcount>1</pushcount>
    <severity>Important</severity>
    <summary>libsndfile security update</summary>
    <description>libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV.   

Security Fix(es):  

  * libsndfile: integer overflow in ima_reader_init() (CVE-2026-37555)


For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
</description>
    <solution>For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258</solution>
    <references>
      <reference href="https://access.redhat.com/errata/RHSA-2026:19560" id="RHSA-2026:19560" type="rhsa" title="RHSA-2026:19560"/>
      <reference href="https://access.redhat.com/security/cve/CVE-2026-37555" id="CVE-2026-37555" type="cve" title="CVE-2026-37555"/>
      <reference href="https://bugzilla.redhat.com/2463856" id="2463856" type="bugzilla" title=""/>
      <reference href="https://errata.almalinux.org/10/ALSA-2026-19560.html" id="ALSA-2026:19560" type="self" title="ALSA-2026:19560"/>
    </references>
    <pkglist>
      <collection short="almalinux-10-for-x86_64_v2-crb-rpms__10_0_default">
        <name>almalinux-10-for-x86_64_v2-crb-rpms__10_0_default</name>
        <package name="libsndfile-devel" version="1.2.2" release="6.el10_2.1" epoch="0" arch="x86_64_v2" src="libsndfile-1.2.2-6.el10_2.1.src.rpm">
          <filename>libsndfile-devel-1.2.2-6.el10_2.1.x86_64_v2.rpm</filename>
          <sum type="sha256">29a08e2fbbed4d048405fbe0990036855acf885487bbddfe196a8024ec5e7290</sum>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>