- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:88316: grafana-pcp security update (Important)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-23 Summary: The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-88316.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88455: ca-certificates security update (Critical)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Critical Release date: 2026-10-23 Summary: The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI). Security Fix(es): * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-88455.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86093: golang security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-10-23 Summary: The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [almalinux-10.2.z] (JIRA:AlmaLinux-287191) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-86093.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86970: cockpit-machines security update (Moderate)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Moderate Release date: 2026-10-23 Summary: Cockpit component for managing libvirt virtual machines. Security Fix(es): * cockpit-machines: cockpit-machines: Sensitive data exposure via command-line arguments (CVE-2026-92768) * cockpit-machines: cockpit-machines: Sensitive Data Exposure of guest credentials via JSON argument in process list (CVE-2026-92747) * cockpit-machines: cockpit-machines: Information Disclosure of RHSM Offline Token via Process Arguments (CVE-2026-92745) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-86970.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88247: expat security update (Important)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-23 Summary: Expat is a C library for parsing XML documents. Security Fix(es): * expat: expat: Denial of Service via integer overflow in expat_realloc (CVE-2026-102633) * expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer (CVE-2026-77214) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-88247.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88354: grafana-pcp security update (Critical)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-23 Summary: The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-88354.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88459: ca-certificates security update (Critical)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Critical Release date: 2026-10-23 Summary: The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI). Security Fix(es): * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-88459.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:86196: golang security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-10-23 Summary: The golang packages provide the Go programming language compiler. Security Fix(es): * net/[http:](http:) golang: golang: Denial of Service via crafted HTTP Range headers (CVE-2026-78667) * crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references (CVE-2026-97031) * net/[http:](http:) net/http/internal/http2: golang.org/x/net/http2: net/[http:](http:) Denial of Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669) * golang: crypto/x509: Go: crypto/x509: mitigation for security concerns with a specific Certificate Authority (CVE-2026-111943) Bug Fix(es) and Enhancement(s): * Update Go to version 1.26.10+1 [almalinux-9.8.z] (JIRA:AlmaLinux-287192) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-86196.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:82295: hplip security update (Important)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Important Release date: 2026-10-23 Summary: The hplip packages contain the Hewlett-Packard Linux Imaging and Printing Project (HPLIP), which provides drivers for Hewlett-Packard printers and multi-function peripherals. Security Fix(es): * hplip: potential memory buffer overflow (CVE-2020-6923) * hplip: HP Linux Imaging and Printing Software - Use of DSA Key (CVE-2025-43023) * hplip: HPLIP: Multiple vulnerabilities enabling local code execution and privilege escalation (CVE-2026-91099) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution and privilege escalation (CVE-2026-91098) * hplip: HPLIP: Multiple vulnerabilities enable remote code execution and privilege escalation (CVE-2026-91097) * hplip: HPLIP: Multiple vulnerabilities leading to remote code execution, privilege escalation, and denial of service (CVE-2026-91103) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91106) * hplip: HPLIP: Multiple vulnerabilities allow remote code execution, privilege escalation, and denial of service. (CVE-2026-91100) * hplip: HPLIP: Remote Code Execution and Privilege Escalation Vulnerabilities (CVE-2026-91101) * hplip: heap-based buffer overflow can lead to remote code execution (CVE-2026-91104) * hplip: HPLIP: Remote code execution and privilege escalation vulnerabilities (CVE-2026-91105) * HPLIP: HPLIP: Multiple vulnerabilities could lead to remote code execution (CVE-2026-91102) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-82295.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:88550: ca-certificates security update (Critical)
by AlmaLinux Errata Notifications 23 Oct '26

23 Oct '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Critical Release date: 2026-10-23 Summary: The ca-certificates package contains a set of Certificate Authority (CA) certificates chosen by the Mozilla Foundation for use with the Internet Public Key Infrastructure (PKI). Security Fix(es): * ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns (CVE-2026-114406) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-88550.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0