- Announce - AlmaLinux List Archives

[Security Advisory] ALSA-2026:96236: nodejs-nodemon security update (Important)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-10 Summary: Simple monitor script for use during development of a node.js app. For use during development of a node.js based application. nodemon will watch the files in the directory in which nodemon was started, and if any files change, nodemon will automatically restart your node application. nodemon does not require any changes to your code or method of development. nodemon simply wraps your node application and keeps an eye on any files that have changed. Remember that nodemon is a replacement wrapper for node, think of it as replacing the word "node" on the command line when you run your script. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-96236.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:96235: ruby security, bug fix, and enhancement update (Moderate)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Moderate Release date: 2026-11-10 Summary: Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fix(es): * ruby: double free issue in regular expression parser (CVE-2026-89078) * ruby: integer overflow issue in regular expression compiler (CVE-2026-93577) * ruby: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) * ruby: integer overflow issue in regular expression compiler (CVE-2026-110264) Bug Fix(es) and Enhancement(s): * ruby: Rebase to the latest Ruby 3.3 release [rhel-10.2.z] (JIRA:RHEL-300972) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-96235.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:96094: nodejs22 security update (Important)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-10 Summary: Node.js is a platform built on Chrome's JavaScript runtime \ for easily building fast, scalable network applications. \ Node.js uses an event-driven, non-blocking I/O model that \ makes it lightweight and efficient, perfect for data-intensive \ real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869) * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018) * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383) * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-96094.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:96088: nodejs24 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-10 Summary: Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications that run across distributed devices. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869) * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018) * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383) * undici: undici: Cache poisoning and information disclosure via improper cross-origin redirect caching (CVE-2026-109829) * nodejs: nodejs: TLS certificate hostname bypass via fullwidth-digit IP hostnames (CVE-2026-105483) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) Bug Fix(es) and Enhancement(s): * nodejs24: Rebase to the latest Node.js 24 release [rhel-10.2.z] (JIRA:RHEL-295759) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-96088.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93413: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-09 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Kernel: Denial of Service in network socket error handling (CVE-2026-22977) * kernel: x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (CVE-2026-46174) * kernel: i2c: stub: Reject I2C block transfers with invalid length (CVE-2026-64191) * kernel: Linux kernel: PPP over L2TP Use-After-Free vulnerability (CVE-2026-68398) * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169) * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603) * kernel: KVM: nVMX: Always flush vpid02 on first use (CVE-2026-89932) * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827) * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787) * kernel: KEYS: encrypted: fix integer overflow of datablob_len (CVE-2026-98222) * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364) * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725) Bug Fix(es) and Enhancement(s): * ipv4: ip_gre: make ipgre_header() robust (rhel-10.2.z) (JIRA:RHEL-270702) * ip6_gre: make ip6gre_header() robust (rhel-10.2.z) (JIRA:RHEL-270721) * AlmaLinux is missing support for conntrack zone filtering in dump/delete requests (10.4) [rhel-10.2.z] (JIRA:RHEL-291348) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-93413.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:92862: tomcat security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 10 Type: Security Severity: Important Release date: 2026-11-09 Summary: Apache Tomcat is a servlet container for the Java Servlet and JavaServer Pages (JSP) technologies. Security Fix(es): * tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182) * tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927) * tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569) * tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905) * tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525) * tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763) Bug Fix(es) and Enhancement(s): * Stalled TLS handshake when the server's first flight is too large [rhel-10] (JIRA:RHEL-264918) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/10/ALSA-2026-92862.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:93412: kernel security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-09 Summary: The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: sctp: stream: fully roll back denied add-stream state (CVE-2026-52929) * kernel: ipv6: sit: reload inner IPv6 header after GSO offloads (CVE-2026-53228) * kernel: ipvs: clear the svc scheduler ptr early on edit (CVE-2026-53270) * kernel: spi: fsl-lpspi: terminate the RX channel on TX prepare failure path (CVE-2026-64303) * kernel: mptcp: pm: userspace: fix use-after-free in get_local_id (CVE-2026-68169) * kernel: scsi: target: core: Fix iSCSI ISID use-after-free in REGISTER AND MOVE (CVE-2026-72083) * kernel: tipc: require net admin for TIPCv2 netlink mutators (CVE-2026-74283) * kernel: Bluetooth: mgmt: fix UAF in pair command cancellation (CVE-2026-74510) * kernel: packet: use consistent hard_header_len in non-ring send paths (CVE-2026-74582) * kernel: mptcp: options: reset DSS fields in case of unexpected size (CVE-2026-80586) * kernel: entry: Fix seccomp bypass after ptrace with TSYNC (CVE-2026-89603) * kernel: scsi: target: iscsi: Reserve a terminator byte for the login payload (CVE-2026-90011) * kernel: virtio-fs: avoid double-free on failed queue setup (CVE-2026-93827) * kernel: smb: client: bound dirent name against end of SMB response in cifs_filldir (CVE-2026-93787) * kernel: xfrm: hold net_device reference under RCU in bundle creation (CVE-2026-98364) * kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period (CVE-2026-98432) * kernel: KVM: arm64: Transfer the hyp stack pages out of the host stage-2 (CVE-2026-98466) * kernel: nvmet-auth: fix out-of-bounds write in nvmet_auth_challenge() (CVE-2026-98725) * kernel: ZDI-CAN-33367: Linux Kernel skbuff skb_zerocopy Improper Ownership Management Local Privilege Escalation Vulnerability () Bug Fix(es) and Enhancement(s): * kernel panic in percpu_counter_add_batch() via submit_bio_noacct() due to NULL pointer (JIRA:RHEL-250378) * ipv4: ip_gre: make ipgre_header() robust (rhel-9.8.z) (JIRA:RHEL-271127) * ip6_gre: make ip6gre_header() robust (rhel-9.8.z) (JIRA:RHEL-271130) * Backport "sched: The newidle balance regression" series to rhel 9.8 [rhel-9.8.z] (JIRA:RHEL-288067) * AlmaLinux is missing support for conntrack zone filtering in dump/delete requests (9.10) [rhel-9.8.z] (JIRA:RHEL-291352) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-93412.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:96234: nodejs:22 security, bug fix, and enhancement update (Important)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 9 Type: Security Severity: Important Release date: 2026-11-09 Summary: Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via uncontrolled recursion in nested brace patterns (CVE-2026-102278) * brace-expansion: brace-expansion: Denial of Service via stack exhaustion from crafted brace patterns (CVE-2026-102276) * undici: undici: Denial of Service via unhandled stream error on excessive content encodings (CVE-2026-109869) * undici: undici: Denial of Service via TLS renegotiation with mismatched certificate (CVE-2026-87018) * undici: undici: Certificate validation bypass via dropped TLS options in Agent (CVE-2026-109383) * nodejs: nodejs: TLS certificate hostname bypass via non-canonical IP hostnames (CVE-2026-106069) * nodejs: nodejs: dns.resolve truncates hostnames containing a NUL character (CVE-2026-105482) Bug Fix(es) and Enhancement(s): * nodejs:22/nodejs: Rebase to the latest Node.js 22 release [rhel-9.8.z] (JIRA:RHEL-302833) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/9/ALSA-2026-96234.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:96087: glibc security update (Moderate)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-10 Summary: The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly. Security Fix(es): * glibc: nscd stack overflow leads to degraded DNS resolution (CVE-2026-89092) * glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration (CVE-2026-8674) * glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader (CVE-2026-86805) * glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow. (CVE-2026-95818) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-96087.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0

[Security Advisory] ALSA-2026:96215: patch security update (Moderate)
by AlmaLinux Errata Notifications 10 Nov '26

10 Nov '26

Hi, You are receiving an AlmaLinux Security update email because you subscribed to receive errata notifications from AlmaLinux. AlmaLinux: 8 Type: Security Severity: Moderate Release date: 2026-11-10 Summary: The patch program applies diff files to originals. The diff command is used to compare an original to a changed file. Diff lists the changes made to the file. A person who has the original file can then use the patch command with the diff file to add the changes to their original file (patching the file). Security Fix(es): * patch: Filename validation bypass in reversal fallback allows file creation outside the working directory (CVE-2026-115207) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Full details, updated packages, references, and other related information: https://errata.almalinux.org/8/ALSA-2026-96215.html This message is automatically generated, please don’t reply. For further questions, please, contact us via the AlmaLinux community chat: https://chat.almalinux.org/. Want to change your notification settings? Sign in and manage mailing lists on https://lists.almalinux.org. Kind regards, AlmaLinux Team

1 0