Most recent entries from osv_rocky

RLSA-2026:19061 — Moderate: glibc security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: glibc

The glibc packages provide the standard C libraries (libc), POSIX thread libraries (libpthread), standard math libraries (libm), and the name service cache daemon (nscd) used by multiple programs on the system. Without these libraries, the Linux system cannot function correctly.

Security Fix(es):

* glibc: glibc: Incorrect DNS response parsing via crafted DNS server response (CVE-2026-4437)

* glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions (CVE-2026-4438)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19139 — Important: go-fdo-client security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: go-fdo-client

go-fdo-client is the device-side implementation of FIDO Device Onboard specification in Go. It provides an FDO client that interacts with FDO manufacturer and owner servers to perform device on-boarding.

Security Fix(es):

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19135 — Important: opentelemetry-collector security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: opentelemetry-collector

Collector with the supported components for a Rocky Enterprise Software Foundation build of OpenTelemetry

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

* google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation (CVE-2026-33186)

* github.com/go-jose/go-jose/v3: github.com/go-jose/go-jose/v4: Go JOSE: Denial of Service via crafted JSON Web Encryption (JWE) object (CVE-2026-34986)

* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)

* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19136 — Important: grafana-pcp security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: grafana-pcp

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards.

Security Fix(es):

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19160 — Important: firefox security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: firefox

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability.

Security Fix(es):

* firefox: Other issue in the WebRTC component (CVE-2026-8094)

* firefox: Memory safety bugs fixed in Firefox ESR 115.35.2, Firefox ESR 140.10.2 and Firefox 150.0.2 (CVE-2026-8092)

* firefox: Use-after-free in the DOM: Networking component (CVE-2026-8090)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19158 — Important: dnsmasq security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: dnsmasq

The dnsmasq packages contain Dnsmasq, a lightweight DNS (Domain Name Server) forwarder and DHCP (Dynamic Host Configuration Protocol) server.

Security Fix(es):

* dnsmasq: dnsmasq: heap buffer overflow in cache via NAME_ESCAPE expansion (CVE-2026-2291)

* dnsmasq: NSEC bitmap parsing infinite loop (CVE-2026-4890)

* dnsmasq: RRSIG rdlen underflow leading to heap OOB read (CVE-2026-4891)

* dnsmasq: DHCPv6 CLID buffer overflow in helper process (CVE-2026-4892)

* dnsmasq: Broken ECS source validation bypass (CVE-2026-4893)

* dnsmasq: extract_addresses() OOB read via malformed rdlen (CVE-2026-5172)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19128 — Important: yggdrasil-worker-package-manager security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: yggdrasil-worker-package-manager

yggdrasil-worker-package-manager is a simple package manager yggd worker. It knows how to install and remove packages, add, remove, enable and disable repositories, and does rudimentary detection of the host it is running on to guess the package manager to use. It only installs packages that match one of the provided allow-pattern regular expressions.

Security Fix(es):

* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19134 — Important: grafana security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: grafana

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB.

Security Fix(es):

* grafana: Grafana: Information disclosure of data-source passwords via public dashboards (CVE-2026-27877)

* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)

* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19141 — Important: PackageKit security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: PackageKit

PackageKit is a D-Bus abstraction layer that allows the session user to manage packages in a secure way using a cross-distribution, cross-architecture API.

Security Fix(es):

* PackageKit: race condition vulnerability leads to arbitrary package installation as root (CVE-2026-41651)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

RLSA-2026:19149 — Important: dovecot security update

Fri, 29 May 2026 16:03:24 +0000

Affected: Rocky Linux:10: dovecot

Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.

Security Fix(es):

* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)

* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)

* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.