Release date:
2026-09-16 18:25:42 UTC
Description:
- CVE-2026-25681: fix HTML sanitizer bypass in the vendored
golang.org/x/net/html package by escaping ">" in DOCTYPE PUBLIC/SYSTEM
identifiers when rendering, so a re-rendered document can no longer terminate
the DOCTYPE token early and inject markup
Updated packages:
-
osbuild-composer-76-2.el9_2.2.alma.tuxcare.els9.x86_64.rpm
sha:1e8f625b21cbc060458ffd3118c10cdaac3be527c1b1e67d04330225b7b67c23
-
osbuild-composer-core-76-2.el9_2.2.alma.tuxcare.els9.x86_64.rpm
sha:3368d7daa3234391fe8a4eb71b79d4672aca21ff19ab750f7484dc7a42c1e15b
-
osbuild-composer-dnf-json-76-2.el9_2.2.alma.tuxcare.els9.x86_64.rpm
sha:87948431ef39a9543074d557df46a9adeb4b41064837b7a8cf787aebb179afd4
-
osbuild-composer-tests-76-2.el9_2.2.alma.tuxcare.els9.x86_64.rpm
sha:bbe3d0b599a6e212040371f36cf9b17e1fea29f97a603e84400d50f657ccc61e
-
osbuild-composer-worker-76-2.el9_2.2.alma.tuxcare.els9.x86_64.rpm
sha:7ebc60ce2c494285ed4039b8bb05d5537eb6bb180600267399399fbc8f2980df
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
