Release date:
2026-09-17 10:20:53 UTC
Description:
- CVE-2026-39821: reject xn-- Punycode labels that decode to an all-ASCII label in the
vendored golang.org/x/net/idna, so ToASCII and ToUnicode no longer resolve names such
as xn--example-.com to example.com without an error, preventing privilege escalation in
programs that perform privilege checks on the ASCII hostname
- CVE-2026-39821: rebuild against golang >= 1.22.9-1.el9_2.tuxcare.els19 so the copy of
golang.org/x/net/idna vendored into the Go standard library, which net/http uses to
convert outbound request hosts, carries the same rejection
Updated packages:
-
osbuild-composer-76-2.el9_2.2.alma.tuxcare.els10.x86_64.rpm
sha:c631dcb4e9458534d0312c15fe52c8dc26958a5795ffa0cb8557d0627cde9d12
-
osbuild-composer-core-76-2.el9_2.2.alma.tuxcare.els10.x86_64.rpm
sha:3bde186e5315b4f2b44f438cd58b7433a5bb91a21725b32216c826fe3d7d7af7
-
osbuild-composer-dnf-json-76-2.el9_2.2.alma.tuxcare.els10.x86_64.rpm
sha:7d396a8ba8c3c1193c5ef2cd8b8755159546ebba2575749e319e5b72001c60c5
-
osbuild-composer-tests-76-2.el9_2.2.alma.tuxcare.els10.x86_64.rpm
sha:222d323b5e4230f1ab4010640aeb31a498cab4a781f508587500efedd332de63
-
osbuild-composer-worker-76-2.el9_2.2.alma.tuxcare.els10.x86_64.rpm
sha:4e62fec3cbfb47b6726f9032d288b145d5f3e6c384d043cd0a624a80685c6d07
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
