Release date:
2026-09-10 11:09:08 UTC
Description:
- CVE-2026-39821: reject Punycode (xn--) labels that decode to an all-ASCII label in
Profile.process of the vendored golang.org/x/net/idna, so that ToASCII and ToUnicode
return an error instead of the decoded ASCII name, preventing a hostname
authorization bypass
Updated packages:
-
osbuild-composer-132.2-3.el9_6.alma.1.tuxcare.els6.x86_64.rpm
sha:296c2616cf71a5c61229339512a301c396364349017e3a2e30f9dbd6e3d8c78b
-
osbuild-composer-core-132.2-3.el9_6.alma.1.tuxcare.els6.x86_64.rpm
sha:ac5ce94563a95625a23c8feb6a484b35bb486088bb8a8271751941214897071f
-
osbuild-composer-tests-132.2-3.el9_6.alma.1.tuxcare.els6.x86_64.rpm
sha:fccc989181f7ce6fc2bd49cb1c0c4e262887c1a5641ec0882368e4ddde275ca3
-
osbuild-composer-worker-132.2-3.el9_6.alma.1.tuxcare.els6.x86_64.rpm
sha:533751f5c4f6040c2b60865574214d355025c87ab61b951c14a22ce4fe88c07b
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
