Release date:
2026-09-16 16:43:20 UTC
Description:
- CVE-2026-25681: escape ">" as > in DOCTYPE PUBLIC/SYSTEM identifiers in
writeDoctypeQuoted of the vendored golang.org/x/net/html, so that Render cannot
emit a DOCTYPE whose identifier terminates the token early when re-parsed,
preventing an HTML sanitizer bypass
Updated packages:
-
osbuild-composer-132.2-3.el9_6.alma.1.tuxcare.els8.x86_64.rpm
sha:d43557f8e1b64fe61240b92c8bd17b8c9963adcdb9fa952c798227b123d62f2e
-
osbuild-composer-core-132.2-3.el9_6.alma.1.tuxcare.els8.x86_64.rpm
sha:c126616f29ffb406b206e77ae128e12d2fc5f86ff8fa0f996e3cd4a0f2ce8e05
-
osbuild-composer-tests-132.2-3.el9_6.alma.1.tuxcare.els8.x86_64.rpm
sha:4733fbadb8386cf1c4249b3999269e2952097f344a0212875083052b2fa92514
-
osbuild-composer-worker-132.2-3.el9_6.alma.1.tuxcare.els8.x86_64.rpm
sha:f125509598cbdb57bfdccc110a18c5b15aabef9d5f3c4addeb32c974bb29dc23
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
