Release date:
2026-09-17 15:07:38 UTC
Description:
- CVE-2026-42502: treat foster-parented raw-text elements in foreign content as
escaped rather than literal in childTextNodesAreLiteral of the vendored
golang.org/x/net/html, preventing a cross-site scripting bypass when a parsed
tree is re-rendered
Updated packages:
-
osbuild-composer-132.2-3.el9_6.alma.1.tuxcare.els9.x86_64.rpm
sha:3972f5932a99538a6d8224a9cf3102b4655aa98f5f5f829873e6341277d33aa3
-
osbuild-composer-core-132.2-3.el9_6.alma.1.tuxcare.els9.x86_64.rpm
sha:09ddcc7ae9f4edd3f7f9a32360e5ce067e0f05a8e29f81882ca70e46bf1e82ff
-
osbuild-composer-tests-132.2-3.el9_6.alma.1.tuxcare.els9.x86_64.rpm
sha:64e6bb1819a3e218b63128654b89674c1e26f332785eef25bda97dc4c1b32199
-
osbuild-composer-worker-132.2-3.el9_6.alma.1.tuxcare.els9.x86_64.rpm
sha:170482cbd2693143cfd3c42e5bfa13aba37cf1d537f501ac339375175bcbd02a
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
