chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
python3.12	3.12.13-2.el8_10 -> 3.12.13-3.el8_10
python3.12-libs	3.12.13-2.el8_10 -> 3.12.13-3.el8_10
acl	2.2.53-3.el8 -> 2.4.0-1.el8_10
glib2	2.56.4-169.el8_10 -> 2.56.4-170.el8_10
glibc	2.28-251.el8_10.38 -> 2.28-251.el8_10.40
glibc-all-langpacks	2.28-251.el8_10.38 -> 2.28-251.el8_10.40
glibc-common	2.28-251.el8_10.38 -> 2.28-251.el8_10.40
glibc-devel	2.28-251.el8_10.38 -> 2.28-251.el8_10.40
glibc-gconv-extra	2.28-251.el8_10.38 -> 2.28-251.el8_10.40
glibc-headers	2.28-251.el8_10.38 -> 2.28-251.el8_10.40
kernel-headers	4.18.0-553.139.1.el8_10 -> 4.18.0-553.146.1.el8_10
libacl	2.2.53-3.el8 -> 2.4.0-1.el8_10
libtasn1	4.13-5.el8_10 -> 4.13-6.el8_10
libxml2	2.9.7-21.el8_10.5 -> 2.9.7-21.el8_10.6
openssl	1:1.1.1k-16.el8_6 -> 1:1.1.1k-17.el8_6
openssl-devel	1:1.1.1k-16.el8_6 -> 1:1.1.1k-17.el8_6
openssl-libs	1:1.1.1k-16.el8_6 -> 1:1.1.1k-17.el8_6
platform-python	3.6.8-76.el8_10 -> 3.6.8-77.el8_10
python3-libs	3.6.8-76.el8_10 -> 3.6.8-77.el8_10

---

python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations

CVE-2026-15308

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-15308
• https://bugzilla.redhat.com/show_bug.cgi?id=2498608
• https://www.cve.org/CVERecord?id=CVE-2026-15308
• https://nvd.nist.gov/vuln/detail/CVE-2026-15308
• https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9
• https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced
• https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606
• https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd
• https://github.com/python/cpython/issues/153030
• https://github.com/python/cpython/pull/153031
• https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/

---

python: Python: Command-line option injection in webbrowser.open() via crafted URLs

CVE-2026-4519

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-4519
• https://bugzilla.redhat.com/show_bug.cgi?id=2449649
• https://www.cve.org/CVERecord?id=CVE-2026-4519
• https://nvd.nist.gov/vuln/detail/CVE-2026-4519
• https://github.com/python/cpython/issues/143930
• https://github.com/python/cpython/pull/143931
• https://mail.python.org/archives/list/security-announce@python.org/thread/AY5NDSS433JK56Q7Q5IS7B37QFZVVOUS/

---

python: Quadratic complexity in os.path.expandvars() with user-controlled template

CVE-2025-6075

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-6075
• https://bugzilla.redhat.com/show_bug.cgi?id=2408891
• https://www.cve.org/CVERecord?id=CVE-2025-6075
• https://nvd.nist.gov/vuln/detail/CVE-2025-6075
• https://github.com/python/cpython/issues/136065
• https://mail.python.org/archives/list/security-announce@python.org/thread/IUP5QJ6D4KK6ULHOMPC7DPNKRYQTQNLA/

---

cpython: Out-of-memory when loading Plist

CVE-2025-13837

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-13837
• https://bugzilla.redhat.com/show_bug.cgi?id=2418084
• https://www.cve.org/CVERecord?id=CVE-2025-13837
• https://nvd.nist.gov/vuln/detail/CVE-2025-13837
• https://github.com/python/cpython/issues/119342
• https://github.com/python/cpython/pull/119343

---

cpython: Header injection via newlines in data URL mediatype in Python

CVE-2025-15282

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-15282
• https://bugzilla.redhat.com/show_bug.cgi?id=2431366
• https://www.cve.org/CVERecord?id=CVE-2025-15282
• https://nvd.nist.gov/vuln/detail/CVE-2025-15282
• https://github.com/python/cpython/issues/143925
• https://github.com/python/cpython/pull/143926
• https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/

---

firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

CVE-2025-59375

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-59375
• https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• https://www.cve.org/CVERecord?id=CVE-2025-59375
• https://nvd.nist.gov/vuln/detail/CVE-2025-59375
• https://www.mozilla.org/security/advisories/mfsa2026-22/#CVE-2025-59375
• https://www.mozilla.org/security/advisories/mfsa2026-24/#CVE-2025-59375

---

cpython: Header injection in http.cookies.Morsel in Python

CVE-2026-0672

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-0672
• https://bugzilla.redhat.com/show_bug.cgi?id=2431374
• https://www.cve.org/CVERecord?id=CVE-2026-0672
• https://nvd.nist.gov/vuln/detail/CVE-2026-0672
• https://github.com/python/cpython/issues/143919
• https://github.com/python/cpython/pull/143920

---

python: Python: HTTP header injection via CR/LF in proxy tunnel headers

CVE-2026-1502

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-1502
• https://bugzilla.redhat.com/show_bug.cgi?id=2457409
• https://www.cve.org/CVERecord?id=CVE-2026-1502
• https://nvd.nist.gov/vuln/detail/CVE-2026-1502
• https://github.com/python/cpython/commit/05ed7ce7ae9e17c23a04085b2539fe6d6d3cef69
• https://github.com/python/cpython/issues/146211
• https://github.com/python/cpython/pull/146212
• https://mail.python.org/archives/list/security-announce@python.org/thread/2IVPAEQWUJBCTQZEJEVTYCIKSMQPGRZ3/

---

cpython: CPython: Logging Bypass in Legacy .pyc File Handling

CVE-2026-2297

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-2297
• https://bugzilla.redhat.com/show_bug.cgi?id=2444691
• https://www.cve.org/CVERecord?id=CVE-2026-2297
• https://nvd.nist.gov/vuln/detail/CVE-2026-2297
• https://github.com/python/cpython/commit/482d6f8bdba9da3725d272e8bb4a2d25fb6a603e
• https://github.com/python/cpython/commit/a51b1b512de1d56b3714b65628a2eae2b07e535e
• https://github.com/python/cpython/commit/e58e9802b9bec5cdbf48fc9bf1da5f4fda482e86
• https://github.com/python/cpython/issues/145506
• https://github.com/python/cpython/pull/145507

---

cpython: Incomplete control character validation in http.cookies

CVE-2026-3644

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-3644
• https://bugzilla.redhat.com/show_bug.cgi?id=2448168
• https://www.cve.org/CVERecord?id=CVE-2026-3644
• https://nvd.nist.gov/vuln/detail/CVE-2026-3644
• https://github.com/python/cpython/commit/57e88c1cf95e1481b94ae57abe1010469d47a6b4
• https://github.com/python/cpython/issues/145599
• https://github.com/python/cpython/pull/145600
• https://mail.python.org/archives/list/security-announce@python.org/thread/H6CADMBCDRFGWCMOXWUIHFJNV43GABJ7/

---

cpython: Stack overflow parsing XML with deeply nested DTD content models

CVE-2026-4224

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-4224
• https://bugzilla.redhat.com/show_bug.cgi?id=2448181
• https://www.cve.org/CVERecord?id=CVE-2026-4224
• https://nvd.nist.gov/vuln/detail/CVE-2026-4224
• https://github.com/python/cpython/commit/196edfb06a7458377d4d0f4b3cd41724c1f3bd4a
• https://github.com/python/cpython/commit/e0a8a6da90597a924b300debe045cdb4628ee1f3
• https://github.com/python/cpython/commit/eb0e8be3a7e11b87d198a2c3af1ed0eccf532768
• https://github.com/python/cpython/issues/145986
• https://github.com/python/cpython/pull/145987
• https://mail.python.org/archives/list/security-announce@python.org/thread/5M7CGUW3XBRY7II4DK43KF7NQQ3TPZ6R/

---

python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API

CVE-2026-4786

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-4786
• https://bugzilla.redhat.com/show_bug.cgi?id=2458049
• https://www.cve.org/CVERecord?id=CVE-2026-4786
• https://nvd.nist.gov/vuln/detail/CVE-2026-4786
• https://github.com/python/cpython/issues/148169
• https://github.com/python/cpython/pull/148170
• https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/

---

python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules

CVE-2026-6100

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-6100
• https://bugzilla.redhat.com/show_bug.cgi?id=2457932
• https://www.cve.org/CVERecord?id=CVE-2026-6100
• https://nvd.nist.gov/vuln/detail/CVE-2026-6100
• https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
• https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
• https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
• https://github.com/python/cpython/issues/148395
• https://github.com/python/cpython/pull/148396
• https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/

---

acl: Symlink traversal privilege escalation via libacl functions

CVE-2026-54369

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-54369
• https://bugzilla.redhat.com/show_bug.cgi?id=2490277
• https://www.cve.org/CVERecord?id=CVE-2026-54369
• https://nvd.nist.gov/vuln/detail/CVE-2026-54369

---

acl: TOCTOU Symlink Traversal via getfacl/setfacl

CVE-2026-54370

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-54370
• https://bugzilla.redhat.com/show_bug.cgi?id=2490279
• https://www.cve.org/CVERecord?id=CVE-2026-54370
• https://nvd.nist.gov/vuln/detail/CVE-2026-54370

---

glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

CVE-2026-58016

More information

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-58016
• https://bugzilla.redhat.com/show_bug.cgi?id=2492257
• https://www.cve.org/CVERecord?id=CVE-2026-58016
• https://nvd.nist.gov/vuln/detail/CVE-2026-58016
• https://gitlab.gnome.org/GNOME/glib/-/issues/3932

---

glibc: glibc: Out-of-bounds write via TSIG record processing

CVE-2026-5435

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-5435
• https://bugzilla.redhat.com/show_bug.cgi?id=2463465
• https://www.cve.org/CVERecord?id=CVE-2026-5435
• https://nvd.nist.gov/vuln/detail/CVE-2026-5435
• https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@​redhat.com/T/#u
• https://sourceware.org/bugzilla/show_bug.cgi?id=34033

---

glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings

CVE-2026-5928

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-5928
• https://bugzilla.redhat.com/show_bug.cgi?id=2459854
• https://www.cve.org/CVERecord?id=CVE-2026-5928
• https://nvd.nist.gov/vuln/detail/CVE-2026-5928
• https://sourceware.org/bugzilla/show_bug.cgi?id=33998

---

glibc: glibc: Application crash or uninitialized memory read via crafted DNS response

CVE-2026-6238

More information

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-6238
• https://bugzilla.redhat.com/show_bug.cgi?id=2463539
• https://www.cve.org/CVERecord?id=CVE-2026-6238
• https://nvd.nist.gov/vuln/detail/CVE-2026-6238
• https://inbox.sourceware.org/libc-announce/7a655d55-276f-41fe-b550-feb3ebb2ce91@​redhat.com/T/#u
• https://sourceware.org/bugzilla/show_bug.cgi?id=34069

---

libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string

CVE-2025-13151

More information

Severity

Low

References

• https://access.redhat.com/security/cve/CVE-2025-13151
• https://bugzilla.redhat.com/show_bug.cgi?id=2427698
• https://www.cve.org/CVERecord?id=CVE-2025-13151
• https://nvd.nist.gov/vuln/detail/CVE-2025-13151
• https://gitlab.com/gnutls/libtasn1
• https://gitlab.com/gnutls/libtasn1/-/merge_requests/121

---

libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling

CVE-2025-6170

More information

Severity

Low

References

• https://access.redhat.com/security/cve/CVE-2025-6170
• https://bugzilla.redhat.com/show_bug.cgi?id=2372952
• https://www.cve.org/CVERecord?id=CVE-2025-6170
• https://nvd.nist.gov/vuln/detail/CVE-2025-6170
• https://gitlab.gnome.org/GNOME/libxml2/-/issues/941

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.

[rhacs-bot]

Auto-approved by automation.