Tuxcare Errata System 0.0.1 5.10 2026-09-10T14:33:20 Community Enterprise Operating System 9 - CVE-2025-23085: fix HTTP/2 memory leak on premature socket close or invalid header (ERR_PROTO) Important TuxCare License Agreement CVE-2024-27983 CVE-2025-23085 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-23085: fix HTTP/2 memory leak on premature socket close or invalid header (ERR_PROTO) Important TuxCare License Agreement CVE-2024-27983 CVE-2025-23085 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-27983: close HTTP/2 streams during session destruction to prevent memory leak and DoS Important TuxCare License Agreement CVE-2024-27983 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-25629: fix ares__read_line() function to prevent out-of-bounds read when parsing configuration files with embedded NULL characters Important TuxCare License Agreement CVE-2024-25629 CVE-2025-23166 CVE-2024-28863 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-25629: fix ares__read_line() function to prevent out-of-bounds read when parsing configuration files with embedded NULL characters Moderate TuxCare License Agreement CVE-2024-25629 CVE-2025-23085 CVE-2024-28863 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-25629: fix ares__read_line() function to prevent out-of-bounds read when parsing configuration files with embedded NULL characters Moderate TuxCare License Agreement CVE-2024-25629 CVE-2024-28863 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-32002: prevent Module.constructor._load() bypass by adding constructor property protection - CVE-2023-32006: prevent require.main.constructor and require.extensions bypass by implementing secure module loading validation Critical TuxCare License Agreement CVE-2023-32002 CVE-2023-32006 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-23918: prevent process.mainModule.require() policy bypass - CVE-2023-32002: prevent Module.constructor._load() bypass by adding constructor property protection - CVE-2023-32006: prevent require.main.constructor and require.extensions bypass by implementing secure module loading validation Critical TuxCare License Agreement CVE-2023-23918 CVE-2023-32006 CVE-2023-32002 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-30590: update documentation and add tests clarifying DH generateKeys behavior Important TuxCare License Agreement CVE-2023-30590 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-30589: fix llhttp parser to properly validate LF after CR in HTTP header fields, add lenient flag checks before allowing CR without LF, add test file to verify the fix prevents request smuggling attacks Important TuxCare License Agreement CVE-2023-30589 CVE-2023-30590 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-30589: fix llhttp parser to properly validate LF after CR in HTTP header fields, add lenient flag checks before allowing CR without LF, add test file to verify the fix prevents request smuggling attacks Important TuxCare License Agreement CVE-2023-30589 CVE-2023-32559 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering with Hash class internals in policy mechanism Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-32212: fix IPv4 validation in inspector_socket to properly validate IP addresses and reject non-routable IPs (0.0.0.0/8), replace vulnerable dot-counting parser with proper octet validation, add tests Important TuxCare License Agreement CVE-2022-32212 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. Moderate TuxCare License Agreement CVE-2023-46809 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - ALTNJS-219: Remove gyp. Build for CL10 Important TuxCare License Agreement CVE-2025-23166 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5 decryption logic, preventing a Marvin‑style padding‑oracle attack that could allow recovery of sensitive data. Moderate TuxCare License Agreement CVE-2023-46809 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2024-27982 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2024-27982 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - Remove python from runtime dependencies Important TuxCare License Agreement CVE-2023-38552 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that could lead to remote denial of service when malformed input is processed Important TuxCare License Agreement CVE-2024-22019 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-27982: disallow OBS folding in HTTP headers by default Moderate TuxCare License Agreement CVE-2022-32215 CVE-2022-32213 CVE-2024-27982 CVE-2022-35256 CVE-2022-32214 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource exhaustion during decompression Moderate TuxCare License Agreement CVE-2024-22025 CVE-2023-46809 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to prevent sensitive data leakage Low TuxCare License Agreement CVE-2023-45143 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - Enable shared OpenSSL Moderate TuxCare License Agreement CVE-2024-0727 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options, preventing potential information disclosure Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection on abrupt socket close Important TuxCare License Agreement CVE-2025-59465 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch blocks to route exceptions through error handlers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2025-59466 CVE-2026-21637 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism that could expose uninitialized memory when using vm module with timeout options, preventing potential information disclosure Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism preventing race condition that could expose uninitialized memory Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle mechanism preventing race condition that could expose uninitialized memory Important TuxCare License Agreement CVE-2025-55131 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of calling FatalException - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent remote attackers from crashing TLS servers Important TuxCare License Agreement CVE-2026-21637 CVE-2025-59466 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-22150: undici uses predictable Math.random() for multipart/form-data boundary, allowing attackers to tamper with backend requests under certain conditions Moderate TuxCare License Agreement CVE-2025-22150 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to prevent uncaught TypeError when a __proto__ header is received and the application accesses req.headersDistinct or req.trailersDistinct Important TuxCare License Agreement CVE-2026-21710 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21713: use CRYPTO_memcmp instead of memcmp in Web Cryptography HMAC signature verification to prevent timing attacks Moderate TuxCare License Agreement CVE-2026-21713 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21713 CVE-2026-21714 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 CVE-2026-21712 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow instead of leaking memory Moderate TuxCare License Agreement CVE-2026-21714 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21712: return original href when ada::parse fails in url.format() instead of crashing on malformed IDN hostnames Moderate TuxCare License Agreement CVE-2026-21712 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants so consecutive numeric strings no longer collide in V8's internal string table (HashDoS via JSON.parse) Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a Name's hash_field via a 3-round xorshift-multiply with compile-time constants, so consecutive numeric strings no longer collide in V8's internal string table Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-21717: scramble V8 array-index hash_field with a 3-round xorshift-multiply so consecutive numeric strings no longer hash to consecutive buckets, preventing O(n^2) HashDoS via JSON.parse Moderate TuxCare License Agreement CVE-2026-21717 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-30581: policy: handle mainModule.__proto__ bypass by installing the policy-aware require() on the module prototype and assigning process.mainModule via setOwnProperty(), closing the process.mainModule.__proto__.require() experimental-policy bypass - CVE-2023-44487: nghttp2 (HTTP/2 Rapid Reset): backport the upstream nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming RST_STREAM frames now trigger a GOAWAY instead of unbounded work Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-44487: HTTP/2 Rapid Reset. Backport the nghttp2 RST_STREAM rate-limit mitigation (token bucket, burst=1000 rate=33/s) to the bundled deps/nghttp2 1.47.0; once the per-connection budget is exhausted a GOAWAY is sent, tearing down peers that rapidly open and cancel HTTP/2 streams. Minimal cherry-pick of upstream nghttp2 commit 72b4af6143 (shipped in 1.57.0), no wholesale version bump Important TuxCare License Agreement CVE-2023-44487 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-30581: handle mainModule.__proto__ bypass of the experimental policy mechanism; set the policy-wrapped require on Module.prototype and use setOwnProperty for process.mainModule (backport of nodejs/node d0a8264ec9) - CVE-2023-44487: HTTP/2 Rapid Reset; backport the nghttp2 RST_STREAM rate-limit mitigation (token-bucket limiter, default burst 1000 / rate 33, GOAWAY on exhaustion) into bundled deps/nghttp2 (backport of nghttp2 72b4af6) Important TuxCare License Agreement CVE-2023-30581 CVE-2023-44487 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48619: cap the HTTP/2 client originSet at 128 entries so a malicious server can no longer drive unbounded memory growth via repeated ORIGIN frames; the session is destroyed with ERR_HTTP2_TOO_MANY_ORIGINS once the cap is exceeded (backport of nodejs/node c79968e108) - CVE-2026-48930: reject dns.lookup()/dnsPromises.lookup()/net.connect() hostnames that contain an embedded NUL byte, preventing silent authority rebinding caused by C-string truncation in the resolver bindings; adds validateStringWithoutNullBytes (backport of nodejs/node 7dafafa2) - CVE-2026-48933: guard the legacy CipherBase::Update() output-length computation against signed-int overflow (len + block_size > INT_MAX), turning ~2 GiB one-shot cipher inputs into a clean failure instead of an out-of-bounds write; the legacy analog of the WebCrypto fix in nodejs/node 98fbc89211 (Node 12 has no WebCrypto) Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation in the resolver bindings (backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes) - CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a malicious server can no longer cause unbounded memory growth via ORIGIN frames (backport of nodejs/node@c79968e1) - CVE-2026-48933: crypto: guard the cipher output-length computation against signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc (Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892) Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48619: cap http2 client originSet size (default 128, option maxOriginSetSize) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS, preventing unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames containing embedded NUL bytes via new validateStringWithoutNullBytes, preventing silent authority rebinding from c-string truncation in the resolver bindings - CVE-2026-48933: guard the WebCrypto AES cipher output length with TryGetIntCipherOutputLength so ~2 GiB inputs fail cleanly instead of overflowing the signed int buffer length and aborting the process Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48619: http2 client OOM via unbounded ORIGIN frames. Backport upstream c79968e108 (first in v22.23.0): cap the client-side originSet (default 128, configurable via options.maxOriginSetSize on connect) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded. Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present. - CVE-2026-48930: TLS/DNS embedded-NUL hostname authority rebinding. Backport upstream 7dafafa242 (first in v22.23.0): add validateStringWithoutNullBytes() and reject embedded NUL bytes in the hostname/options.host arguments of dns.lookup, dnsPromises.lookup and net.connect before they reach the NUL-terminated C resolver. - CVE-2026-48933: WebCrypto AES cipher output-length integer overflow. Backport upstream 98fbc89211 (first in v22.23.0): add TryGetIntCipherOutputLength() guard in crypto_cipher.h and use it in AES_Cipher() so an input length near 2 GiB fails cleanly instead of overflowing the signed int buffer length and aborting the process. Critical TuxCare License Agreement CVE-2026-48933 CVE-2026-48930 CVE-2026-48619 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48619: cap HTTP/2 client originSet size to prevent unbounded memory growth from malicious ORIGIN frames - CVE-2026-48930: reject dns/net hostnames with embedded NUL bytes to prevent silent authority rebinding via C-string truncation - CVE-2026-48933: guard WebCrypto cipher output length to avoid signed integer overflow on ~2 GiB inputs Critical TuxCare License Agreement CVE-2023-32003 CVE-2026-48933 CVE-2026-48930 CVE-2023-30582 CVE-2026-48619 CVE-2024-37372 CVE-2023-32005 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48931 CVE-2026-48618 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48617: gate process.report.writeReport() on the fs.write permission so diagnostic reports cannot escape the --allow-fs-write allow-list - CVE-2026-48935: disable FileHandle.utimes() when the Permission Model is enabled so file timestamps cannot be changed with read-only access Moderate TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 CVE-2026-48618 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2023-39333: module: stop code injection through WebAssembly export names in lib/internal/modules/esm/create_dynamic_module.js -- the ESM facade now uses index-derived local bindings and a JSONStringify-quoted import.meta.exports key instead of interpolating the attacker-controlled export name into code position (adapted from nodejs/node@eaf9083c: V8 8.4 has no ES2022 arbitrary module namespace names, so the `export { ... as NAME }` clause is emitted only for names matching the IdentifierName grammar) - CVE-2026-48931: http: destroy keep-alive sockets that receive unsolicited data while idle in the Agent freeSockets pool, closing the response-queue poisoning window left open once responseKeepAlive() detaches the parser and its 'data' listener (backport of nodejs/node@0a22d401 squashed with its regression follow-up nodejs/node@eaa29254, which guards the idle socket at the handle level instead of attaching a public 'data' listener plus resume()) Low TuxCare License Agreement CVE-2026-48931 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48937: http2: tear down the session when nghttp2 internally queues a GOAWAY for a low-level protocol error. nghttp2 calls nghttp2_session_terminate_session() itself and returns success from nghttp2_session_mem_recv() without any callback, so the Http2Session stayed live on a dead socket, holding its streams, buffers and handle -- repeatable by an unauthenticated peer for memory/handle exhaustion. OnFrameSent() now flags a GOAWAY we did not initiate and SendPendingData() raises NGHTTP2_ERR_PROTO to JavaScript after it is written (backport of nodejs/node@a8a0d128; Node 14 has no graceful_close_initiated_ flag, so that term of the guard is covered by the new goaway_initiated_ flag and by is_closing()) Low TuxCare License Agreement CVE-2026-48937 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48618: normalize the peer hostname with domainToASCII() before splitting it into DNS labels in tls.checkServerIdentity(), so the verifier counts the same labels the resolver connected to; Unicode dot separators (U+3002, U+FF0E, U+FF61) can no longer defeat the wildcard-depth rule and make a *.example.com certificate authenticate a host two levels below it (backport of nodejs/node 1efb4ff51a plus the required IPv6 IP-SAN follow-up 1d87a24050) - CVE-2026-48928: add the 'i' flag to the SNI RegExp built by tls.Server.prototype.addContext(), so an uppercase or mixed-case SNI hostname selects its per-hostname SecureContext instead of silently falling back to the server's default context and bypassing per-tenant client-certificate authorization in multi-context mTLS deployments (backport of nodejs/node 39d1d09684) - CVE-2026-48934: bind a reusable TLS client session to the host it was authenticated for, so a session obtained from host A can no longer be replayed against host B to skip checkServerIdentity() via isSessionReused(); adds wrapSessionState/getSessionForReuse and an explicit TLSSocket.prototype.getSession (backport of nodejs/node fd890ba01d, with the fix's optional chaining rewritten to && form because V8 7.8 has no ?.) - CVE-2026-58040: bind identity checks to session and socket reuse in the https.Agent, the vector CVE-2026-48934 left open. A request supplying its own checkServerIdentity is tagged with a unique per-request index that Agent.prototype.getName() appends, so it gets its own pool bucket; createConnection() neither reads nor writes the TLS session cache for it, and a new keepSocketAlive() override keeps its socket out of freeSockets. A later request using the default strict check can therefore no longer inherit a session or a keep-alive socket authenticated under permissive rules and be reported authorized against an unverified host (backport of nodejs/node 51123159fe) Important TuxCare License Agreement CVE-2026-48937 CVE-2026-48931 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp that Node compiles by default (the tarball's 6.0.11 is rebased to 6.1.1 by CVE-2024-22019 and CVE-2024-27982 earlier in this series), so headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require the LF after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-23167: restore HTTP/1 message-framing terminator validation in both parsers Node 12 bundles. In the loose (non-strict) state machine of llhttp 2.1.6 -- the one Node compiles, since LLHTTP_STRICT_MODE is never set -- headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done / chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a CR instead of consuming any byte, and res_line_almost_done requires the LF after the response status line's CR. The legacy deps/http_parser 2.9.4, which node.gypi also links and which --http-parser=legacy (or NODE_OPTIONS) selects at runtime, is built with HTTP_PARSER_STRICT=0 and had the identical defect; its five framing assertions are made unconditional via a new FRAMING_CHECK macro. A header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT instead of swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2025-23167: restore terminator validation in the loose state machine of the bundled llhttp 2.1.6 that Node compiles by default, so headers_almost_done, chunk_size_almost_done, the chunk_data_almost_done / chunk_data_almost_done_skip pair and res_line_almost_done require the LF (resp. CR then LF) after a CR instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the byte and parsing what follows as a second, smuggled request Moderate TuxCare License Agreement CVE-2025-23167 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-48618: tls: IDNA-normalize the peer hostname before splitting it into DNS labels in checkServerIdentity(), so the verifier splits the same labels the resolver does and a Unicode dot separator (U+3002/U+FF0E/U+FF61) can no longer defeat the wildcard-depth rule (backport of nodejs/node@2197a471 plus the mandatory IPv6 IP-SAN follow-up @1d87a240) - CVE-2026-48928: tls: add the 'i' flag to the RegExp built by Server.prototype.addContext(), so SNI context matching is case-insensitive as RFC 6066 Section 3 requires and an uppercased SNI hostname can no longer fall back to the default context, bypassing per-tenant mTLS client-CA policy (backport of nodejs/node@39d1d096) - CVE-2026-48934: tls: bind a reusable client session to the host it was authenticated for, so a session obtained from one host can no longer be replayed against another to skip checkServerIdentity() on resumption (backport of nodejs/node@fd890ba0) - CVE-2026-58040: https: bind identity checks to session reuse -- the incomplete-fix follow-up to CVE-2026-48934, which left the https.Agent layer untouched, so getName() did not key on checkServerIdentity, sessions were cached purely on options._agentKey and there was no keepSocketAlive override. A request with a custom per-request checkServerIdentity is now excluded from socket reuse and from the TLS session cache, so a connection authenticated under one callback cannot be resumed under another, where the identity check is skipped (backport of nodejs/node@51123159, the v22.x release-line commit shipped in v22.23.2; the upstream establishTunnel() hunk is dropped because 14.21.3 has no proxy-tunnel support in lib/https.js) Moderate TuxCare License Agreement CVE-2026-48934 CVE-2026-48928 CVE-2026-48618 CVE-2026-58040 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs18-zlib collection. On CL7 node is now built against its bundled deps/zlib, because the base OS zlib 1.2.7 makes npm fail with Z_DATA_ERROR while inflating registry responses. Other platforms keep linking the system zlib as before. - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive transitively through alt-nodejs18-zlib-devel. Moderate TuxCare License Agreement CVE-2026-58040 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-58040: https: bind identity checks to session reuse, so a request passing its own checkServerIdentity gets its own https.Agent pool name and neither resumes a cached TLS session nor reuses a keep-alive socket that was authenticated under different identity rules (incomplete-fix follow-up to CVE-2026-48934) Moderate TuxCare License Agreement CVE-2026-58040 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - Update to 22.23.2 Important TuxCare License Agreement CVE-2026-58042 CVE-2026-58045 CVE-2026-58041 CVE-2026-58043 CVE-2026-58039 CVE-2026-56850 CVE-2026-56847 CVE-2026-56846 CVE-2026-56848 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2022-43548: harden the inspector IsIPAddress() to parse IPv4 and bracketed IPv6 hosts with uv_inet_pton(), rejecting octal, hexadecimal and leading-zero octet formats and treating 0.0.0.0/8 and ::/128 as non-routable, closing the --inspect DNS-rebinding host allow-list bypass - Folded in upstream follow-up 73fa9ab7a5, which keeps the IPv6 string terminator inside the INET6_ADDRSTRLEN buffer Important TuxCare License Agreement CVE-2022-43548 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-56846: keep HTTP/2 header blocks charged against maxSessionMemory for as long as JS can reach them. HandleHeadersFrame() now moves current_headers_length_ into a new Http2Stream::retained_headers_length_ counter instead of un-charging it from the session total the moment the headers are handed to JS, and RemoveStream() drains both counters when the stream leaves the session, so a peer can no longer keep unbounded header memory alive on stalled streams while maxSessionMemory reads as near zero - CVE-2026-56848: do not force purge pending session data from Http2Stream::SubmitRstStream() when RST_STREAM is submitted for a refused stream while nghttp2 is still inside a receive callback. Such a stream (a HEADERS frame arriving for an unknown stream on a closed session, e.g. right after a GOAWAY) is now answered with FlushRstStream() alone, so nghttp2_session_mem_send() is no longer re-entered from inside nghttp2_session_mem_recv() where it could free streams the active receive is still using Important TuxCare License Agreement CVE-2026-56846 CVE-2026-56848 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-56846: http2: retain header memory in session accounting, so a header block handed to JS by Http2Session::HandleHeadersFrame() stays charged against maxSessionMemory until the stream is removed, instead of being un-charged while the JS objects can still keep it alive - CVE-2026-56848: http2: defer rst stream while in scope, so submitting RST_STREAM with NGHTTP2_REFUSED_STREAM from inside an nghttp2 receive callback flushes the frame instead of force-purging pending data, which re-entered nghttp2's send path and freed streams the active receive was still using Important TuxCare License Agreement CVE-2026-56846 CVE-2026-56848 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-56846: http2: retain header memory in session accounting -- HandleHeadersFrame() un-charged the decoded header block from maxSessionMemory as soon as it handed it to JS, even though the JS objects can keep the block alive for the whole lifetime of the stream, so a peer that opens many streams with large header blocks and never lets them complete keeps unbounded header memory alive while the credit-based limit reads as near zero and never rejects a new stream. The amount is now moved into a new per-stream counter, Http2Stream::retained_headers_length_, and RemoveStream() drains both counters when the stream is erased (backport of nodejs/node@f14d78b9, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test with two deviations. The header block is built as an object with a multi-valued cookie field because 14.21.3's Http2Session#request() rejects the flat array upstream passes; that one is required, or the test throws ERR_INVALID_ARG_TYPE before it ever reaches the fix. The server also raises maxHeaderListPairs to 4096, which is hardening: it puts the pair-count branch of AddHeader() structurally out of reach, leaving the session-memory branch as the only thing the test can be measuring. The wire shape still matches upstream's -- 120 cookie fields plus four pseudo-headers, 124 entries. The three doc/api/http2.md hunks are deliberately omitted, so the -docs sub-package keeps describing maxSessionMemory without the "header blocks retained by open streams" clause) - CVE-2026-56848: http2: defer rst stream while in scope -- SubmitRstStream() force-purged pending session data via SendPendingData() for every error code except NGHTTP2_CANCEL, so a RST_STREAM submitted for a refused stream from inside an nghttp2 receive callback re-entered nghttp2_session_mem_send() while nghttp2_session_mem_recv() was still on the stack, and the send path could free streams the active receive was still using (heap use-after-free, reachable by sending GOAWAY with last_stream_id 0 immediately followed by HEADERS for further streams). NGHTTP2_REFUSED_STREAM now takes the same deferred path, flushing the RST_STREAM and leaving the pending data for the enclosing Http2Scope (backport of nodejs/node@daa6d25e, the v22.x release-line commit shipped in v22.23.2, carrying the upstream regression test verbatim; the cosmetic re-indent of the pre-existing AddPendingRstStream block is not carried) Important TuxCare License Agreement CVE-2026-56846 CVE-2026-56848 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-56846: keep HTTP/2 header blocks charged against maxSessionMemory while the JS objects built from them can still keep them alive. A new Http2Stream::retained_headers_length_ accumulates what Http2Session::HandleHeadersFrame() used to un-charge the moment it handed the headers up to JS, and Http2Session::RemoveStream() drains both counters when the stream leaves the session, so a peer can no longer hold unbounded header memory alive across many stalled streams while the credit-based limit reads as near zero (backport of nodejs/node f14d78b9e0). Node 12's RemoveStream() takes the stream as a parameter instead of looking it up by id, and its now-redundant un-charge in Http2Stream::~Http2Stream() is removed so the counter is not decremented twice - CVE-2026-56848: stop Http2Stream::SubmitRstStream() from force-purging the session's pending outbound data for a refused stream. Resetting a stream that nghttp2 refused after a GOAWAY happens from inside a receive callback, where session_->SendPendingData() re-enters nghttp2_session_mem_send() while nghttp2_session_mem_recv() is still on the stack and can free streams the active receive is still using. Such a reset now goes out through FlushRstStream() alone, extending the deferral that already covered NGHTTP2_CANCEL to NGHTTP2_REFUSED_STREAM (backport of nodejs/node daa6d25e3d) Important TuxCare License Agreement CVE-2026-48934 CVE-2026-48928 CVE-2026-56846 CVE-2026-56848 CVE-2026-48618 CVE-2026-58040 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - Update to 24.18.1 Important TuxCare License Agreement CVE-2026-58043 CVE-2026-56846 CVE-2026-56848 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - Update to 26.5.1 Important TuxCare License Agreement CVE-2026-58043 CVE-2026-56846 CVE-2026-56848 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-56846: HTTP/2 header blocks retained by JS escaped the maxSessionMemory budget. Backport upstream f14d78b9e020 (first in v22.23.2): Http2Session::HandleHeadersFrame() un-charged current_headers_length_ from the session total right after handing the decoded headers to JS, even though those objects can keep the block alive for the whole life of the stream, so a peer opening many streams with large header blocks and never completing them kept unbounded header memory reachable while currentSessionMemory read near zero and no stream was ever refused. Move the octets into a new per-stream counter retained_headers_length_ instead, and drain both counters in Http2Session::RemoveStream(). - CVE-2026-56848: HTTP/2 heap use-after-free via re-entrant RST_STREAM for a refused stream. Backport upstream daa6d25e3dce (first in v22.23.2): Http2Stream::SubmitRstStream() deferred the force purge of pending session data only for NGHTTP2_CANCEL, so for NGHTTP2_REFUSED_STREAM it called SendPendingData() -- and thus nghttp2_session_mem_send() -- while nghttp2_session_mem_recv() was still on the stack, letting the send path free streams the active receive was still using. Flush the RST_STREAM through nghttp2's normal queue and return instead when the session is in scope and the code is NGHTTP2_REFUSED_STREAM. Important TuxCare License Agreement CVE-2026-48934 CVE-2026-48937 CVE-2026-48928 CVE-2026-56846 CVE-2026-56848 CVE-2026-48931 CVE-2026-48618 CVE-2026-58040 cpe:/o:centos:centos:9 Community Enterprise Operating System 9 - CVE-2026-58043: permission: avoid granting radix split nodes so an internal radix-tree branch point created while inserting sibling --allow-fs-read / --allow-fs-write entries (e.g. secret1, secret2, secret3) is no longer mistakenly marked as an explicitly granted path itself (e.g. secret) Important TuxCare License Agreement CVE-2026-58043 cpe:/o:centos:centos:9 alt-nodejs12-nodejs alt-nodejs12-nodejs-devel alt-nodejs12-nodejs-docs alt-nodejs12-npm alt-nodejs16-nodejs alt-nodejs16-nodejs-devel alt-nodejs16-nodejs-docs alt-nodejs16-npm alt-nodejs14-nodejs alt-nodejs14-nodejs-devel alt-nodejs14-nodejs-docs alt-nodejs14-npm alt-nodejs18-nodejs alt-nodejs18-nodejs-devel alt-nodejs18-nodejs-docs alt-nodejs18-npm alt-nodejs20-nodejs alt-nodejs20-nodejs-devel alt-nodejs20-nodejs-docs alt-nodejs20-npm alt-nodejs22-nodejs alt-nodejs22-nodejs-devel alt-nodejs22-nodejs-docs alt-nodejs22-npm alt-nodejs24-nodejs alt-nodejs24-nodejs-devel alt-nodejs24-nodejs-docs alt-nodejs24-npm alt-nodejs26-nodejs alt-nodejs26-nodejs-devel alt-nodejs26-nodejs-docs alt-nodejs26-npm x86_64 0:12.22.12-2.el9.tuxcare.els2 d07bf2a08d50eb66 0:12.22.12-2.el9.tuxcare.els2 x86_64 0:12.22.12-2.el9 x86_64 0:16.20.2-1.el9.tuxcare.els2 0:16.20.2-1.el9.tuxcare.els2 x86_64 0:8.19.4-16.20.2.1.el9 x86_64 0:14.21.3-1.1.el9.tuxcare.els1 0:14.21.3-1.1.el9.tuxcare.els1 x86_64 0:6.14.18-14.21.3.1.el9 x86_64 0:16.20.2-1.el9.tuxcare.els5 0:16.20.2-1.el9.tuxcare.els5 x86_64 0:14.21.3-1.1.el9.tuxcare.els4 0:14.21.3-1.1.el9.tuxcare.els4 x86_64 0:12.22.12-2.el9.tuxcare.els4 0:12.22.12-2.el9.tuxcare.els4 x86_64 0:14.21.3-1.1.el9.tuxcare.els5 0:14.21.3-1.1.el9.tuxcare.els5 x86_64 0:16.20.2-2.el9.tuxcare.els6 0:16.20.2-2.el9.tuxcare.els6 x86_64 0:8.19.4-16.20.2.2.el9 x86_64 0:12.22.12-2.el9.tuxcare.els5 0:12.22.12-2.el9.tuxcare.els5 x86_64 0:14.21.3-2.el9.tuxcare.els6 0:14.21.3-2.el9.tuxcare.els6 x86_64 0:6.14.18-14.21.3.2.el9 x86_64 0:14.21.3-3.el9 0:14.21.3-3.el9 x86_64 0:6.14.18-14.21.3.3.el9 x86_64 0:12.22.12-3.el9 0:12.22.12-3.el9 x86_64 0:14.21.3-5.el9 0:14.21.3-5.el9 x86_64 0:6.14.18-14.21.3.5.el9 x86_64 0:16.20.2-3.el9 0:16.20.2-3.el9 x86_64 0:8.19.4-16.20.2.3.el9 x86_64 0:14.21.3-9.el9 0:14.21.3-9.el9 x86_64 0:6.14.18-14.21.3.9.el9 x86_64 0:12.22.12-7.el9 0:12.22.12-7.el9 x86_64 0:14.21.3-11.el9 0:14.21.3-11.el9 x86_64 0:6.14.18-14.21.3.11.el9 x86_64 0:18.20.8-3.el9.tuxcare.els 0:18.20.8-3.el9.tuxcare.els x86_64 0:10.8.2-18.20.8.3.el9 x86_64 0:16.20.2-4.el9 0:16.20.2-4.el9 x86_64 0:8.19.4-16.20.2.4.el9 x86_64 0:14.21.3-12.el9 0:14.21.3-12.el9 x86_64 0:6.14.18-14.21.3.12.el9 x86_64 0:16.20.2-5.el9 0:16.20.2-5.el9 x86_64 0:8.19.4-16.20.2.5.el9 x86_64 0:12.22.12-9.el9 0:12.22.12-9.el9 x86_64 1:6.14.16-12.22.12.9.el9 x86_64 0:12.22.12-10.el9 0:12.22.12-10.el9 x86_64 1:6.14.16-12.22.12.10.el9 x86_64 0:12.22.12-12.el9 0:12.22.12-12.el9 x86_64 1:6.14.16-12.22.12.12.el9 x86_64 0:14.21.3-14.el9 0:14.21.3-14.el9 x86_64 0:6.14.18-14.21.3.14.el9 x86_64 0:16.20.2-7.el9 0:16.20.2-7.el9 x86_64 0:8.19.4-16.20.2.7.el9 x86_64 0:12.22.12-14.el9 0:12.22.12-14.el9 x86_64 1:6.14.16-12.22.12.14.el9 x86_64 0:16.20.2-8.el9 0:16.20.2-8.el9 x86_64 0:8.19.4-16.20.2.8.el9 x86_64 0:16.20.2-9.el9 0:16.20.2-9.el9 x86_64 0:8.19.4-16.20.2.9.el9 x86_64 0:16.20.2-10.el9 0:16.20.2-10.el9 x86_64 0:8.19.4-16.20.2.10.el9 x86_64 0:14.21.3-17.el9 0:14.21.3-17.el9 x86_64 1:6.14.18-14.21.3.17.el9 x86_64 0:18.20.8-4.el9 0:18.20.8-4.el9 x86_64 0:10.8.2-18.20.8.4.el9 x86_64 0:14.21.3-18.el9 0:14.21.3-18.el9 x86_64 1:6.14.18-14.21.3.18.el9 x86_64 0:12.22.12-15.el9 0:12.22.12-15.el9 x86_64 1:6.14.16-12.22.12.15.el9 x86_64 0:18.20.8-5.el9 0:18.20.8-5.el9 x86_64 0:10.8.2-18.20.8.5.el9 x86_64 0:14.21.3-19.el9 0:14.21.3-19.el9 x86_64 1:6.14.18-14.21.3.19.el9 x86_64 0:16.20.2-12.el9 0:16.20.2-12.el9 x86_64 0:8.19.4-16.20.2.12.el9 x86_64 0:12.22.12-16.el9 0:12.22.12-16.el9 x86_64 1:6.14.16-12.22.12.16.el9 x86_64 0:16.20.2-13.el9 0:16.20.2-13.el9 x86_64 0:8.19.4-16.20.2.13.el9 x86_64 0:18.20.8-6.el9 0:18.20.8-6.el9 x86_64 0:10.8.2-18.20.8.6.el9 x86_64 0:12.22.12-17.el9 0:12.22.12-17.el9 x86_64 1:6.14.16-12.22.12.17.el9 x86_64 0:16.20.2-17.el9 0:16.20.2-17.el9 x86_64 0:8.19.4-16.20.2.17.el9 x86_64 0:18.20.8-9.el9 0:18.20.8-9.el9 x86_64 0:10.8.2-18.20.8.9.el9 x86_64 0:16.20.2-18.el9 0:16.20.2-18.el9 x86_64 0:8.19.4-16.20.2.18.el9 x86_64 0:18.20.8-10.el9 0:18.20.8-10.el9 x86_64 0:10.8.2-18.20.8.10.el9 x86_64 0:16.20.2-20.el9 0:16.20.2-20.el9 x86_64 0:8.19.4-16.20.2.20.el9 x86_64 0:18.20.8-12.el9 0:18.20.8-12.el9 x86_64 0:10.8.2-18.20.8.12.el9 x86_64 0:14.21.3-21.el9 0:14.21.3-21.el9 x86_64 1:6.14.18-14.21.3.21.el9 x86_64 0:12.22.12-19.el9 0:12.22.12-19.el9 x86_64 1:6.14.16-12.22.12.19.el9 x86_64 0:20.20.2-2.el9 0:20.20.2-2.el9 x86_64 0:10.8.2-20.20.2.2.el9 x86_64 0:14.21.3-22.el9 0:14.21.3-22.el9 x86_64 1:6.14.18-14.21.3.22.el9 x86_64 0:18.20.8-13.el9 0:18.20.8-13.el9 x86_64 0:10.8.2-18.20.8.13.el9 x86_64 0:16.20.2-21.el9 0:16.20.2-21.el9 x86_64 0:8.19.4-16.20.2.21.el9 x86_64 0:12.22.12-20.el9 0:12.22.12-20.el9 x86_64 1:6.14.16-12.22.12.20.el9 x86_64 0:14.21.3-23.el9 0:14.21.3-23.el9 x86_64 1:6.14.18-14.21.3.23.el9 x86_64 0:16.20.2-22.el9 0:16.20.2-22.el9 x86_64 0:8.19.4-16.20.2.22.el9 x86_64 0:12.22.12-21.el9 0:12.22.12-21.el9 x86_64 1:6.14.16-12.22.12.21.el9 x86_64 0:12.22.12-22.el9 0:12.22.12-22.el9 x86_64 1:6.14.16-12.22.12.22.el9 x86_64 0:14.21.3-24.el9 0:14.21.3-24.el9 x86_64 1:6.14.18-14.21.3.24.el9 x86_64 0:18.20.8-14.el9 0:18.20.8-14.el9 x86_64 0:10.8.2-18.20.8.14.el9 x86_64 0:16.20.2-23.el9 0:16.20.2-23.el9 x86_64 0:8.19.4-16.20.2.23.el9 x86_64 0:20.20.2-3.el9 0:20.20.2-3.el9 x86_64 0:10.8.2-20.20.2.3.el9 x86_64 0:18.20.8-17.el9 0:18.20.8-17.el9 x86_64 0:10.8.2-18.20.8.17.el9 x86_64 0:20.20.2-6.el9 0:20.20.2-6.el9 x86_64 0:10.8.2-20.20.2.6.el9 x86_64 0:14.21.3-25.el9 0:14.21.3-25.el9 x86_64 1:6.14.18-14.21.3.25.el9 x86_64 0:14.21.3-26.el9 0:14.21.3-26.el9 x86_64 1:6.14.18-14.21.3.26.el9 x86_64 0:12.22.12-24.el9 0:12.22.12-24.el9 x86_64 1:6.14.16-12.22.12.24.el9 x86_64 0:16.20.2-24.el9 0:16.20.2-24.el9 x86_64 0:8.19.4-16.20.2.24.el9 x86_64 0:12.22.12-26.el9 0:12.22.12-26.el9 x86_64 1:6.14.16-12.22.12.26.el9 x86_64 0:14.21.3-28.el9 0:14.21.3-28.el9 x86_64 1:6.14.18-14.21.3.28.el9 x86_64 0:14.21.3-31.el9 0:14.21.3-31.el9 x86_64 1:6.14.18-14.21.3.31.el9 x86_64 0:18.20.8-20.el9 0:18.20.8-20.el9 x86_64 0:10.8.2-18.20.8.20.el9 x86_64 0:20.20.2-9.el9 0:20.20.2-9.el9 x86_64 0:10.8.2-20.20.2.9.el9 x86_64 0:22.23.2-1.el9 0:22.23.2-1.el9 x86_64 0:10.9.8-22.23.2.1.el9 x86_64 0:12.22.12-31.el9 0:12.22.12-31.el9 x86_64 1:6.14.16-12.22.12.31.el9 x86_64 0:18.20.8-22.el9 0:18.20.8-22.el9 x86_64 0:10.8.2-18.20.8.22.el9 x86_64 0:20.20.2-11.el9 0:20.20.2-11.el9 x86_64 0:10.8.2-20.20.2.11.el9 x86_64 0:14.21.3-34.el9 0:14.21.3-34.el9 x86_64 1:6.14.18-14.21.3.34.el9 x86_64 0:12.22.12-32.el9 0:12.22.12-32.el9 x86_64 1:6.14.16-12.22.12.32.el9 x86_64 0:24.18.1-1.el9 0:24.18.1-1.el9 x86_64 0:11.16.0-24.18.1.1.el9 x86_64 0:26.5.1-1.el9 0:26.5.1-1.el9 x86_64 0:11.17.0-26.5.1.1.el9 x86_64 0:16.20.2-29.el9 0:16.20.2-29.el9 x86_64 0:8.19.4-16.20.2.29.el9 x86_64 0:20.20.2-12.el9 0:20.20.2-12.el9 x86_64 0:10.8.2-20.20.2.12.el9