Repository navigation
chore(deps): refresh rpm lockfiles [SECURITY] - #1
Open
konflux-internal-p02[bot] wants to merge 1 commit into
Open
konflux-internal-p02[bot] wants to merge 1 commit into
konflux-internal-p02[bot] wants to merge 1 commit into
Conversation
konflux-internal-p02
Bot
force-pushed
the
konflux/mintmaker/main/lock-file-maintenance-vulnerability
branch
7 times, most recently
from
September 28, 2026 01:06
947fa24 to
9567571
Compare
konflux-internal-p02
Bot
force-pushed
the
konflux/mintmaker/main/lock-file-maintenance-vulnerability
branch
from
September 30, 2026 02:33
9567571 to
852a586
Compare
konflux-internal-p02
Bot
force-pushed
the
konflux/mintmaker/main/lock-file-maintenance-vulnerability
branch
from
October 2, 2026 03:02
852a586 to
0e0f6a8
Compare
konflux-internal-p02
Bot
force-pushed
the
konflux/mintmaker/main/lock-file-maintenance-vulnerability
branch
4 times, most recently
from
October 11, 2026 01:11
7db4a05 to
2f06fc0
Compare
Signed-off-by: konflux-internal-p02 <170854209+konflux-internal-p02[bot]@users.noreply.github.com>
konflux-internal-p02
Bot
force-pushed
the
konflux/mintmaker/main/lock-file-maintenance-vulnerability
branch
from
October 13, 2026 04:56
2f06fc0 to
b717bd1
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
File deploy/konflux/cli/rpms.in.yaml:
7.76.1-40.el9_8.7->7.76.1-40.el9_8.810.40-6.el9->10.40-7.el9_810.40-6.el9->10.40-7.el9_8File deploy/konflux/e2e-odh/rpms.in.yaml:
7.76.1-40.el9_8.7->7.76.1-40.el9_8.810.40-6.el9->10.40-7.el9_810.40-6.el9->10.40-7.el9_8File deploy/konflux/gateway/rpms.in.yaml:
10.40-6.el9->10.40-7.el9_810.40-6.el9->10.40-7.el9_8File deploy/konflux/openclaw/rpms.in.yaml:
10.40-6.el9->10.40-7.el9_810.40-6.el9->10.40-7.el9_8File deploy/konflux/supervisor/rpms.in.yaml:
10.40-6.el9->10.40-7.el9_810.40-6.el9->10.40-7.el9_8pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
CVE-2026-86145
More information
Severity
Important
References
PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
CVE-2026-89156
More information
Severity
Important
References
pcre2: PCRE2: Out-of-bounds write via large pattern input
CVE-2026-89157
More information
Severity
Important
References
PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms
CVE-2026-89158
More information
Severity
Important
References
pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
CVE-2026-89160
More information
Severity
Important
References
pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
CVE-2026-89161
More information
Severity
Important
References
pcre2: pcre2: Out-of-bounds write via crafted regular expression
CVE-2026-103111
More information
Severity
Important
References
curl: curl: Cookie injection via malicious HTTP server using super cookies
CVE-2026-8924
More information
Severity
Moderate
References
curl: curl: Information disclosure via incorrect Digest authentication header reuse
CVE-2026-11856
More information
Severity
Moderate
References
curl: curl: Cookie injection via malicious HTTP server using super cookies
CVE-2026-8924
More information
Details
A flaw was found in curl's cookie parsing logic. A malicious HTTP server can exploit this by setting 'super cookies' that bypass the Public Suffix List check. This allows an attacker-controlled origin to inject cookies that curl then transmits to unrelated third-party domains, leading to compromising request integrity.
Severity
Moderate
References
curl: curl: Information disclosure via incorrect Digest authentication header reuse
CVE-2026-11856
More information
Details
A flaw was found in curl. When
libcurlperforms a transfer to an HTTP origin using Digest authentication and then reuses the same connection handle for a subsequent transfer to a different origin, it may incorrectly send the authentication header intended for the first origin to the second. This could lead to unintended information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data.Severity
Moderate
References
pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions
CVE-2026-86145
More information
Details
A flaw was found in PCRE2. An out-of-bounds write vulnerability exists in the
pcre2_dfa_matchfunction due to improper size checking when reusing cached workspace blocks. A remote attacker could exploit this by providing a specially crafted regular expression or a recursive pattern in conjunction with a small heap limit. This could lead to data corruption or potentially arbitrary code execution, compromising the integrity and availability of the system.Severity
Important
References
PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback
CVE-2026-89156
More information
Details
A flaw was found in PCRE2. An attacker can provide invalid UTF (Unicode Transformation Format) data, leading to an out-of-bounds read during a Just-In-Time (JIT) fallback. This vulnerability could potentially result in a denial of service.
Severity
Important
References
pcre2: PCRE2: Out-of-bounds write via large pattern input
CVE-2026-89157
More information
Details
A flaw was found in PCRE2. On 32-bit platforms, an attacker can provide a specially crafted large pattern, leading to an out-of-bounds write within the pcre2_pattern_convert function. This vulnerability can result in high integrity impact, such as data corruption, and potentially a low availability impact, causing a denial of service.
Severity
Important
References
PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms
CVE-2026-89158
More information
Details
A flaw was found in PCRE2. On 32-bit platforms, an integer overflow in the
pcre2_compile_32function can lead to an out-of-bounds write. This vulnerability could allow a remote attacker to achieve a high integrity impact and a low availability impact, potentially leading to data corruption or denial of service.Severity
Important
References
pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching
CVE-2026-89160
More information
Details
A flaw was found in PCRE2, a library for processing regular expressions. A remote attacker could exploit this vulnerability by providing a specially crafted input that triggers an out-of-bounds read during pattern matching with invalid UTF (Unicode Transformation Format) characters. This could lead to a denial of service, making the affected system or application unavailable.
Severity
Important
References
pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match
CVE-2026-89161
More information
Details
A flaw was found in PCRE2, a library for processing regular expressions. The
pcre2_jit_matchfunction, which handles just-in-time (JIT) compilation for regular expressions, incorrectly manages memory when processing certain inputs. This memory corruption vulnerability could allow a local attacker to cause the application to crash, leading to a denial of service, or potentially execute unauthorized code.Severity
Important
References
pcre2: pcre2: Out-of-bounds write via crafted regular expression
CVE-2026-103111
More information
Details
A flaw was found in pcre2. When an application processes attacker-controlled regular expressions using certain Just-In-Time (JIT) compiler interfaces, an out-of-bounds write with arbitrary data can occur. An attacker could exploit this vulnerability to achieve arbitrary code execution, corrupt memory, or cause a denial of service (DoS).
Severity
Important
References
🔧 This Pull Request updates lock files to use the latest dependency versions.
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.
To execute skipped test pipelines write comment
/ok-to-test.Documentation
Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.