chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
kernel-headers	4.18.0-553.155.1.el8_10 -> 4.18.0-553.156.1.el8_10
libattr	2.4.48-3.el8 -> 2.6.0-1.el8_10
libnghttp2	1.33.0-6.el8_10.2 -> 1.33.0-6.el8_10.3
pam	1.3.1-39.el8_10 -> 1.3.1-40.el8_10
platform-python	3.6.8-77.el8_10 -> 3.6.8-78.el8_10
python3-libs	3.6.8-77.el8_10 -> 3.6.8-78.el8_10

---

attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr

CVE-2026-54371

More information

Details

A flaw was found in the attr package. This vulnerability allows a local attacker to perform a symlink traversal attack by replacing a pathname component with a symbolic link - either during directory hierarchy traversal by getfattr or during backup restoration by setfattr, which reads and resolves full pathnames from backup files. In both cases, when these utilities are executed by a privileged process over a path controlled by the attacker, this can lead to local privilege escalation.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-54371
• https://bugzilla.redhat.com/show_bug.cgi?id=2490283
• https://www.cve.org/CVERecord?id=CVE-2026-54371
• https://nvd.nist.gov/vuln/detail/CVE-2026-54371

---

nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests

CVE-2026-58055

More information

Details

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-58055
• https://bugzilla.redhat.com/show_bug.cgi?id=2493954
• https://www.cve.org/CVERecord?id=CVE-2026-58055
• https://nvd.nist.gov/vuln/detail/CVE-2026-58055
• https://github.com/bikini/exploitarium/tree/main/nghttp2-nghttpx-upgrade-queue-poison-poc
• https://github.com/nghttp2/nghttp2/commit/ab28105c4a0197da24f8bfc414bc116055249e1e
• https://www.vulncheck.com/advisories/nghttp2-nghttpx-http-request-response-smuggling-via-upgrade-request-with-content-length

---

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

CVE-2026-54411

More information

Details

A flaw was found in Linux-PAM's pam_userdb module. This vulnerability, categorized as an Observable Timing Discrepancy (CWE-208), allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during plaintext password comparison, an attacker can deduce the password. This flaw is exploitable when the pam_userdb module is configured to store and compare credentials in plaintext, which is not a default setting.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-54411
• https://bugzilla.redhat.com/show_bug.cgi?id=2488766
• https://www.cve.org/CVERecord?id=CVE-2026-54411
• https://nvd.nist.gov/vuln/detail/CVE-2026-54411
• https://cwe.mitre.org/data/definitions/208.html
• https://github.com/linux-pam/linux-pam
• https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h
• https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327

---

python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory

CVE-2026-11940

More information

Details

A flaw was found in the tarfile.extractall() function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2026-11940
• https://bugzilla.redhat.com/show_bug.cgi?id=2491848
• https://www.cve.org/CVERecord?id=CVE-2026-11940
• https://nvd.nist.gov/vuln/detail/CVE-2026-11940
• https://github.com/python/cpython/issues/151558
• https://github.com/python/cpython/pull/151559
• https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.