Refresh RPM lockfiles [SECURITY]

[red-hat-konflux-kflux-prd-rh02]

This PR contains the following updates:

File images/must-gather/rpms.in.yaml:

Package	Change
openshift-clients	4.16.0-202410172045.p0.gcf533b5.assembly.stream.el9 -> 4.20.0-202603030647.p2.g64e778a.assembly.stream.el9
jq	1.6-17.el9 -> 1.6-19.el9
rsync	3.2.3-20.el9 -> 3.2.5-3.el9
tar	2:1.34-7.el9 -> 2:1.34-9.el9_7

File images/openscap/rpms.in.yaml:

Package	Change
openscap	1:1.3.12-1.el9_6 -> 1:1.3.13-1.el9_7
openscap-scanner	1:1.3.12-1.el9_6 -> 1:1.3.13-1.el9_7
expat	2.5.0-5.el9_6 -> 2.5.0-5.el9_7.1
kmod-libs	28-10.el9 -> 28-11.el9
libfdisk	2.37.4-21.el9 -> 2.37.4-21.el9_7
openssl	1:3.2.2-6.el9_5.1 -> 1:3.5.1-7.el9_7
pam	1.5.1-25.el9_6 -> 1.5.1-26.el9_6
systemd	252-51.el9_6.1 -> 252-55.el9_7.7
systemd-pam	252-51.el9_6.1 -> 252-55.el9_7.7
systemd-rpm-macros	252-51.el9_6.1 -> 252-55.el9_7.7
util-linux	2.37.4-21.el9 -> 2.37.4-21.el9_7
util-linux-core	2.37.4-21.el9 -> 2.37.4-21.el9_7

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing

CVE-2025-59375

More information

Details

A memory amplification vulnerability in libexpat allows attackers to trigger excessive dynamic memory allocations by submitting specially crafted XML input. A small input (~250 KiB) can cause the parser to allocate hundreds of megabytes, leading to denial-of-service (DoS) through memory exhaustion.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-59375
• https://bugzilla.redhat.com/show_bug.cgi?id=2395108
• https://www.cve.org/CVERecord?id=CVE-2025-59375
• https://nvd.nist.gov/vuln/detail/CVE-2025-59375
• https://github.com/libexpat/libexpat/blob/676a4c531ec768732fac215da9730b5f50fbd2bf/expat/Changes#L45-L74
• https://github.com/libexpat/libexpat/issues/1018
• https://github.com/libexpat/libexpat/pull/1034
• https://issues.oss-fuzz.com/issues/439133977

---

util-linux: util-linux: Heap buffer overread in setpwnam() when processing 256-byte usernames

CVE-2025-14104

More information

Details

A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam() function, affecting SUID (Set User ID) login-utils utilities writing to the password database.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-14104
• https://bugzilla.redhat.com/show_bug.cgi?id=2419369
• https://www.cve.org/CVERecord?id=CVE-2025-14104
• https://nvd.nist.gov/vuln/detail/CVE-2025-14104

---

systemd-coredump: race condition that allows a local attacker to crash a SUID program and gain read access to the resulting core dump

CVE-2025-4598

More information

Details

A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access the original's privileged process coredump, allowing the attacker to read sensitive data, such as /etc/shadow content, loaded by the original process.

A SUID binary or process has a special type of permission, which allows the process to run with the file owner's permissions, regardless of the user executing the binary. This allows the process to access more restricted data than unprivileged users or processes would be able to. An attacker can leverage this flaw by forcing a SUID process to crash and force the Linux kernel to recycle the process PID before systemd-coredump can analyze the /proc/pid/auxv file. If the attacker wins the race condition, they gain access to the original's SUID process coredump file. They can read sensitive content loaded into memory by the original binary, affecting data confidentiality.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-4598
• https://bugzilla.redhat.com/show_bug.cgi?id=2369242
• https://www.cve.org/CVERecord?id=CVE-2025-4598
• https://nvd.nist.gov/vuln/detail/CVE-2025-4598
• https://www.openwall.com/lists/oss-security/2025/05/29/3

---

runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects

CVE-2025-52881

More information

Details

A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-52881
• https://bugzilla.redhat.com/show_bug.cgi?id=2404715
• https://www.cve.org/CVERecord?id=CVE-2025-52881
• https://nvd.nist.gov/vuln/detail/CVE-2025-52881
• https://github.com/opencontainers/selinux/pull/237

---

golang: net/url: Memory exhaustion in query parameter parsing in net/url

CVE-2025-61726

More information

Details

A flaw was found in the net/url package in the Go standard library. The package does not enforce a limit on the number of unique query parameters it parses. A Go application using the net/http.Request.ParseForm method will try to process all parameters provided in the request. A specially crafted HTTP request containing a massive number of query parameters will cause the application to consume an excessive amount of memory, eventually causing the application to crash or become unresponsive, resulting in a denial of service.

Severity

Important

References

• https://access.redhat.com/security/cve/CVE-2025-61726
• https://bugzilla.redhat.com/show_bug.cgi?id=2434432
• https://www.cve.org/CVERecord?id=CVE-2025-61726
• https://nvd.nist.gov/vuln/detail/CVE-2025-61726
• https://go.dev/cl/736712
• https://go.dev/issue/77101
• https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• https://pkg.go.dev/vuln/GO-2026-4341

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[openshift-ci]

Hi @red-hat-konflux-kflux-prd-rh02[bot]. Thanks for your PR.

I'm waiting for a github.com member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-9b6b29f1a929cb6a5f59e44c1167191ae653d651

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-55ff0c830f37ec1282113a133366899fbf22d8b9

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-53b47692a990764696b59670482826eaefb3b076

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-4117fee46a929ad1fda520e5f02ed4d2677fa434

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-0388841cb286db39a7ee46dab298efc2c851a8c8

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-69ebc8b1812414972dd0cfc316c52d765cc1526d

[yuumasato]

/retest

[yuumasato]

/test e2e-aws-serial

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-3f0c6c112896d4c1b6c95f1a7b4c77f239c36042

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-1dbd0bcbd6b316f114b37d47d8f35feec86e5ae2

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-0778bfb95795ebe9ebe95e1b8316ec384612b2fe

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-9510675dc3fc9328dc1d4a0c8ceb1113768c27d8

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-b6b51aafa9d7495a43ed7a6e75580ff2a72017cb

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-b4cb816191d10eb929c2a99bf6efc775fcfadde6

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-73e46d41359b8d8a6f935472c83aa5c714013780

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-2c74d0f63f512fe085b3b27f448ea343ac74ed3d

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-5363ba1c85276e1223939240a9eb03128a936770

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-a2bdb2ef9c43ea134d6374f4195c01417ee5e94f

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-750db4d4ff5c6da83d0e8ef43c882476e88e4367

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-8cd501b6a76c244f776f0da9e942219c2a280de4

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-e2f8584d0243f7832d7eabb6671061c69cee12a9

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-606e34d8268b8411cf1f7c405750c573d95ba09b

[github-actions]

🤖 To deploy this PR, run the following command:

make catalog-deploy CATALOG_IMG=ghcr.io/complianceascode/compliance-operator-catalog:894-b4c3226fed870bc28fb2eb8495ee336933591537

[openshift-ci]

@red-hat-konflux-kflux-prd-rh02[bot]: The following tests failed, say /retest to rerun all failed tests or /retest-required to rerun all mandatory failed tests:

Test name	Commit	Details	Required	Rerun command
ci/prow/e2e-rosa	b4c3226	link	true	/test e2e-rosa
ci/prow/images	b4c3226	link	true	/test images
ci/prow/e2e-aws-parallel-arm	b4c3226	link	true	/test e2e-aws-parallel-arm

Full PR test history. Your PR dashboard.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here.