chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
dbus-broker	28-7.el9 -> 28-9.el9_8
gzip	1.12-1.el9 -> 1.12-2.el9_8
libxml2	2.9.13-14.el9_8.2 -> 2.9.13-14.el9_8.4
tar	2:1.34-11.el9 -> 2:1.34-13.el9_8

---

dbus-broker: dbus-broker: session bus denial of service via EMFILE during peer setup

CVE-2026-16730

More information

Details

A flaw was found in dbus-broker. When the process file-descriptor limit is reached, EMFILE/ENFILE errors during peer setup (notably SO_PEERPIDFD) are handled as fatal failures, causing the broker to exit. A local attacker who can open many connections to the user session bus can trigger this and deny service to the desktop session. Flatpak applications can reach the host session bus through the dbus proxy.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-16730
• https://bugzilla.redhat.com/show_bug.cgi?id=2506348
• https://www.cve.org/CVERecord?id=CVE-2026-16730
• https://nvd.nist.gov/vuln/detail/CVE-2026-16730
• https://github.com/bus1/dbus-broker/issues/435

---

gzip: gzip: Arbitrary file overwrite via insecure temporary file handling in gzexe utility

CVE-2026-41991

More information

Details

A flaw was found in the gzexe utility of GNU gzip. When the mktemp utility is not available, gzexe creates temporary files with predictable names based on the process ID. A local attacker can exploit this by pre-creating a symbolic link to an arbitrary file at the predicted temporary file path. This can lead to a Time-of-Check to Time-of-Use (TOCTOU) condition, allowing the attacker to overwrite arbitrary files on the system.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-41991
• https://bugzilla.redhat.com/show_bug.cgi?id=2494158
• https://www.cve.org/CVERecord?id=CVE-2026-41991
• https://nvd.nist.gov/vuln/detail/CVE-2026-41991
• https://cert.pl/en/posts/2026/04/CVE-2026-41991/
• https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=4e6f8b24ab823146ab8776f0b7fe486ab34d4269
• https://www.gnu.org/software/gzip/

---

gzip: gzip: Information disclosure via global buffer overflow in LZH decompression

CVE-2026-41992

More information

Details

A flaw was found in GNU gzip. This global buffer overflow vulnerability in the LZH decompression logic is caused by improper reuse of shared global state between different decompression formats. An attacker can exploit this by providing a specially crafted LZW file followed by a specially crafted LZH file to the gzip -d command. This can lead to an out-of-bounds read, potentially resulting in information disclosure.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-41992
• https://bugzilla.redhat.com/show_bug.cgi?id=2494159
• https://www.cve.org/CVERecord?id=CVE-2026-41992
• https://nvd.nist.gov/vuln/detail/CVE-2026-41992
• https://cert.pl/en/posts/2026/04/CVE-2026-41991/
• https://cgit.git.savannah.gnu.org/cgit/gzip.git/commit/?id=63dbf6b3b9e6e781df1a6a64e609b10e23969681
• https://www.gnu.org/software/gzip/

---

libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free

CVE-2026-6653

More information

Details

A flaw was found in libxml2. A remote attacker can exploit a use-after-free vulnerability in the xmlParseInternalSubset function by providing maliciously crafted XML input. This improper handling of entity resolution can lead to a denial-of-service (DoS), making the affected system or application unavailable.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-6653
• https://bugzilla.redhat.com/show_bug.cgi?id=2491354
• https://www.cve.org/CVERecord?id=CVE-2026-6653
• https://nvd.nist.gov/vuln/detail/CVE-2026-6653
• https://bugs.launchpad.net/ubuntu/+source/libxml2/+bug/2141260
• https://gitlab.gnome.org/GNOME/libxml2/-/work_items/1058

---

libxml2: libxml2: Arbitrary code execution in xmlcatalog utility via buffer overflow

CVE-2026-11979

More information

Details

A flaw was found in libxml2, specifically within the xmlcatalog utility when operating in shell mode. An attacker can exploit multiple stack-based buffer overflows by providing an excessively long input line. This leads to memory corruption, which may cause the application to crash or potentially allow the attacker to execute arbitrary code within the context of the xmlcatalog process.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-11979
• https://bugzilla.redhat.com/show_bug.cgi?id=2494191
• https://www.cve.org/CVERecord?id=CVE-2026-11979
• https://nvd.nist.gov/vuln/detail/CVE-2026-11979
• https://cert.pl/en/posts/2026/06/CVE-2026-11979
• https://gitlab.gnome.org/GNOME/libxml2/-/commit/c2e233fc1b341685fc99621b2768b503f777a72e

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.

[rhacs-bot]

Auto-approved by automation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.34%. Comparing base (15cbb7f) to head (e4ef7f9).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.25    #3887   +/-   ##
=============================================
  Coverage         27.34%   27.34%           
=============================================
  Files                95       95           
  Lines              5420     5420           
  Branches           2545     2545           
=============================================
  Hits               1482     1482           
  Misses             3211     3211           
  Partials            727      727           

Flag	Coverage Δ
collector-unit-tests	27.34% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.