CLSA-2026-1782216821
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.6esu/CLSA-2026-1782216821.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1782216821
- Upstream
CVE (3)
- CVE-2026-28907
- CVE-2026-28958
- CVE-2026-43660
- Published
- 2026-06-23T12:14:16Z
- Modified
- 2026-10-26T09:43:20Z
- Summary
- webkit2gtk3: Fix of 16 CVEs
- Details
-
- CVE-2026-28907: align ContentSecurityPolicySource::pathMatches() with the CSP3 path-matching algorithm to prevent path-traversal CSP bypass (WebKit bug 308675)
- CVE-2026-43660: preserve all CSP policies when a blob: URL inherits from a page that sent multiple CSP headers (WebKit bug 308906)
- CVE-2026-28958: pass the initiator when computing SameSite info in FrameLoader::load to prevent SameSite=Strict cookie cross-site leakage (WebKit bug 311228)
- References
-
- https://errata.tuxcare.com/els_os/tuxcare9.6esu/CLSA-2026-1782216821.html
- https://nvd.nist.gov/vuln/detail/CVE-2026-28847
- https://nvd.nist.gov/vuln/detail/CVE-2026-28883
- https://nvd.nist.gov/vuln/detail/CVE-2026-28901
- https://nvd.nist.gov/vuln/detail/CVE-2026-28902
- https://nvd.nist.gov/vuln/detail/CVE-2026-28903
- https://nvd.nist.gov/vuln/detail/CVE-2026-28904
- https://nvd.nist.gov/vuln/detail/CVE-2026-28905
- https://nvd.nist.gov/vuln/detail/CVE-2026-28907
- https://nvd.nist.gov/vuln/detail/CVE-2026-28942
- https://nvd.nist.gov/vuln/detail/CVE-2026-28946
- https://nvd.nist.gov/vuln/detail/CVE-2026-28947
- https://nvd.nist.gov/vuln/detail/CVE-2026-28953
- https://nvd.nist.gov/vuln/detail/CVE-2026-28955
- https://nvd.nist.gov/vuln/detail/CVE-2026-28958
- https://nvd.nist.gov/vuln/detail/CVE-2026-43658
- https://nvd.nist.gov/vuln/detail/CVE-2026-43660
Affected packages
TuxCare:AlmaLinux:9.6 / webkit2gtk3
Package
- Name
- webkit2gtk3
- Purl
- pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.6
TuxCare:AlmaLinux:9.6 / webkit2gtk3-devel
Package
- Name
- webkit2gtk3-devel
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.6
TuxCare:AlmaLinux:9.6 / webkit2gtk3-jsc
Package
- Name
- webkit2gtk3-jsc
- Purl
- pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.6