CLSA-2026-1791973636

See a problem?
Import Source
https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json
JSON Data
https://api.osv.dev/v1/vulns/CLSA-2026-1791973636
Upstream
CVE (67)
  • CVE-2026-10009
  • CVE-2026-10011
  • CVE-2026-10977
  • CVE-2026-10985
  • CVE-2026-11024
  • CVE-2026-11039
  • CVE-2026-11057
  • CVE-2026-11099
  • CVE-2026-11121
  • CVE-2026-11124
  • CVE-2026-11159
  • CVE-2026-11663
  • CVE-2026-11675
  • CVE-2026-13971
  • CVE-2026-14389
  • CVE-2026-14414
  • CVE-2026-14427
  • CVE-2026-15766
  • CVE-2026-16417
  • CVE-2026-17702
  • CVE-2026-17745
  • CVE-2026-17757
  • CVE-2026-17914
  • CVE-2026-19160
  • CVE-2026-19161
  • CVE-2026-19176
  • CVE-2026-3538
  • CVE-2026-3909
  • CVE-2026-43804
  • CVE-2026-4460
  • CVE-2026-5870
  • CVE-2026-6298
  • CVE-2026-6364
  • CVE-2026-64713
  • CVE-2026-64728
  • CVE-2026-64730
  • CVE-2026-64753
  • CVE-2026-64757
  • CVE-2026-64778
  • CVE-2026-64779
  • CVE-2026-64782
  • CVE-2026-64783
  • CVE-2026-64784
  • CVE-2026-65332
  • CVE-2026-65336
  • CVE-2026-65337
  • CVE-2026-65341
  • CVE-2026-65351
  • CVE-2026-7353
  • CVE-2026-76041
  • CVE-2026-78376
  • CVE-2026-78914
  • CVE-2026-79020
  • CVE-2026-79112
  • CVE-2026-79144
  • CVE-2026-79147
  • CVE-2026-7920
  • CVE-2026-7923
  • CVE-2026-7949
  • CVE-2026-83596
  • CVE-2026-84359
  • CVE-2026-84635
  • CVE-2026-85049
  • CVE-2026-8510
  • CVE-2026-8579
  • CVE-2026-9983
  • CVE-2026-9998
Published
2026-10-14T10:28:22Z
Modified
2026-10-26T09:43:53Z
Summary
webkit2gtk3: Fix of 62 CVEs
Details
  • Rebase to webkitgtk 2.54.0 (WebKitGTK Security Advisory WSA-2026-0006), aligning with the release RHEL 9 ships (webkit2gtk3-2.54.0-1.el9_8, RHSA-2026:69098).
  • Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from c9s 2.54.0-2 and reverts 317619@main, which aborts Eclipse/SWT applications on a RELEASE_ASSERT in initializeMainThread.
  • Drop fix-renderflexbox-typename.patch (was Patch17); the code it patched is gone on 2.54.0.
  • Build with gcc-toolset-14 (GCC 14) instead of gcc-toolset-12; GCC 12 cannot compile 2.54.0 (ANGLE ResourceMap static_assert, LayoutRect constexpr).
  • Backport the GStreamerCommon.h <WebCore/GraphicsTypesGL.h> include from upstream 2.54.1; GCC resolves the symlinked WebCore private headers to their real path, so the quoted include is not found when building the PCH.
  • Drop the vendored Skia backports for CVE-2026-5870, CVE-2026-7920, CVE-2026-7923, CVE-2026-10009 and CVE-2026-11663 (was Patch20..Patch24); the Skia snapshot bundled with 2.54.0 already includes them.
  • CVEs resolved by this rebase (62 total): CVE-2026-3538, CVE-2026-3909, CVE-2026-4460, CVE-2026-6298, CVE-2026-6364, CVE-2026-7353, CVE-2026-7949, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983, CVE-2026-9998, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985, CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099, CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11675, CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-2026-14427, CVE-2026-15766, CVE-2026-16417, CVE-2026-17702, CVE-2026-17745, CVE-2026-17757, CVE-2026-17914, CVE-2026-19160, CVE-2026-19161, CVE-2026-19176, CVE-2026-43804, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64753, CVE-2026-64757, CVE-2026-64778, CVE-2026-64779, CVE-2026-64782, CVE-2026-64783, CVE-2026-64784, CVE-2026-65332, CVE-2026-65336, CVE-2026-65337, CVE-2026-65341, CVE-2026-65351, CVE-2026-76041, CVE-2026-78376, CVE-2026-78914, CVE-2026-79020, CVE-2026-79112, CVE-2026-79144, CVE-2026-79147, CVE-2026-83596, CVE-2026-84359, CVE-2026-84635, CVE-2026-85049
References

Affected packages

TuxCare:AlmaLinux:9.2 / webkit2gtk3

Package

Name
webkit2gtk3
Purl
pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.54.0-1.el9.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"

TuxCare:AlmaLinux:9.2 / webkit2gtk3-devel

Package

Name
webkit2gtk3-devel
Purl
pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.54.0-1.el9.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"

TuxCare:AlmaLinux:9.2 / webkit2gtk3-jsc

Package

Name
webkit2gtk3-jsc
Purl
pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.54.0-1.el9.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"

TuxCare:AlmaLinux:9.2 / webkit2gtk3-jsc-devel

Package

Name
webkit2gtk3-jsc-devel
Purl
pkg:rpm/tuxcare/webkit2gtk3-jsc-devel?distro=almalinux-9.2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.54.0-1.el9.tuxcare.els12

Database specific

source 
"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"