chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
kernel-headers	5.14.0-687.44.1.el9_8 -> 5.14.0-687.46.1.el9_8
coreutils	8.32-41.el9_8 -> 8.32-41.el9_8.1
coreutils-common	8.32-41.el9_8 -> 8.32-41.el9_8.1
expat	2.5.0-6.el9_8.1 -> 2.5.0-6.el9_8.3
pam	1.5.1-28.el9 -> 1.5.1-28.el9_8.1
vim-filesystem	2:8.2.2637-26.el9_8.13 -> 2:8.2.2637-26.el9_8.21

---

coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values

CVE-2026-56392

More information

Details

A flaw was found in GNU coreutils, specifically in the unexpand utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when unexpand processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing subsequent operations to write beyond its boundaries. Successful exploitation can cause the unexpand utility to crash, potentially resulting in a denial of service or enabling further memory manipulation.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-56392
• https://bugzilla.redhat.com/show_bug.cgi?id=2506694
• https://www.cve.org/CVERecord?id=CVE-2026-56392
• https://nvd.nist.gov/vuln/detail/CVE-2026-56392
• https://cert.pl/en/posts/2026/07/CVE-2026-56391
• https://git.savannah.gnu.org/cgit/coreutils.git/
• https://git.savannah.gnu.org/cgit/coreutils.git/commit/?id=b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d

---

expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking

CVE-2026-50219

More information

Details

A flaw was found in libexpat. This vulnerability occurs because the library, in versions before 2.8.2, does not properly track handler call depth when certain XML parsing functions are invoked from within handlers during a policy violation. This oversight can lead to a use-after-free condition, which may result in information disclosure, integrity loss, or denial of service.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-50219
• https://bugzilla.redhat.com/show_bug.cgi?id=2484620
• https://www.cve.org/CVERecord?id=CVE-2026-50219
• https://nvd.nist.gov/vuln/detail/CVE-2026-50219
• https://github.com/libexpat/libexpat/pull/1246

---

expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow

CVE-2026-56132

More information

Details

A flaw was found in libexpat, a library used for parsing XML data. An attacker could exploit a heap-based buffer overflow, a type of memory error, by providing specially crafted XML input. This vulnerability occurs when the library mishandles memory reallocation while processing XML, particularly when multiple parsers share data. Successful exploitation could allow the attacker to execute arbitrary code, access sensitive information, or cause the application to crash, leading to a denial of service.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-56132
• https://bugzilla.redhat.com/show_bug.cgi?id=2490669
• https://www.cve.org/CVERecord?id=CVE-2026-56132
• https://nvd.nist.gov/vuln/detail/CVE-2026-56132
• https://github.com/libexpat/libexpat/pull/1272

---

linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module

CVE-2026-54411

More information

Details

A flaw was found in Linux-PAM's pam_userdb module. This vulnerability, categorized as an Observable Timing Discrepancy (CWE-208), allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during plaintext password comparison, an attacker can deduce the password. This flaw is exploitable when the pam_userdb module is configured to store and compare credentials in plaintext, which is not a default setting.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-54411
• https://bugzilla.redhat.com/show_bug.cgi?id=2488766
• https://www.cve.org/CVERecord?id=CVE-2026-54411
• https://nvd.nist.gov/vuln/detail/CVE-2026-54411
• https://cwe.mitre.org/data/definitions/208.html
• https://github.com/linux-pam/linux-pam
• https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h
• https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 27.34%. Comparing base (ac7740c) to head (58b2417).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@              Coverage Diff              @@
##           release-3.25    #3943   +/-   ##
=============================================
  Coverage         27.34%   27.34%           
=============================================
  Files                95       95           
  Lines              5420     5420           
  Branches           2545     2545           
=============================================
  Hits               1482     1482           
  Misses             3211     3211           
  Partials            727      727           

Flag	Coverage Δ
collector-unit-tests	27.34% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.