chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
glibc-devel	2.34-274.el9_8 -> 2.34-275.el9_8
glibc	2.34-274.el9_8 -> 2.34-275.el9_8
glibc-common	2.34-274.el9_8 -> 2.34-275.el9_8
glibc-gconv-extra	2.34-274.el9_8 -> 2.34-275.el9_8
glibc-minimal-langpack	2.34-274.el9_8 -> 2.34-275.el9_8
p11-kit	0.26.2-1.el9 -> 0.26.4-1.el9_8
p11-kit-trust	0.26.2-1.el9 -> 0.26.4-1.el9_8
glibc-headers	2.34-274.el9_8 -> 2.34-275.el9_8

---

p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing

CVE-2026-13757

More information

Details

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-13757
• https://bugzilla.redhat.com/show_bug.cgi?id=2494556
• https://www.cve.org/CVERecord?id=CVE-2026-13757
• https://nvd.nist.gov/vuln/detail/CVE-2026-13757
• https://github.com/advisories/GHSA-p2wm-69qx-x25w

---

p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters

CVE-2026-2100

More information

Details

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2026-2100
• https://bugzilla.redhat.com/show_bug.cgi?id=2437308
• https://www.cve.org/CVERecord?id=CVE-2026-2100
• https://nvd.nist.gov/vuln/detail/CVE-2026-2100
• https://github.com/p11-glue/p11-kit/pull/740
• https://github.com/p11-glue/p11-kit/releases/tag/0.26.2

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: (in timezone Etc/UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.

[rhacs-bot]

Auto-approved by automation.

[rhacs-bot]

Auto-approved by automation.