RLSA-2026:42088

See a problem?
Please try reporting it to the source first.
Source
https://errata.rockylinux.org/RLSA-2026:42088
Import Source
https://storage.googleapis.com/resf-osv-data/RLSA-2026:42088.json
JSON Data
https://api.test.osv.dev/v1/vulns/RLSA-2026:42088
Upstream
  • CVE-2026-39872
  • CVE-2026-43663
  • CVE-2026-43676
  • CVE-2026-43699
  • CVE-2026-43701
  • CVE-2026-43705
  • CVE-2026-43707
  • CVE-2026-43712
  • CVE-2026-43713
  • CVE-2026-43715
  • CVE-2026-43716
  • CVE-2026-43720
  • CVE-2026-43721
  • CVE-2026-43725
  • CVE-2026-43726
  • CVE-2026-43727
  • CVE-2026-43731
  • CVE-2026-43732
  • CVE-2026-43734
  • CVE-2026-43740
  • CVE-2026-43742
  • CVE-2026-43745
Published
2026-07-21T06:00:53.836342Z
Modified
2026-07-21T06:30:06.452314378Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Important: webkit2gtk3 security update
Details

WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.

Security Fix(es):

  • Mozilla: Arbitrary JavaScript execution in PDF.js (CVE-2024-4367)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-39872)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43663)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43676)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43699)

  • webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43701)

  • webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43705)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43707)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43712)

  • webkitgtk: webkitgtk: Visiting a website may leak sensitive data (CVE-2026-43713)

  • webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43715)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43716)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43720)

  • webkitgtk: webkitgtk: A malicious website may silently hijack clipboard data (CVE-2026-43721)

  • webkitgtk: webkitgtk: A malicious website may process restricted web content outside the sandbox (CVE-2026-43725)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43726)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43727)

  • webkitgtk: webkitgtk: Maliciously crafted web content may lead to memory corruption (CVE-2026-43731)

  • webkitgtk: webkitgtk: Maliciously crafted web content may disclose sensitive user information (CVE-2026-43732)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43734)

  • webkitgtk: webkitgtk: Maliciously crafted web content may disclose process memory (CVE-2026-43740)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43742)

  • webkitgtk: webkitgtk: Maliciously crafted web content may cause unexpected process crash (CVE-2026-43745)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References
Credits
    • Rocky Enterprise Software Foundation
    • Red Hat

Affected packages

Rocky Linux:8 / webkit2gtk3

Package

Name
webkit2gtk3
Purl
pkg:rpm/rocky-linux/webkit2gtk3?distro=rocky-linux-8&epoch=0

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0:2.52.5-1.el8_10
Database specific 
{
    "yum_repository": "AppStream"
}

Database specific

source 
"https://storage.googleapis.com/resf-osv-data/RLSA-2026:42088.json"