UnratedFix available
webkit2gtk3: Fix of 62 CVEs
Type: advisorySources: OSV
- Rebase to webkitgtk 2.54.0 (WebKitGTK Security Advisory WSA-2026-0006), aligning with the release RHEL 9 ships (webkit2gtk3-2.54.0-1.el9_8, RHSA-2026:69098). - Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from c9s 2.54.0-2 and reverts 317619@main, which aborts Eclipse/SWT applications on a RELEASE_ASSERT in initializeMainThread. - Drop fix-renderflexbox-typename.patch (was Patch17); the code it patched is gone on 2.54.0. - Build with gcc-toolset-14 (GCC 14) instead of gcc-toolset-12; GCC 12 cannot compile 2.54.0 (ANGLE ResourceMap static_assert, LayoutRect constexpr). - Backport the GStreamerCommon.h include from upstream 2.54.1; GCC resolves the symlinked WebCore private headers to their real path, so the quoted include is not found when building the PCH. - Drop the vendored Skia backports for CVE-2026-5870, CVE-2026-7920, CVE-2026-7923, CVE-2026-10009 and CVE-2026-11663 (was Patch20..Patch24); the Skia snapshot bundled with 2.54.0 already includes them. - CVEs resolved by this rebase (62 total): CVE-2026-3538, CVE-2026-3909, CVE-2026-4460, CVE-2026-6298, CVE-2026-6364, CVE-2026-7353, CVE-2026-7949, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983, CVE-2026-9998, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985, CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099, CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11675, CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-
- Products
- webkit2gtk3, webkit2gtk3-devel, webkit2gtk3-jsc, webkit2gtk3-jsc-devel
- Affected versions
- Not specified
- Fixed versions
- 2.54.0-1.el9.tuxcare.els12
- CVEs
- CVE-2026-10009, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985, CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099, CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11663, CVE-2026-11675, CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-2026-14427, CVE-2026-15766, CVE-2026-16417, CVE-2026-17702, CVE-2026-17745, CVE-2026-17757, CVE-2026-17914, CVE-2026-19160, CVE-2026-19161, CVE-2026-19176, CVE-2026-3538, CVE-2026-3909, CVE-2026-43804, CVE-2026-4460, CVE-2026-5870, CVE-2026-6298, CVE-2026-6364, CVE-2026-64713, CVE-2026-64728, CVE-2026-64730, CVE-2026-64753, CVE-2026-64757, CVE-2026-64778, CVE-2026-64779, CVE-2026-64782, CVE-2026-64783, CVE-2026-64784, CVE-2026-65332, CVE-2026-65336, CVE-2026-65337, CVE-2026-65341, CVE-2026-65351, CVE-2026-7353, CVE-2026-76041, CVE-2026-78376, CVE-2026-78914, CVE-2026-79020, CVE-2026-79112, CVE-2026-79144, CVE-2026-79147, CVE-2026-7920, CVE-2026-7923, CVE-2026-7949, CVE-2026-83596, CVE-2026-84359, CVE-2026-84635, CVE-2026-85049, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983, CVE-2026-9998
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 11:58 UTC · Revision 1
Source evidence
- Rebase to webkitgtk 2.54.0 (WebKitGTK Security Advisory WSA-2026-0006), aligning with the release RHEL 9 ships (webkit2gtk3-2.54.0-1.el9_8, RHSA-2026:69098). - Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from c9s 2.54.0-2 and reverts 317619@main, which aborts Eclipse/SWT applications on a RELEASE_ASSERT in initializeMainThread. - Drop fix-renderflexbox-typename.patch (was Patch17); the code it patched is gone on 2.54.0. - Build with gcc-toolset-14 (GCC 14) instead of gcc-toolset-12; GCC 12 cannot compile 2.54.0 (ANGLE ResourceMap static_assert, LayoutRect constexpr). - Backport the GStreamerCommon.h include from upstream 2.54.1; GCC resolves the symlinked WebCore private headers to their real path, so the quoted include is not found when building the PCH. - Drop the vendored Skia backports for CVE-2026-5870, CVE-2026-7920, CVE-2026-7923, CVE-2026-10009 and CVE-2026-11663 (was Patch20..Patch24); the Skia snapshot bundled with 2.54.0 already includes them. - CVEs resolved by this rebase (62 total): CVE-2026-3538, CVE-2026-3909, CVE-2026-4460, CVE-2026-6298, CVE-2026-6364, CVE-2026-7353, CVE-2026-7949, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983, CVE-2026-9998, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985, CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099, CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11675, CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-
osv:CLSA-2026-1791973636
webkit2gtk3
Fixed versions: 2.54.0-1.el9.tuxcare.els12
webkit2gtk3-devel
Fixed versions: 2.54.0-1.el9.tuxcare.els12
webkit2gtk3-jsc
Fixed versions: 2.54.0-1.el9.tuxcare.els12
webkit2gtk3-jsc-devel
Fixed versions: 2.54.0-1.el9.tuxcare.els12
Complete source record
{
"id": "604dc8832be1a81a6972a064d6f4a1f05f8297049a10a9677c02e927a4158d94",
"url": "https://osv.dev/vulnerability/CLSA-2026-1791973636",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "webkit2gtk3: Fix of 62 CVEs",
"summary": "- Rebase to webkitgtk 2.54.0 (WebKitGTK Security Advisory WSA-2026-0006), aligning with the release RHEL 9 ships (webkit2gtk3-2.54.0-1.el9_8, RHSA-2026:69098). - Adopt the CentOS Stream 9 2.54.0 packaging patch set; skia-s390x.patch and mimalloc.patch are new there for 2.54.0, fix-eclipse.patch is from c9s 2.54.0-2 and reverts 317619@main, which aborts Eclipse/SWT applications on a RELEASE_ASSERT in initializeMainThread. - Drop fix-renderflexbox-typename.patch (was Patch17); the code it patched is gone on 2.54.0. - Build with gcc-toolset-14 (GCC 14) instead of gcc-toolset-12; GCC 12 cannot compile 2.54.0 (ANGLE ResourceMap static_assert, LayoutRect constexpr). - Backport the GStreamerCommon.h include from upstream 2.54.1; GCC resolves the symlinked WebCore private headers to their real path, so the quoted include is not found when building the PCH. - Drop the vendored Skia backports for CVE-2026-5870, CVE-2026-7920, CVE-2026-7923, CVE-2026-10009 and CVE-2026-11663 (was Patch20..Patch24); the Skia snapshot bundled with 2.54.0 already includes them. - CVEs resolved by this rebase (62 total): CVE-2026-3538, CVE-2026-3909, CVE-2026-4460, CVE-2026-6298, CVE-2026-6364, CVE-2026-7353, CVE-2026-7949, CVE-2026-8510, CVE-2026-8579, CVE-2026-9983, CVE-2026-9998, CVE-2026-10011, CVE-2026-10977, CVE-2026-10985, CVE-2026-11024, CVE-2026-11039, CVE-2026-11057, CVE-2026-11099, CVE-2026-11121, CVE-2026-11124, CVE-2026-11159, CVE-2026-11675, CVE-2026-13971, CVE-2026-14389, CVE-2026-14414, CVE-",
"evidence": "osv:CLSA-2026-1791973636",
"products": [
{
"name": {
"value": "webkit2gtk3",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.54.0-1.el9.tuxcare.els12",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "webkit2gtk3-devel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.54.0-1.el9.tuxcare.els12",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "webkit2gtk3-jsc",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.54.0-1.el9.tuxcare.els12",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "webkit2gtk3-jsc-devel",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "2.54.0-1.el9.tuxcare.els12",
"evidence": "/affected/3/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CLSA-2026-1791973636",
"aliases": [
"CLSA-2026-1791973636"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.0-1.el9.tuxcare.els12"
}
]
}
],
"package": {
"name": "webkit2gtk3",
"purl": "pkg:rpm/tuxcare/webkit2gtk3?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.0-1.el9.tuxcare.els12"
}
]
}
],
"package": {
"name": "webkit2gtk3-devel",
"purl": "pkg:rpm/tuxcare/webkit2gtk3-devel?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.0-1.el9.tuxcare.els12"
}
]
}
],
"package": {
"name": "webkit2gtk3-jsc",
"purl": "pkg:rpm/tuxcare/webkit2gtk3-jsc?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "2.54.0-1.el9.tuxcare.els12"
}
]
}
],
"package": {
"name": "webkit2gtk3-jsc-devel",
"purl": "pkg:rpm/tuxcare/webkit2gtk3-jsc-devel?distro=almalinux-9.2",
"ecosystem": "TuxCare:AlmaLinux:9.2"
},
"database_specific": {
"source": "https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/almalinux9.2esu/CLSA-2026-1791973636.json"
}
}
],
"modified": "2026-10-26T09:43:53.951328326Z",
"provider": "osv",
"upstream": [
"CVE-2026-10009",
"CVE-2026-10011",
"CVE-2026-10977",
"CVE-2026-10985",
"CVE-2026-11024",
"CVE-2026-11039",
"CVE-2026-11057",
"CVE-2026-11099",
"CVE-2026-11121",
"CVE-2026-11124",
"CVE-2026-11159",
"CVE-2026-11663",
"CVE-2026-11675",
"CVE-2026-13971",
"CVE-2026-14389",
"CVE-2026-14414",
"CVE-2026-14427",
"CVE-2026-15766",
"CVE-2026-16417",
"CVE-2026-17702",
"CVE-2026-17745",
"CVE-2026-17757",
"CVE-2026-17914",
"CVE-2026-19160",
"CVE-2026-19161",
"CVE-2026-19176",
"CVE-2026-3538",
"CVE-2026-3909",
"CVE-2026-43804",
"CVE-2026-4460",
"CVE-2026-5870",
"CVE-2026-6298",
"CVE-2026-6364",
"CVE-2026-64713",
"CVE-2026-64728",
"CVE-2026-64730",
"CVE-2026-64753",
"CVE-2026-64757",
"CVE-2026-64778",
"CVE-2026-64779",
"CVE-2026-64782",
"CVE-2026-64783",
"CVE-2026-64784",
"CVE-2026-65332",
"CVE-2026-65336",
"CVE-2026-65337",
"CVE-2026-65341",
"CVE-2026-65351",
"CVE-2026-7353",
"CVE-2026-76041",
"CVE-2026-78376",
"CVE-2026-78914",
"CVE-2026-79020",
"CVE-2026-79112",
"CVE-2026-79144",
"CVE-2026-79147",
"CVE-2026-7920",
"CVE-2026-7923",
"CVE-2026-7949",
"CVE-2026-83596",
"CVE-2026-84359",
"CVE-2026-84635",
"CVE-2026-85049",
"CVE-2026-8510",
"CVE-2026-8579",
"CVE-2026-9983",
"CVE-2026-9998"
],
"references": [
"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1791973636.html",
"https://nvd.nist.gov/vuln/detail/CVE-2026-10011",
"https://nvd.nist.gov/vuln/detail/CVE-2026-10977",
"https://nvd.nist.gov/vuln/detail/CVE-2026-10985",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11024",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11039",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11057",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11099",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11121",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11124",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11159",
"https://nvd.nist.gov/vuln/detail/CVE-2026-11675",
"https://nvd.nist.gov/vuln/detail/CVE-2026-13971",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14389",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14414",
"https://nvd.nist.gov/vuln/detail/CVE-2026-14427",
"https://nvd.nist.gov/vuln/detail/CVE-2026-15766",
"https://nvd.nist.gov/vuln/detail/CVE-2026-16417",
"https://nvd.nist.gov/vuln/detail/CVE-2026-17702",
"https://nvd.nist.gov/vuln/detail/CVE-2026-17745",
"https://nvd.nist.gov/vuln/detail/CVE-2026-17757",
"https://nvd.nist.gov/vuln/detail/CVE-2026-17914",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19160",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19161",
"https://nvd.nist.gov/vuln/detail/CVE-2026-19176",
"https://nvd.nist.gov/vuln/detail/CVE-2026-3538",
"https://nvd.nist.gov/vuln/detail/CVE-2026-3909",
"https://nvd.nist.gov/vuln/detail/CVE-2026-43804",
"https://nvd.nist.gov/vuln/detail/CVE-2026-4460",
"https://nvd.nist.gov/vuln/detail/CVE-2026-6298",
"https://nvd.nist.gov/vuln/detail/CVE-2026-6364",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64713",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64728",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64730",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64753",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64757",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64778",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64779",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64782",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64783",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64784",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65332",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65336",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65337",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65341",
"https://nvd.nist.gov/vuln/detail/CVE-2026-65351",
"https://nvd.nist.gov/vuln/detail/CVE-2026-7353",
"https://nvd.nist.gov/vuln/detail/CVE-2026-76041",
"https://nvd.nist.gov/vuln/detail/CVE-2026-78376",
"https://nvd.nist.gov/vuln/detail/CVE-2026-78914",
"https://nvd.nist.gov/vuln/detail/CVE-2026-79020",
"https://nvd.nist.gov/vuln/detail/CVE-2026-79112",
"https://nvd.nist.gov/vuln/detail/CVE-2026-79144",
"https://nvd.nist.gov/vuln/detail/CVE-2026-79147",
"https://nvd.nist.gov/vuln/detail/CVE-2026-7949",
"https://nvd.nist.gov/vuln/detail/CVE-2026-83596",
"https://nvd.nist.gov/vuln/detail/CVE-2026-84359",
"https://nvd.nist.gov/vuln/detail/CVE-2026-84635",
"https://nvd.nist.gov/vuln/detail/CVE-2026-85049",
"https://nvd.nist.gov/vuln/detail/CVE-2026-8510",
"https://nvd.nist.gov/vuln/detail/CVE-2026-8579",
"https://nvd.nist.gov/vuln/detail/CVE-2026-9983",
"https://nvd.nist.gov/vuln/detail/CVE-2026-9998"
]
},
"related_cves": [
{
"value": "CVE-2026-10009",
"evidence": "/upstream"
},
{
"value": "CVE-2026-10011",
"evidence": "/upstream"
},
{
"value": "CVE-2026-10977",
"evidence": "/upstream"
},
{
"value": "CVE-2026-10985",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11024",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11039",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11057",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11099",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11121",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11124",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11159",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11663",
"evidence": "/upstream"
},
{
"value": "CVE-2026-11675",
"evidence": "/upstream"
},
{
"value": "CVE-2026-13971",
"evidence": "/upstream"
},
{
"value": "CVE-2026-14389",
"evidence": "/upstream"
},
{
"value": "CVE-2026-14414",
"evidence": "/upstream"
},
{
"value": "CVE-2026-14427",
"evidence": "/upstream"
},
{
"value": "CVE-2026-15766",
"evidence": "/upstream"
},
{
"value": "CVE-2026-16417",
"evidence": "/upstream"
},
{
"value": "CVE-2026-17702",
"evidence": "/upstream"
},
{
"value": "CVE-2026-17745",
"evidence": "/upstream"
},
{
"value": "CVE-2026-17757",
"evidence": "/upstream"
},
{
"value": "CVE-2026-17914",
"evidence": "/upstream"
},
{
"value": "CVE-2026-19160",
"evidence": "/upstream"
},
{
"value": "CVE-2026-19161",
"evidence": "/upstream"
},
{
"value": "CVE-2026-19176",
"evidence": "/upstream"
},
{
"value": "CVE-2026-3538",
"evidence": "/upstream"
},
{
"value": "CVE-2026-3909",
"evidence": "/upstream"
},
{
"value": "CVE-2026-43804",
"evidence": "/upstream"
},
{
"value": "CVE-2026-4460",
"evidence": "/upstream"
},
{
"value": "CVE-2026-5870",
"evidence": "/upstream"
},
{
"value": "CVE-2026-6298",
"evidence": "/upstream"
},
{
"value": "CVE-2026-6364",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64713",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64728",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64730",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64753",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64757",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64778",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64779",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64782",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64783",
"evidence": "/upstream"
},
{
"value": "CVE-2026-64784",
"evidence": "/upstream"
},
{
"value": "CVE-2026-65332",
"evidence": "/upstream"
},
{
"value": "CVE-2026-65336",
"evidence": "/upstream"
},
{
"value": "CVE-2026-65337",
"evidence": "/upstream"
},
{
"value": "CVE-2026-65341",
"evidence": "/upstream"
},
{
"value": "CVE-2026-65351",
"evidence": "/upstream"
},
{
"value": "CVE-2026-7353",
"evidence": "/upstream"
},
{
"value": "CVE-2026-76041",
"evidence": "/upstream"
},
{
"value": "CVE-2026-78376",
"evidence": "/upstream"
},
{
"value": "CVE-2026-78914",
"evidence": "/upstream"
},
{
"value": "CVE-2026-79020",
"evidence": "/upstream"
},
{
"value": "CVE-2026-79112",
"evidence": "/upstream"
},
{
"value": "CVE-2026-79144",
"evidence": "/upstream"
},
{
"value": "CVE-2026-79147",
"evidence": "/upstream"
},
{
"value": "CVE-2026-7920",
"evidence": "/upstream"
},
{
"value": "CVE-2026-7923",
"evidence": "/upstream"
},
{
"value": "CVE-2026-7949",
"evidence": "/upstream"
},
{
"value": "CVE-2026-83596",
"evidence": "/upstream"
},
{
"value": "CVE-2026-84359",
"evidence": "/upstream"
},
{
"value": "CVE-2026-84635",
"evidence": "/upstream"
},
{
"value": "CVE-2026-85049",
"evidence": "/upstream"
},
{
"value": "CVE-2026-8510",
"evidence": "/upstream"
},
{
"value": "CVE-2026-8579",
"evidence": "/upstream"
},
{
"value": "CVE-2026-9983",
"evidence": "/upstream"
},
{
"value": "CVE-2026-9998",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 450228,
"published_at": "2026-10-14T10:28:22+00:00"
}