<?xml version="1.0" encoding="UTF-8"?>
<updates>
  <update from="updates@fedoraproject.org" status="testing" type="security" version="2.0">
    <id>FEDORA-EPEL-2026-6a6d19585f</id>
    <title>gum-2.0.0-1.el10_4</title>
    <issued date="2026-08-24 19:18:54"/>
    <updated date="2026-08-24 19:18:54"/>
    <rights>Copyright (C) 2026 Red Hat, Inc. and others.</rights>
    <release>Fedora EPEL 10.4</release>
    <severity>Moderate</severity>
    <summary>gum-2.0.0-1.el10_4 security update</summary>
    <description>Update to version 2.0.0 and override bundled golang.org/x/net to v0.55.0.  The latter fixes CVE-2026-25680, CVE-2026-25681, and CVE-2026-42506.

https://github.com/charmbracelet/gum/releases/tag/v2.0.0</description>
    <references>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2494608" id="2494608" type="bugzilla" title="CVE-2026-42506 gum: golang.org/x/net/html: Cross-Site Scripting (XSS) via arbitrary HTML parsing [epel-all]"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2494898" id="2494898" type="bugzilla" title="CVE-2026-25680 gum: golang.org/x/net/html: Denial of Service due to excessive HTML parsing [epel-all]"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2495243" id="2495243" type="bugzilla" title="CVE-2026-25681 gum: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting [epel-all]"/>
      <reference href="https://bugzilla.redhat.com/show_bug.cgi?id=2520222" id="2520222" type="bugzilla" title="gum-2.0.0 is available"/>
    </references>
    <pkglist>
      <collection short="EPEL-10.4">
        <name>Fedora EPEL 10.4</name>
        <package name="gum" version="2.0.0" release="1.el10_4" epoch="0" arch="src" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/SRPMS/g/gum-2.0.0-1.el10_4.src.rpm">
          <filename>gum-2.0.0-1.el10_4.src.rpm</filename>
        </package>
        <package name="gum-debuginfo" version="2.0.0" release="1.el10_4" epoch="0" arch="x86_64" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/x86_64/g/gum-debuginfo-2.0.0-1.el10_4.x86_64.rpm">
          <filename>gum-debuginfo-2.0.0-1.el10_4.x86_64.rpm</filename>
        </package>
        <package name="gum" version="2.0.0" release="1.el10_4" epoch="0" arch="x86_64" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/x86_64/g/gum-2.0.0-1.el10_4.x86_64.rpm">
          <filename>gum-2.0.0-1.el10_4.x86_64.rpm</filename>
        </package>
        <package name="gum-debugsource" version="2.0.0" release="1.el10_4" epoch="0" arch="x86_64" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/x86_64/g/gum-debugsource-2.0.0-1.el10_4.x86_64.rpm">
          <filename>gum-debugsource-2.0.0-1.el10_4.x86_64.rpm</filename>
        </package>
        <package name="gum-debuginfo" version="2.0.0" release="1.el10_4" epoch="0" arch="aarch64" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/aarch64/g/gum-debuginfo-2.0.0-1.el10_4.aarch64.rpm">
          <filename>gum-debuginfo-2.0.0-1.el10_4.aarch64.rpm</filename>
        </package>
        <package name="gum" version="2.0.0" release="1.el10_4" epoch="0" arch="aarch64" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/aarch64/g/gum-2.0.0-1.el10_4.aarch64.rpm">
          <filename>gum-2.0.0-1.el10_4.aarch64.rpm</filename>
        </package>
        <package name="gum-debugsource" version="2.0.0" release="1.el10_4" epoch="0" arch="aarch64" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/aarch64/g/gum-debugsource-2.0.0-1.el10_4.aarch64.rpm">
          <filename>gum-debugsource-2.0.0-1.el10_4.aarch64.rpm</filename>
        </package>
        <package name="gum-debuginfo" version="2.0.0" release="1.el10_4" epoch="0" arch="ppc64le" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/ppc64le/g/gum-debuginfo-2.0.0-1.el10_4.ppc64le.rpm">
          <filename>gum-debuginfo-2.0.0-1.el10_4.ppc64le.rpm</filename>
        </package>
        <package name="gum" version="2.0.0" release="1.el10_4" epoch="0" arch="ppc64le" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/ppc64le/g/gum-2.0.0-1.el10_4.ppc64le.rpm">
          <filename>gum-2.0.0-1.el10_4.ppc64le.rpm</filename>
        </package>
        <package name="gum-debugsource" version="2.0.0" release="1.el10_4" epoch="0" arch="ppc64le" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/ppc64le/g/gum-debugsource-2.0.0-1.el10_4.ppc64le.rpm">
          <filename>gum-debugsource-2.0.0-1.el10_4.ppc64le.rpm</filename>
        </package>
        <package name="gum-debuginfo" version="2.0.0" release="1.el10_4" epoch="0" arch="s390x" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/s390x/g/gum-debuginfo-2.0.0-1.el10_4.s390x.rpm">
          <filename>gum-debuginfo-2.0.0-1.el10_4.s390x.rpm</filename>
        </package>
        <package name="gum" version="2.0.0" release="1.el10_4" epoch="0" arch="s390x" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/s390x/g/gum-2.0.0-1.el10_4.s390x.rpm">
          <filename>gum-2.0.0-1.el10_4.s390x.rpm</filename>
        </package>
        <package name="gum-debugsource" version="2.0.0" release="1.el10_4" epoch="0" arch="s390x" src="https://download.fedoraproject.org/pub/fedora/linux/updates/10.4/s390x/g/gum-debugsource-2.0.0-1.el10_4.s390x.rpm">
          <filename>gum-debugsource-2.0.0-1.el10_4.s390x.rpm</filename>
        </package>
      </collection>
    </pkglist>
  </update>
</updates>
