chore(deps): refresh rpm lockfiles [SECURITY]

[red-hat-konflux]

This PR contains the following updates:

File rpms.in.yaml:

Package	Change
kernel-headers	5.14.0-611.24.1.el9_7 -> 5.14.0-611.26.1.el9_7
curl	7.76.1-34.el9 -> 7.76.1-35.el9_7.3
libcurl	7.76.1-34.el9 -> 7.76.1-35.el9_7.3

---

curl: libcurl: Curl out of bounds read for cookie path

CVE-2025-9086

More information

Details

1. A cookie is set using the secure keyword for https://target
2. curl is redirected to or otherwise made to speak with http://target (same
   hostname, but using clear text HTTP) using the same cookie set
3. The same cookie name is set - but with just a slash as path (path=\"/\",).
   Since this site is not secure, the cookie should just be ignored.
4. A bug in the path comparison logic makes curl read outside a heap buffer
   boundary

The bug either causes a crash or it potentially makes the comparison come to
the wrong conclusion and lets the clear-text site override the contents of the
secure cookie, contrary to expectations and depending on the memory contents
immediately following the single-byte allocation that holds the path.

The presumed and correct behavior would be to plainly ignore the second set of
the cookie since it was already set as secure on a secure host so overriding
it on an insecure host should not be okay.

Severity

Moderate

References

• https://access.redhat.com/security/cve/CVE-2025-9086
• https://bugzilla.redhat.com/show_bug.cgi?id=2394750
• https://www.cve.org/CVERecord?id=CVE-2025-9086
• https://nvd.nist.gov/vuln/detail/CVE-2025-9086
• https://curl.se/docs/CVE-2025-9086.html
• https://curl.se/docs/CVE-2025-9086.json
• https://github.com/curl/curl/commit/c6ae07c6a541e0e96d0040afb6
• https://hackerone.com/reports/3294999

🔧 This Pull Request updates lock files to use the latest dependency versions.

---

Configuration

📅 Schedule: Branch creation - "" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

---

Documentation

Find out how to configure dependency updates in MintMaker documentation or see all available configuration options in Renovate documentation.