Puppet Core 9.1.0

Released September 2026. This release adds Debian 12 ARM V7L support for Puppet agent, includes improvements to help prevent security vulnerabilities, and resolves compatibility issues with hiera-eyaml and JSON dependencies. Puppet also offers extended agent support for Red Hat Enterprise Linux 7 (RHEL 7).

New features and enhancements

Agent platforms added

This release adds support for the Puppet agent on the following operating system platforms:

  • Debian 12 ARM V7L PA-7764

Extended agent support for older operating systems

Puppet now offers extended agent support for selected operating systems that are no longer included in the standard Puppet Core supported operating systems list. Extended agent support is currently available for Red Hat Enterprise Linux 7 (RHEL 7). If you require support for an operating system that is not listed in the Supported agent platforms table, contact Puppet to discuss available support options.

Security updates

Updated OpenSSL

Updated OpenSSL from 3.5.7 to 3.5.8 to address the following CVEs:

  • CVE-2026-18798

  • CVE-2026-63072

  • CVE-2026-63076

  • CVE-2026-14456

  • CVE-2026-14457

  • CVE-2026-54874

  • CVE-2026-63073

  • CVE-2026-63074

  • CVE-2026-63075

  • CVE-2026-75803

PA-9223

Patched resolv gem

Patched the default gem resolv in Ruby to address the following CVEs:

  • CVE-2026-80212

  • CVE-2026-80213

PA-9229

Patched RubyGems

Patched RubyGems to address CVE-2026-82455.

PA-9260

Updated curl

Updated curl from 8.21.0 to 8.22.0 to address the following CVEs:

  • CVE-2026-13608

  • CVE-2026-18924

  • CVE-2026-19931

  • CVE-2026-80229

  • CVE-2026-82208

PA-9266

Updated libxml2

Updated libxml2 from 2.15.3 to 2.15.4 to address the following CVEs:

  • CVE-2026-86138

  • CVE-2026-86139

  • CVE-2026-86140

  • CVE-2026-86142

  • CVE-2026-86143

  • CVE-2026-86144

PA-9272

Resolved issues

Updated hiera-eyaml compatibility

Updated hiera-eyaml from 5.0.0 to 5.0.1 so that encrypted Hiera values can be decrypted when Puppet Server uses Bouncy Castle 1.85 or later.

PA-9262

Updated JSON dependency compatibility

Puppet now constrains its JSON dependency to greater than or equal to 2.0, and less than 4, to avoid JSON compatibility issues. This prevents breakage when newer JSON versions are installed in environments using Bundler or similar dependency tooling.

PA-9273

Deprecations