The compressed .tgz patch that was added in 9.26-r1 was never applied.
The issue was fixed in 9.26-r2.

ref #11914

fixes commit d674ed89 ({main,community}/*: remove duplicate CVEs)