Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
*** Bug 2451608 has been marked as a duplicate of this bug. ***
These CVEs affect libfuse3's io_uring subsystem, which was introduced in fuse3 3.18.0 and fixed in 3.18.2. fuse-sshfs itself is not vulnerable — it merely links against libfuse3 at runtime. fuse3 is not available in EPEL, so there is nothing to fix here. EPEL ships fuse-sshfs linked against the base OS fuse3 package, which is an older version (pre-3.18.0) that does not include the io_uring subsystem and is therefore not affected.