High ELSA-2026-500450 3 CVEs

Important: ca-certificates security update (Oracle Linux 9)

Published Oct 20, 2026 · Updated Oct 20, 2026

Ecosystem: Oracle Linux

Summary

[2025.2.80_v9.0.305-91.0.1]
- eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 9	ca-certificates	0:2025.2.80_v9.0.305-91.0.1.el9

Vulnerabilities 3

Critical 9.1

CVE-2026-114820 Public exploit

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Alpine

Oct 24, 2026
Medium 6.8

CVE-2026-111943 Public exploit

Distrust compromised intermediate certificates in crypto/x509

On most platforms, Go uses the given system root certificates. However, in some narrower cases, the system trust stores may not be updated without further action. To defend against the narrower set of cases that may remain affected, a denylist was added in cr…

Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go crates.io

Oct 21, 2026
Medium 5.4

CVE-2026-113470

Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised c…

Mozilla Firefox Thunderbird thunderbird Browsers Debian Ubuntu

Oct 20, 2026