Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

367 results · Clear filters · Feed

Medium max 10.0

ELSA-2026-96235 4 CVEs 1 exploited

Moderate: ruby security, bug fix, and enhancement update (Oracle Linux 10)

[3.3.13-16] - Rebase to Ruby 3.3.13. Resolves: RHEL-300972 - Fix: integer overflow issue in regular expression compiler (CVE-2026-110264) Resolves: RHEL-292066 - Fix: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) Resolves: RHEL-…

Nov 9, 2026
Medium max 10.0

ELSA-2026-96233 3 CVEs 1 exploited

Moderate: ruby4.0 security, bug fix, and enhancement update (Oracle Linux 10)

[4.0.9-38] - Upgrade to ruby 4.0.9. Resolves: RHEL-300942 - Fix: integer overflow issue in regular expression compiler (CVE-2026-110264) Resolves: RHEL-292062 - Fix: integer overflow issue in CI/CD regular expression compiler (CVE-2026-97229) Resolves: RHEL-2…

Nov 9, 2026
High max 9.2

ELSA-2026-90495 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 9)

[1.0.9-10.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

Nov 2, 2026
High max 9.2

ELSA-2026-92420 2 CVEs 1 exploited

Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

[8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: -RHEL-291714

Oct 30, 2026
High max 9.2

ELSA-2026-92376 13 CVEs 1 exploited

Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 30, 2026
High max 9.2

ELSA-2026-92378 13 CVEs 1 exploited

Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 9)

nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 30, 2026
High max 9.2

ELSA-2026-92492 2 CVEs 1 exploited

Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

[8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291717

Oct 30, 2026
High max 9.2

ELSA-2026-92428 2 CVEs 1 exploited

Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

[8.0.133-1.0.1] - Add support for Oracle Linux [8.0.133-1] - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291718

Oct 30, 2026
High max 9.2

ELSA-2026-88693 1 CVE 1 exploited

Important: php security update (Oracle Linux 7)

[5.4.16-48.0.1] - Backport fix for CVE-2026-109619 [Orabug: 40200805]

Oct 29, 2026
High max 9.2

ELSA-2026-90501 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 8)

[1.0.6-5] - Resolves: RHEL-290271 - CVE-2026-111497 brotli: Out-of-Bounds Write in Google Brotli Decoder

Oct 27, 2026
High max 9.2

ELSA-2026-90449 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 10)

[1.1.0-8.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

Oct 27, 2026
High max 9.2

ELSA-2026-500512 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 8)

[1.0.6-4.0.1] - Fix CVE-2026-111497: reject invalid Brotli block switches

Oct 26, 2026
High max 9.2

ELSA-2026-500520 1 CVE 1 exploited

Important: nodejs:24 security update (Oracle Linux 8)

nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 26, 2026
High max 9.2

ELSA-2026-500519 1 CVE 1 exploited

Important: nodejs:22 security update (Oracle Linux 8)

nodejs [1:22.23.2-2.0.1] - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder - Expose the block-switch error and add malformed-stream regression coverage - Require the fixed Oracle Linux 8 system Brotli build nodejs-nodemon nodejs-packag…

Oct 26, 2026
High max 9.2

ELSA-2026-500513 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 9)

[1.0.9-10.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

Oct 26, 2026
High max 9.2

ELSA-2026-500517 1 CVE 1 exploited

Important: nodejs:22 security update (Oracle Linux 9)

nodejs [1:22.23.2-2.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 26, 2026
High max 9.2

ELSA-2026-500518 1 CVE 1 exploited

Important: nodejs:24 security update (Oracle Linux 9)

nodejs [1:24.21.0-1.0.1] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging

Oct 26, 2026
High max 9.2

ELSA-2026-500514 1 CVE 1 exploited

Important: brotli security update (Oracle Linux 10)

[1.1.0-8.0.1] - Fix out-of-bounds write in the Brotli decoder [CVE-2026-111497]

Oct 26, 2026
High max 9.2

ELSA-2026-500515 1 CVE 1 exploited

Important: nodejs24 security update (Oracle Linux 10)

[24.21.0-1.0.2] - Fix out-of-bounds write in bundled Brotli decoder [CVE-2026-111497] - Require fixed OL10 system Brotli for builds without bundled Brotli

Oct 26, 2026
High max 9.2

ELSA-2026-500516 1 CVE 1 exploited

Important: nodejs22 security update (Oracle Linux 10)

[1:22.23.2-3.0.2] - Backport upstream fix for CVE-2026-111497 in the bundled Brotli decoder - Expose the block-switch error and add malformed-stream regression coverage - Require the fixed Oracle Linux 10 system Brotli build

Oct 26, 2026
High max 9.2

ELSA-2026-87073 3 CVEs 2 exploited

Important: php:8.2 security update (Oracle Linux 8)

libzip [1.7.3-1] - update to 1.7.3 [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop …

Oct 22, 2026
High max 9.2

ELSA-2026-87079 3 CVEs 2 exploited

Important: php:8.3 security update (Oracle Linux 9)

php [8.3.36-1] - rebase to 8.3.36 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-3] - use valkey for tests [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6…

Oct 22, 2026
High max 9.2

ELSA-2026-87072 3 CVEs 2 exploited

Important: php:8.2 security update (Oracle Linux 9)

php [8.2.35-1] - rebase to 8.2.35 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd [2.0.3-4] - build for PHP 8.1 #2070040 [2.0.3-3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.0.3-2] - Rebuilt for …

Oct 22, 2026
High max 9.2

ELSA-2026-87080 12 CVEs 2 exploited

Important: php:7.4 security update (Oracle Linux 8)

libzip [1.6.1-1] - update to 1.6.1 - enable lzma support [1.5.2-1] - update to 1.5.2 - add all explicit cmake options to ensure openssl is used even in local build with other lilbraries available [1.5.1-1] - update to 1.5.1 - drop dependency on zlib-devel and…

Oct 21, 2026
High max 9.2

ELSA-2026-87151 3 CVEs 2 exploited

Important: php security update (Oracle Linux 9)

[8.0.30-8.1] - Fix FILTER_SANITIZE_ENCODED does not encode 0xFF - Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison CVE-2026-91768 - Fix Various packet overreads in mysqlnd wire protocol CVE-2025-1218 - Fix TLS hostname v…

Oct 21, 2026
High max 9.2

ELSA-2026-87070 3 CVEs 2 exploited

Important: php security update (Oracle Linux 10)

[8.3.36-1] - rebase to 8.3.36 [8.3.35-1] - rebase to 8.3.35

Oct 21, 2026
High max 9.2

ELSA-2026-87071 3 CVEs 2 exploited

Important: php8.4 security update (Oracle Linux 10)

[8.4.27-1] - rebase to 8.4.27

Oct 21, 2026
High max 9.8

ELSA-2026-70498 12 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 5, 2026
High max 9.8

ELSA-2026-70402 20 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.168.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 2, 2026
High max 9.8

ELSA-2026-71233 13 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.60.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 2, 2026
Critical max 9.6

ELSA-2026-74084 322 CVEs 1 exploited

Critical: webkit2gtk3 security update (Oracle Linux 8)

[2.54.0-1] - Update to 2.54.0

Oct 1, 2026
High max 9.8

ELSA-2026-70459 13 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.50.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Sep 24, 2026
High max 10.0

ELSA-2026-500248 1168 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-206.104.3.3] - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39974840] {CVE-2026-80590} [6.12.0-206.104.3.2] - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (Weiming Shi) [Orabug: 39931938…

Sep 4, 2026
High max 9.3

ELSA-2026-34911 7 CVEs 1 exploited

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Aug 10, 2026
High max 9.3

ELSA-2026-500150 21 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-205.92.4.2] - net: tap: set skb->dev before parsing virtio net header in tap_get_user_xdp() (Dongli Zhang) [Orabug: 39844842] - x86/bugs: Make Safe-RET robust against interrupt injection (Borislav Petkov (AMD)) [Orabug: 39844812] {CVE-2026-68480} - KV…

Aug 8, 2026
High max 9.8

ELSA-2026-19569 14 CVEs 1 exploited

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 21, 2026
High max 9.8

ELSA-2026-19131 26 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 10)

[140.12.0-1.0.1] - Add Oracle prefs [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

Jul 20, 2026
High max 7.5

ELSA-2026-36788 2 CVEs 1 exploited

Important: tomcat security, bug fix, and enhancement update (Oracle Linux 10)

[1:10.1.49-3] - Related: RHEL-168577 Remove unnecessary patch [1:10.1.49-2] - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds Resolves: CVE-2026-29146 tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in Encrypt…

Jul 16, 2026
High max 7.5

ELSA-2026-36790 2 CVEs 1 exploited

Important: tomcat9 security, bug fix, and enhancement update (Oracle Linux 10)

[1:9.0.117-2] - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds [1:9.0.117-1] - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) - Resolves: Tomcat: OCSP checks sometimes …

Jul 16, 2026
High max 9.3

ELSA-2026-500004 3 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-204.92.4.3] - xfrm: hold dev ref until after transport_finish NF_HOOK (Qi Tang) [Orabug: 39727259] {CVE-2026-31663} - xfrm: hold device only for the asynchronous decryption (Jianbo Liu) [Orabug: 39727259] - KVM: arm64: vgic-its: Drop the translation c…

Jul 15, 2026