Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

  • High max 7.8
    ELSA-2026-59133 2 CVEs

    Important: gstreamer1-plugins-good security update (Oracle Linux 10)

    [1.26.7-2.7] - Fix CVE-2026-18298 in gdkpixbufdec element Resolves: RHEL-246557 [1.26.7-2.6] - Fix insufficient size validation in MRF file parsing in qtmoovrecover (CVE-2026-18296) Resolves: RHEL-246546

  • High max 7.5
    ELSA-2026-59243 1 CVE

    Important: python-pyasn1 security update (Oracle Linux 10)

    [0.6.2-1.1] - Fix CVE-2026-59886: prevent overflow in Real.__float__() when converting ASN.1 Real values with large exponents Resolves: RHEL-217904

  • High max 8.1
    ELSA-2026-57574 2 CVEs

    Important: php:8.2 security, bug fix, and enhancement update (Oracle Linux 8)

    libzip [1.7.3-1] - update to 1.7.3 php [8.2.33-1] - rebase to 8.2.33 php-pear [1:1.10.14-1] - update PEAR to 1.10.14 for PHP 8.2 RHEL-14705 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14705 php-pecl-rrd [2.0.3-1] - update to 2.0.3 php-pecl-xd…

  • High max 9.8
    ELSA-2026-57253 9 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.157.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 7.5
    ELSA-2026-56970 1 CVE

    Important: perl-Date-Manip security update (Oracle Linux 9)

    [6.85-3.1] - Fix CVE-2026-60075: prevent ReDoS via long whitespace runs in date/time parsing Related: RHEL-239797

  • High max 8.1
    ELSA-2026-57539 2 CVEs

    Important: php:8.3 security, bug fix, and enhancement update (Oracle Linux 9)

    php [8.3.33-1] - rebase to 8.3.33 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 [5.1.21-1] - update to 5.1.21 for PHP 8.1 #2070040 php-pecl-redis6 [6.1.0-3] - use valkey for tests [6.1.0-2] - ignore 1 ONLINE test [6.1.0-1] - RHEL build [6…

  • High max 8.4
    ELSA-2026-56936 29 CVEs

    Important: mysql:8.4 security, bug fix, and enhancement update (Oracle Linux 8)

    mecab [0.996-2.12] - Bump version for 'mysql' module rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'AppStream' repo - Resolves: #2180411 [0.996-2] - Rebuild to fix the issue described in #2000986 - Resolves: #2000986 [0.996-1.9]…

  • High max 7.5
    ELSA-2026-57562 1 CVE

    Important: perl-Date-Manip security update (Oracle Linux 8)

    [6.60-3.1] - Fix CVE-2026-60075: prevent ReDoS via crafted strings with long interior whitespace runs in date/time parsing - Resolves: RHEL-239807

  • High max 8.8
    ELSA-2026-55764 10 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

    [4.18.0-553.155.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 8.1
    ELSA-2026-57462 1 CVE

    Important: curl security, bug fix, and enhancement update (Oracle Linux 8)

    [7.61.1-34.el8_10.13] - fix TLS/STARTTLS connection reuse vulnerability (CVE-2026-8286) [7.61.1-34.el8_10.12] - NTLM: use HTTP/1.0 instead of HTTP/1.1 for compatibility (RHEL-171912)

  • High max 8.4
    ELSA-2026-56973 29 CVEs

    Important: mysql:8.4 security, bug fix, and enhancement update (Oracle Linux 9)

    mecab [0.996-3.4] - Bump version for package rebuild We are moving the 'mecab-devel' RPM from the 'buildroot' repo to the 'CRB' repo - Resolves: #2182069 [0.996-3.3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [0.996-3.2] - Rebuilt…

  • High max 9.8
    ELSA-2026-57252 26 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.41.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 7.1
    ELSA-2026-57600 1 CVE

    Important: mrtg security update (Oracle Linux 9)

    [2.17.7-12.0.1.el9_8.1] - Create mrtg lock file before running restorecon on it [Orabug: 39096845] [2.17.7-12.1] - Fix CVE-2026-72694: symlink-following chown of pid file in daemon mode Resolves: RHEL-236047

  • High max 7.8
    ELSA-2026-57148 1 CVE

    Important: ansible-core security update (Oracle Linux 10)

    [2.16.16-2.0.1.el10_2.1] - exclude telemetry from Oracle Linux [1:2.16.16-2.1] - Fix CVE-2026-11332 (ansible-galaxy role installs could allow arbitrary git configuration injection via malformed role requirements) (RHEL-194128)

  • High max 9.8
    ELSA-2026-57251 24 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.49.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.1
    ELSA-2026-57596 1 CVE

    Important: mrtg security update (Oracle Linux 10)

    [2.17.10-12.1] - Fix symlink-following chown of pid file in daemon mode (CVE-2026-72694) Resolves: RHEL-236045

  • High max 7.6
    ELSA-2026-56521 1 CVE

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 8)

    [1.16.1-9.0.1.el8_10.2] - Update origin URL [Orabug: 36209826] [1.16.1-9.2] - Fix IMA ADPCM input size check in adpcmdec (CVE-2026-19387) Resolves: RHEL-235503 [1.16.1-9.1] - Fix buffer overflow in DTLS certificate subject DN handling (CVE-2026-59692) Resolve…

  • High max 8.8
    ELSA-2026-55740 4 CVEs

    Important: pcp security update (Oracle Linux 9)

    [6.3.7-8.0.1.el9_8.4] - Adds interval option support in PCP nfsiostat tool [Orabug: 39068870] - Introduces proc.numa_maps metrics in linux_proc PMDA [Orabug: 39096683] - adds numastat process option in the tool - Added support for size based cleanup for pcp a…

  • High max 7.8
    ELSA-2026-57149 1 CVE

    Important: ansible-core security update (Oracle Linux 9)

    [1:2.14.18-3.1] - Fix CVE-2026-11332 (prevent arbitrary git configuration via role requirements) (RHEL-194134)

  • High max 8.1
    ELSA-2026-56969 2 CVEs

    Important: php8.4 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.4.24-2] - rebase to 8.4.24

  • High max 7.5
    ELSA-2026-56971 1 CVE

    Important: perl-Date-Manip security update (Oracle Linux 10)

    [6.94-5.1] - Fix CVE-2026-60075: prevent quadratic-cost regex DoS in date/time parsing by rejecting overly long input strings Resolves: RHEL-239790

  • High max 7.5
    ELSA-2026-57126 1 CVE

    Important: yggdrasil security update (Oracle Linux 10)

    [0.4.9.2-2] - Rebuild yggdrasil against updated golang

  • High max 5.4
    ELSA-2026-46386 2 CVEs

    Important: libreoffice security update (Oracle Linux 7)

    [5.3.6.1-26.0.5] - Backport fix for CVE-2026-4430 [Orabug: 39791243] - Backport fix for CVE-2026-8357 [Orabug: 39791243] [5.3.6.1-26.0.3] - Fix CVE-2025-1080, do not process macros in exotic uri schemes [Orabug: 37770225]

  • High max 8.8
    ELSA-2026-55560 4 CVEs

    Important: pcp security update (Oracle Linux 8)

    [5.3.7-22.0.12.el8_10.5] - Implemented units header in csv output using pmrep[Orabug: 39064482] - Adds interval option support in PCP nfsiostat tool [Orabug: 38902336] - Introduces proc.numa_maps metrics in linux_proc PMDA [Orabug: 38509848] - adds numastat p…

  • High max 7.6
    ELSA-2026-56130 1 CVE

    Important: sg3_utils security, bug fix, and enhancement update (Oracle Linux 8)

    [1.44-6.1] - sg_inq output conformance for SCSI name string and ATA fields (RHEL-188162)

  • High max 7.8
    ELSA-2026-56219 1 CVE

    Important: python3 security update (Oracle Linux 8)

    [3.6.8-78.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-78] - Security fix for CVE-2026-11940 Resolves: RHEL-227194

  • High max 7.8
    ELSA-2026-55601 5 CVEs

    Important: nodejs:22 security update (Oracle Linux 9)

    nodejs [1:22.23.1-3] - deps: update npm/ip-address to 10.4.0 - deps: update npm/brace-expansion to 2.1.4 Fix: CVE-2026-69192 & CVE-2026-54272 CVE-2026-69152 Resolves: RHEL-223914 RHEL-223798 [1:22.23.1-3] - deps: update sqlite to 3.53.4 Fix: CVE-2026-11824, C…

  • High max 7.8
    ELSA-2026-55603 6 CVEs

    Important: nodejs:24 security update (Oracle Linux 9)

    nodejs [1:24.18.0-6] - Update brace-expansion from 5.0.6 to 5.0.9 to address CVE-2026-13149 (memory exhaustion via deeply chained brace groups). as well as CVE-2026-14257 (fixed in 5.0.8). [1:24.18.0-5] - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address […

  • High max 7.8
    ELSA-2026-55856 4 CVEs

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [9.0.120-1.0.1] - Add support for Oracle Linux [9.0.120-1] - Update to .NET SDK 9.0.120 and Runtime 9.0.19 - Resolves: RHEL-235476

  • High max 7.8
    ELSA-2026-55857 4 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [10.0.111-1.0.1] - Add support for Oracle Linux [10.0.111-1] - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235481

  • High max 7.8
    ELSA-2026-55858 4 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [10.0.111-1.0.1] - Add support for Oracle Linux [10.0.111-1] - Update to .NET SDK 10.0.111 and Runtime 10.0.11 - Resolves: RHEL-235482

  • High max 8.8
    ELSA-2026-55617 4 CVEs

    Important: pcp security update (Oracle Linux 10)

    [7.0.3-5.0.1] - Fix unterminated backtick in pmlogger_janitor fix not to terminate unauthorized process patch [Orabug: 39270658] - Adds interval option support in PCP nfsiostat tool [Orabug: 39068870] - Introduces proc.numa_maps metrics in linux_proc PMDA [Or…

  • High max 8.4
    ELSA-2026-56007 29 CVEs

    Important: mysql8.4 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.4.11-1] - Rebase to 8.4.11

  • High max 7.5
    ELSA-2026-55530 3 CVEs

    Important: 389-ds:1.4 security update (Oracle Linux 8)

    [1.4.3.39-26] - Bump version to 1.4.3.39-26 - Resolves: RHEL-183073 - EMBARGOED CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-8.10.z] - Resolves: RHEL-190782 - CVE-2026-11788 389-ds-base: 389-ds-base…

  • High max 7.5
    ELSA-2026-55784 1 CVE

    Important: unbound security update (Oracle Linux 8)

    [1.16.2-5.14] - Add unit test for CVE-2026-44690 from upstream. [1.16.2-5.13] - Fix CVE-2026-44690 (RHEL-212801)

  • High max 7.5
    ELSA-2026-55859 1 CVE

    Important: haproxy security update (Oracle Linux 8)

    [1.8.27-5.2] - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204, RHEL-211083)

  • High max 9.0
    ELSA-2026-55446 2 CVEs

    Important: libXfont2 security update (Oracle Linux 8)

    [2.0.3-2.3] - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221956 [2.0.3-2.2] - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222015

  • High max 7.5
    ELSA-2026-55423 3 CVEs

    Important: 389-ds-base security update (Oracle Linux 9)

    [2.8.0-9] - Resolves: RHEL-183082 - CVE-2026-11770 389-ds-base: 389-ds-base: pre-auth LDAP filter injection in CleanAllRUV status check [rhel-9.8.z] - Resolves: RHEL-190775 - CVE-2026-11788 389-ds-base: 389-ds-base: NULL pointer dereference in deref control p…

  • High max 9.0
    ELSA-2026-55447 2 CVEs

    Important: libXfont2 security update (Oracle Linux 9)

    [2.0.3-12.3] - CVE fix for: CVE-2026-59679 Resolves: https://redhat.atlassian.net/browse/RHEL-221957 [2.0.3-12.2] - CVE fix for: CVE-2026-44950 Resolves: https://redhat.atlassian.net/browse/RHEL-222029

  • High max 7.5
    ELSA-2026-55772 2 CVEs

    Important: haproxy security update (Oracle Linux 9)

    [2.8.14-3.2] - Fix NULL pointer dereference in hpack_dht_insert() (CVE-2026-55204) Resolves: RHEL-211082 [2.8.14-3.1] - Fix uint16_t overflow in FCGI demux record length (CVE-2026-55203) Resolves: RHEL-211062