Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

High max 6.5

ELSA-2026-46391 1 CVE

Important: grafana security, bug fix, and enhancement update (Oracle Linux 8)

[9.2.10-32.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-32] - Resolves RHEL-191816: CVE-2026-44740 - Resolves RHEL-188279: Remove Lua ExclusiveArch macro for Konflux build

Jul 27, 2026
High max 8.1

ELSA-2026-46396 4 CVEs

Important: libreswan security update (Oracle Linux 8)

[4.12-2.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-2.6] - Backport fix for CVE-2026-14957 (RHEL-212498) [4.12-2.5] - Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190146, RHEL-190140, RHEL-190132)

Jul 27, 2026
High max 8.1

ELSA-2026-46397 4 CVEs

Important: libreswan security update (Oracle Linux 9)

[4.15-10.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.15-10] - Backport fix for CVE-2026-14957 (RHEL-212107) [4.15-9] - Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190120, RHEL-190125, RHEL-190155)

Jul 27, 2026
High max 6.5

ELSA-2026-46394 1 CVE

Important: go-fdo-client security update (Oracle Linux 10)

[1.0.0-5] - Rebuild against updated golang

Jul 27, 2026
High max 9.6

ELSA-2026-46395 2 CVEs

Important: go-fdo-server security update (Oracle Linux 10)

[1.0.1-3] - Rebuild against updated golang

Jul 27, 2026
High max 8.1

ELSA-2026-46398 4 CVEs

Important: libreswan security update (Oracle Linux 10)

[5.3.2-1.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [5.3.2-1] - Update to libreswan-5.3.2 [5.3.1-1] - Update to libreswan-5.3.1

Jul 27, 2026
High max 8.1

ELSA-2026-43218 1 CVE

Important: pki-deps:10.6 security update (Oracle Linux 8)

apache-commons-collections [3.2.2-10] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild [3.2.2-9] - Remove workaround for symlink->directory rpm bug [3.2.2-8] - Allow testframework to still be built even with tests disabled, which is needed …

Jul 23, 2026
High max 8.8

ELSA-2026-44308 1 CVE

Important: libpq security update (Oracle Linux 9)

[13.23-3] - Add BuildRequires for perl-File-Compare needed by genbki.pl - Related: RHEL-192239 [13.23-2] - Backport fixes for CVE-2026-6478, CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473 from PostgreSQL 14.23 - Resolves: RHEL-192239

Jul 23, 2026
High max 8.8

ELSA-2026-44438 1 CVE

Important: compat-openssl11 security update (Oracle Linux 9)

[1:1.1.1k-5.4] - Fixes CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify()

Jul 23, 2026
High max 8.1

ELSA-2026-43400 2 CVEs

Important: dogtag-pki security update (Oracle Linux 10)

[11.9.0-4.0.1] - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. [11.9.0-4] - Update jackson bundled to 2.21.4 - Resolves: RHEL-188290 - Resolves: RHEL-190906

Jul 23, 2026
High max 8.8

ELSA-2026-44391 1 CVE

Important: libpq security update (Oracle Linux 10)

[16.14-1] - Rebase to upstream release 16.14 - Resolves: RHEL-192240

Jul 23, 2026
High max 7.4

ELSA-2026-25341 1 CVE

Important: tomcat9 update (Oracle Linux 10)

[1:9.0.117-2] - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds [1:9.0.117-1] - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) - Resolves: Tomcat: OCSP checks sometimes …

Jul 23, 2026
High max 7.8

ELSA-2026-44270 1 CVE

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.38.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 23, 2026
High max 9.1

ELSA-2026-37072 8 CVEs

Important: podman security, bug fix, and enhancement update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 23, 2026
High max 9.0

ELSA-2026-28132 2 CVEs

Important: samba security update (Oracle Linux 7)

[4.10.16-25.0.11] - Fix CVE-2026-4408 and CVE-2026-4480 [Orabug: 39599120] [4.10.16-25.0.9] - s3:winbindd: avoid using any netlogon call to get a dc name [Orabug: 38560263] - winbindd: use find_domain_from_name_noinit() in find_dns_domain_name() [Orabug: 3856…

Jul 22, 2026
High max 7.8

ELSA-2026-29952 1 CVE

Important: compat-poppler022 security update (Oracle Linux 7)

[0.22.5-4.0.1] - Fix for CVE-2026-10118 [Orabug: 39635559]

Jul 22, 2026
High max 9.8

ELSA-2026-42828 9 CVEs

Important: httpd:2.4 security, bug fix, and enhancement update (Oracle Linux 8)

httpd [2.4.37-65.0.1.8] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.8] - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resol…

Jul 22, 2026
High max 7.1

ELSA-2026-43420 2 CVEs

Important: acl security update (Oracle Linux 8)

[2.4.0-1] - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111) - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Jul 22, 2026
High max 8.8

ELSA-2026-42122 2 CVEs

Important: sssd security update (Oracle Linux 9)

[2.9.8-4.0.1.el9_8.1] - Restore default debug level for sss_cache [Orabug: 32810448] [2.9.8-5] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Reso…

Jul 22, 2026
High max 8.8

ELSA-2026-43307 5 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.29.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jul 22, 2026
High max 7.5

ELSA-2026-19126 2 CVEs

Important: yggdrasil security update (Oracle Linux 10)

[0.4.9.2-1] - Update yggdrasil to 0.4.9.2 [0.4.9.1-1] - Update yggdrasil to 0.4.9.1 [0.4.9-5] - Bump release for rebuild [0.4.9-4] - Bump release for rebuild [0.4.9-3] - Bump release for rebuild

Jul 22, 2026
High max 7.5

ELSA-2026-24386 1 CVE

Important: podman security update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 22, 2026
High max 9.6

ELSA-2026-30855 1 CVE

Important: git-lfs security update (Oracle Linux 10)

[3.7.1-6] - Rebuild with new Golang [3.7.1-5] - Fix CVE-2026-39821 in vendored golang.org/x/net idna package [3.7.1-4] - Rebuild with new Golang

Jul 22, 2026
High max 7.5

ELSA-2026-24470 3 CVEs

Important: podman security update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 22, 2026
High max 8.8

ELSA-2026-42919 11 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.37.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 22, 2026
High max 8.1

ELSA-2026-29874 1 CVE

Important: nginx security update (Oracle Linux 10)

[1.26.3-6.0.1.el10_2.5] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6.5] - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution …

Jul 22, 2026
High max 6.9

ELSA-2026-43505 1 CVE

Important: mariadb-connector-c security update (Oracle Linux 10)

[3.4.4-2] - CVE-2026-44172 fix

Jul 22, 2026
High max 9.1

ELSA-2026-36199 4 CVEs

Important: buildah security update (Oracle Linux 10)

[1.43.1-4.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-4] - rebuild for CVE-2026-39822 - Resolves: RHEL-193643 [2:1.43.1-3] - bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830 - Resolves: RHEL-186266 …

Jul 22, 2026
High max 7.8

ELSA-2026-30044 1 CVE

Important: poppler security update (Oracle Linux 7)

[0.26.5-43.0.1.el7.1] - Fix for CVE-2026-10118 [Orabug: 39637155] [0.26.5-43.el7_9.1] - Handle bytestring representation of named dests - Resolves: #1857678

Jul 21, 2026
High max 7.3

ELSA-2026-30843 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 7)

[2.061-2.0.1] - Fix for CVE-2026-48962 [Orabug: 39658885]

Jul 21, 2026
High max 7.0

ELSA-2026-35838 1 CVE

Important: python3 security update (Oracle Linux 7)

[3.6.8-21.0.13] - Security update CVE-2026-4786 [Orabug: 39695277] [3.6.8-21.0.11] - Security update CVE-2026-4519 [Orabug: 39246828] [3.6.8-21.0.9] - Security update CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 [Orabug: 39159999] [3.6.8-21.0.7] - Security u…

Jul 21, 2026
High max 8.8

ELSA-2026-41900 17 CVEs

Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

[10.0.110-1.0.1] - Add support for Oracle Linux [10.0.110-1] - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192459

Jul 21, 2026
High max 8.8

ELSA-2026-41901 17 CVEs

Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

[8.0.129-1.0.1] - Add support for Oracle Linux [8.0.129-1] - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192464

Jul 21, 2026
High max 8.8

ELSA-2026-42552 2 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.146.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jul 21, 2026
High max 7.7

ELSA-2026-41947 13 CVEs

Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:22.23.1-1] - Update to version 22.23.1 Resolves: RHEL-176170 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 C…

Jul 21, 2026
High max 8.6

ELSA-2026-39323 1 CVE

Important: pacemaker security update (Oracle Linux 9)

[2.1.10-3.0.1] - Replace bug url [Orabug: 34202300] - Upstream reference in pacemaker crm_report binary [Orabug: 32825154] [2.1.10-3] - Fix integer overflows in remote message decompression code (CVE-2026-10649) - Resolves: RHEL-181150

Jul 21, 2026
High max 7.3

ELSA-2026-42668 1 CVE

Important: libtiff security update (Oracle Linux 9)

[4.4.0-18.1] - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189387)

Jul 21, 2026
High max 7.1

ELSA-2026-42736 2 CVEs

Important: acl security update (Oracle Linux 9)

[2.4.0-1] - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111) - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Jul 21, 2026
High max 8.7

ELSA-2026-41949 1 CVE

Important: python3.14 security update (Oracle Linux 9)

[3.14.5-1.1] - Security fix for CVE-2026-15308 Resolves: RHEL-193779

Jul 21, 2026
High max 9.6

ELSA-2026-18536 3 CVEs

Important: tomcat9 security update (Oracle Linux 10)

[1:9.0.117-2] - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds [1:9.0.117-1] - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) - Resolves: Tomcat: OCSP checks sometimes …

Jul 21, 2026