Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

5,088 results · Clear filters · Feed

High max 8.0

ELSA-2026-21676 1 CVE

Important: cockpit security update (Oracle Linux 10)

[356.2-1.0.1] - Storage: Enable btrfs support [Orabug: 37464632] - Replaced upstream urls in documentation with oracle links [Orabug: 36528753] - Drop subscription-manager-cockpit requirement for ol [Orabug: 34681110] - Remove duplicate reference to server in…

Jul 16, 2026
High max 9.3

ELSA-2026-21757 2 CVEs

Important: flatpak security update (Oracle Linux 10)

[1.16.0-9.1] - Fix arbitrary code execution via crafted symlinks in sandbox-expose options Resolves: RHEL-165630 - Fix arbitrary file deletion on host via improper cache file path validation Resolves: RHEL-170157

Jul 16, 2026
High max 2.9

ELSA-2026-22715 1 CVE

Important: expat security update (Oracle Linux 10)

[2.7.3-57] - expat: backport CVE-2026-45186 fix (attribute collision check DoS) [2.7.3-56] - Rebase to 2.7.3 and add VCS tag * Thu Jun 05 2025 psklenar@redhat.com <psklenar@redhat.com> - https://issues.redhat.com/browse/RHELMISC-13073 * Fri Mar 28 2025 Tomas …

Jul 16, 2026
High max 7.5

ELSA-2026-23102 3 CVEs

Important: delve security update (Oracle Linux 10)

[1.26.1-2.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.26.1-2] - Bump

Jul 16, 2026
High max 7.3

ELSA-2026-23388 5 CVEs

Important: php security update (Oracle Linux 10)

[8.3.31-1] - rebase to 8.3.31 - add tmpfiles.d configuration file for ImageMode

Jul 16, 2026
High max 7.5

ELSA-2026-24338 2 CVEs

Important: bind security update (Oracle Linux 10)

[9.18.33-15.0.1.el10_2.2] - Hard require needed openssl-libs [Orabug: 38742109] - Fix warning when changing device file permissions [Orabug: 36518580] [32:9.18.33-15.2] - Fix GSS-API resource leak (CVE-2026-3039) - Invalid handling of CLASS != IN (CVE-2026-59…

Jul 16, 2026
High max 7.5

ELSA-2026-24347 2 CVEs

Important: frr security update (Oracle Linux 10)

[10.4.4-1] - Resolves: RHEL-166035 - Bump FRR to 10.4.3 to fix EVPN problems

Jul 16, 2026
High max 7.8

ELSA-2026-24985 1 CVE

Important: poppler security update (Oracle Linux 10)

[24.02.0-7.el10_2.2] - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Bump NVR for MR - Resolves: RHEL-180565 [24.02.0-7.el10_2.1] - Fix integer overflow in tilingPatternFill (CVE-2026-10118) - Resolves: RHEL-180565

Jul 16, 2026
High max 7.5

ELSA-2026-25111 2 CVEs

Important: .NET 8.0 security update (Oracle Linux 10)

[8.0.128-1.0.1] - Add support for Oracle Linux [8.0.128-1] - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924

Jul 16, 2026
High max 7.5

ELSA-2026-25112 2 CVEs

Important: .NET 9.0 security update (Oracle Linux 10)

[9.0.118-1.0.1] - Add support for Oracle Linux [9.0.118-1] - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181554 [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919

Jul 16, 2026
High max 7.5

ELSA-2026-25115 2 CVEs

Important: .NET 10.0 security update (Oracle Linux 10)

[10.0.109-1.0.1] - Add support for Oracle Linux [10.0.109-1] - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 [10.0.106-3] - Adjust build limits - Re…

Jul 16, 2026
High max 7.7

ELSA-2026-25216 3 CVEs

Important: valkey security update (Oracle Linux 10)

[8.0.9-1] - Rebase to 8.0.9 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631

Jul 16, 2026
High max 7.4

ELSA-2026-25902 1 CVE

Important: fence-agents security update (Oracle Linux 10)

[4.16.0-21.2] - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 [4.16.0-21.1] - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157187, RHEL-1…

Jul 16, 2026
High max 3.7

ELSA-2026-25930 1 CVE

Important: postfix security update (Oracle Linux 10)

[2:3.8.5-10] - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code. Resolves: RHEL-176554

Jul 16, 2026
High max 8.1

ELSA-2026-26332 2 CVEs

Important: rsync security, bug fix, and enhancement update (Oracle Linux 10)

[3.4.4-1] - Resolves: RHEL-181630 - Rebase rsync to version 3.4.4 - Resolves: RHEL-174929 - TOCTOU symlink race condition (CVE-2026-29518) - Resolves: RHEL-174949 - Memory disclosure via int overflow (CVE-2026-43618) [3.4.1-3] - Resolves: RHEL-118549 - Do not…

Jul 16, 2026
High max 7.8

ELSA-2026-26566 9 CVEs

Important: xorg-x11-server-Xwayland security, bug fix, and enhancement update (Oracle Linux 10)

[24.1.9-4.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184290 [24.1.9-4.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Re…

Jul 16, 2026
High max 8.1

ELSA-2026-27842 1 CVE

Important: memcached security update (Oracle Linux 10)

[0:1.6.23-7.1] - Fix timing side-channel in SASL password database authentication (CVE-2026-47783) - Resolves: RHEL-179083

Jul 16, 2026
High max 8.9

ELSA-2026-27929 2 CVEs

Important: python3.14-urllib3 security update (Oracle Linux 10)

[2.6.3-2] - Security fix for CVE-2026-44431 and CVE-2026-44432 - Resolves: RHEL-184903 - Resolves: RHEL-185128

Jul 16, 2026
High max 8.9

ELSA-2026-28000 2 CVEs

Important: python-urllib3 security update (Oracle Linux 10)

[1.26.19-4] - Security fix for CVE-2026-44431 - Security fix for CVE-2026-44432 Resolves: RHEL-184817, RHEL-185121 [1.26.19-3] - Security fix for CVE-2025-66471 - Security fix for CVE-2025-66418 - Security fix for CVE-2026-21441 Resolves: RHEL-142737, RHEL-13…

Jul 16, 2026
High max 6.7

ELSA-2026-19130 1 CVE

Important: libcap security update (Oracle Linux 10)

[2.69-7.1] - Fix TOCTOU race condition in cap_set_file() (CVE-2026-4878) Resolves: RHEL-169302

Jul 16, 2026
High max 7.5

ELSA-2026-24348 1 CVE

Important: postgresql-jdbc security update (Oracle Linux 10)

[42.7.2-1.2] - Add tests for CVE-2026-42198 [42.7.2-1.1] - Limit SCRAM PBKDF2 iterations to prevent DoS via malicious server - Resolves: RHEL-173479

Jul 16, 2026
High max 7.0

ELSA-2026-28581 2 CVEs

Important: python3.14 security, bug fix, and enhancement update (Oracle Linux 10)

[3.14.5-1] - Update to 3.14.5 Resolves: RHEL-176147 [3.14.5~rc1-1] - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-6019 Resolves: RHEL-176147

Jul 16, 2026
High max 7.5

ELSA-2026-29035 4 CVEs

Important: skopeo security update (Oracle Linux 10)

[2:1.22.2-2] - Rebuild for CVE-2026-25679 - Resolves: RHEL-158499

Jul 16, 2026
High max 8.7

ELSA-2026-40856 1 CVE

Important: python3.14 security update (Oracle Linux 10)

[3.14.5-1.1] - Security fix for CVE-2026-15308 Resolves: RHEL-193775 [3.14.5-1] - Update to 3.14.5 Resolves: RHEL-176147 [3.14.5~rc1-1] - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-60…

Jul 16, 2026
High max 9.6

ELSA-2026-30846 29 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.12.0-1.0.1] - Add Oracle prefs [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

Jul 16, 2026
High max 9.1

ELSA-2026-30857 1 CVE

Important: perl-Archive-Tar security update (Oracle Linux 10)

[3.02-512.1] - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181651

Jul 16, 2026
High max 7.3

ELSA-2026-30860 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 10)

[2.212-512.1] - Fix CVE-2026-48962: remove use of eval in File::GlobMapper - Resolves: RHEL-180415

Jul 16, 2026
High max 7.4

ELSA-2026-20567 1 CVE

Important: qt6-qtdeclarative security update (Oracle Linux 10)

[6.10.1-1.1] - VectorImage: sanitize source string used in output (CVE-2025-14576) Resolves: RHEL-173494

Jul 16, 2026
High max 8.1

ELSA-2026-24331 2 CVEs

Important: cockpit-image-builder security update (Oracle Linux 10)

[94.3-1.0.1] - Switch to old frotend [Orabug: 38011073] [Orabug: 37856296] [Orabug: 37856375] - Replaced additional upstream url [Orabug: 37856187] - Replaced upstream urls in documentation with oracle links [Orabug: 37856187] [94.3-1] - New upstream release …

Jul 16, 2026
High max 7.5

ELSA-2026-24758 1 CVE

Important: libyang security update (Oracle Linux 10)

[2.1.148-4] - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177026 - CVE-2026-44673

Jul 16, 2026
High max 10.0

ELSA-2026-33093 1 CVE

Important: mariadb10.11 security, bug fix, and enhancement update (Oracle Linux 10)

[3:10.11.18-1] - Rebase to 10.11.18 [3:10.11.17-1] - Rebase to 10.11.17 [3:10.11.16-1] - Rebase to 10.11.16

Jul 16, 2026
High max 7.6

ELSA-2026-33540 3 CVEs

Important: ruby4.0 security update (Oracle Linux 10)

[4.0.3-35] - Fix Net::IMAP ResponseReader quadratic complexity vulnerability (CVE-2026-42245) Includes core fix plus additional performance optimizations Resolves: RHEL-181675 - Fix Net::IMAP STARTTLS stripping vulnerability (CVE-2026-42246) Resolves: RHEL-18…

Jul 16, 2026
High max 7.6

ELSA-2026-33565 3 CVEs

Important: ruby security update (Oracle Linux 10)

[3.3.10-13] - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181775 - Fix command injection via Symbol arguments in…

Jul 16, 2026
High max 9.8

ELSA-2026-34109 7 CVEs

Important: httpd security, bug fix, and enhancement update (Oracle Linux 10)

[2.4.63-13.0.1.el10_2.4] - Replace index.html with Oracle's index page oracle_index.html. [2.4.63-13.4] - Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) - Resolves: RHEL-186195 - ht…

Jul 16, 2026
High max 9.6

ELSA-2026-35826 1 CVE

Important: grafana-pcp security update (Oracle Linux 10)

[5.3.0-7] - Resolves RHEL-183688: CVE-2026-39821 [5.3.0-6] - Resolves RHEL-183688: CVE-2026-39821 [5.3.0-5] - Resolves RHEL-166460: CVE-2026-32282 - Resolves RHEL-167495: CVE-2026-32283

Jul 16, 2026
High max 9.6

ELSA-2026-35827 1 CVE

Important: grafana security update (Oracle Linux 10)

[10.2.6-27] - Resolves: RHEL-183694: CVE-2026-39821 [10.2.6-26] - Resolves RHEL-161791: CVE-2026-27877 - Resolves RHEL-166459: CVE-2026-32282 - Resolves RHEL-167494: CVE-2026-32283

Jul 16, 2026
High max 7.5

ELSA-2026-35832 2 CVEs

Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

[0.9.27-7.2] - rebuilt with golang-1.26.4-1.el10_2 to fix CVE-2026-33811, CVE-2026-27145 [0.9.27-7.1] - rebuilt with golang-1.26.3-4.el10_2 to fix CVE-2026-32281 [0.9.27-7] - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810

Jul 16, 2026
High max 8.2

ELSA-2026-33502 1 CVE

Important: giflib security update (Oracle Linux 10)

[5.2.1-25] - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) [5.2.1-24] - rebuild [5.2.1-23] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850)

Jul 16, 2026
High max 4.1

ELSA-2026-36193 1 CVE

Important: python3.14-pip security update (Oracle Linux 10)

[25.2-5] - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pip_install_upgrade to run pip-3.14 - fix bash completion + remove unused metadata file [25.2-4] - Security fix for CVE-2026-8643: path traversal in wheel ent…

Jul 16, 2026
High max 7.5

ELSA-2026-19155 1 CVE

Important: python-markdown security update (Oracle Linux 10)

[3.5.1-6.1] - Fix CVE-2025-69534 (RHEL-153740)

Jul 16, 2026