Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

2,729 results · Clear filters · Feed

Medium max 6.6

ELSA-2026-55434 2 CVEs

Moderate: gstreamer1-plugins-good security update (Oracle Linux 10)

[1.26.7-2.5] - Fix CVE-2026-73434: out-of-bounds read in AVI demuxer vprp handling Resolves: RHEL-239045 [1.26.7-2.4] - Fix out-of-bounds reads when parsing FUJIFILM strd metadata in AVI files (CVE-2026-73433) Resolves: RHEL-239062

Aug 17, 2026
Medium max 7.8

ELSA-2026-54246 2 CVEs

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.154.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Aug 14, 2026
Medium max 5.4

ELSA-2026-54662 1 CVE

Moderate: nghttp2 security update (Oracle Linux 9)

[1.43.0-6.2] - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

Aug 13, 2026
Medium max 6.9

ELSA-2026-54484 1 CVE

Moderate: python-idna security update (Oracle Linux 9)

[2.10-8] - Security fix for CVE-2026-45409 Resolves: RHEL-215653

Aug 13, 2026
Medium max 6.9

ELSA-2026-54481 1 CVE

Moderate: python-idna security update (Oracle Linux 10)

[3.7-6] - Fix CVE-2026-45409: quadratic time complexity in IDNA validation [3.7-5] - rpminspect: Disable the unicode inspection

Aug 13, 2026
Medium max 7.5

ELSA-2026-54512 1 CVE

Moderate: gnome-remote-desktop security update (Oracle Linux 10)

[49.3-4] - Backport connection throttling

Aug 13, 2026
Medium max 5.4

ELSA-2026-54650 1 CVE

Moderate: nghttp2 security update (Oracle Linux 10)

[1.68.0-3.2] - fix HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests (CVE-2026-58055)

Aug 13, 2026
Medium max 6.5

ELSA-2026-54210 1 CVE

Moderate: dhcpcd security update (Oracle Linux 10)

[10.0.6-11] - Fix CVE-2026-14258

Aug 13, 2026
Medium max 7.5

ELSA-2026-50808 1 CVE

Moderate: libpng security update (Oracle Linux 7)

[2:1.5.13-8.0.5] - Fix CVE-2026-33416 [Orabug: 39836909] [2:1.5.13-8.0.3] - Fix CVE-2026-25646 [Orabug: 39093556] [2:1.5.13-8.0.1] - Fix CVE-2025-64720 [Orabug: 38824465]

Aug 12, 2026
Medium max 7.1

ELSA-2026-52765 1 CVE

Moderate: kernel security update (Oracle Linux 8)

[4.18.0-553.153.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Aug 12, 2026
Medium max 6.9

ELSA-2026-54290 1 CVE

Moderate: python-idna security update (Oracle Linux 8)

[2.5-8] - Security fix for CVE-2026-45409 Resolves: RHEL-215650

Aug 12, 2026
Medium max 7.5

ELSA-2026-54178 4 CVEs

Moderate: grafana security, bug fix, and enhancement update (Oracle Linux 10)

[10.2.6-28.4] - Resolves RHEL-211020: CVE-2026-33377 [10.2.6-28.3] - Resolves RHEL-211376: CVE-2026-8609 [10.2.6-28.2] - Resolves RHEL-210981: CVE-2026-33376 [10.2.6-28.1] - Resolves RHEL-211389: CVE-2026-33382 [10.2.6-28] - Resolves RHEL-188282: Remove Lua E…

Aug 12, 2026
Medium max 8.2

ELSA-2026-43575 6 CVEs

Moderate: gnutls security update (Oracle Linux 7)

[3.3.29-9.0.3] - Backport fixes for CVE-2026-3833 CVE-2026-42012 CVE-2026-42013 CVE-2026-42014 CVE-2026-42015 [Orabug: 39770407] - CVE-2026-42011 is not applicable to this baseline. [3.3.29-9.0.1] - Regenerate PKCS#11 test certificates [Orabug: 39674042] - Fi…

Aug 11, 2026
Medium max 7.5

ELSA-2026-53452 1 CVE

Moderate: gstreamer1-plugins-good security update (Oracle Linux 9)

[1.22.12-7.2] - Fix CVE-2026-18649: limit fragmentation unit size in RTP H.264/H.265 depayloaders to prevent excessive memory usage Resolves: RHEL-224162

Aug 11, 2026
Medium max 7.5

ELSA-2026-53451 1 CVE

Moderate: gstreamer1-plugins-good security update (Oracle Linux 10)

[1.26.7-2.3] - Fix excessive memory allocation from malicious RTP fragmentation unit packets in rtph264depay/rtph265depay (CVE-2026-18649) Resolves: RHEL-224158

Aug 11, 2026
Medium max 7.5

ELSA-2026-52674 1 CVE

Moderate: libarchive security update (Oracle Linux 9)

[3.5.3-11] - Related: CVE-2026-14164 [3.5.3-10] - Resolves: CVE-2026-14164

Aug 10, 2026
Medium max 7.5

ELSA-2026-52675 1 CVE

Moderate: libarchive security update (Oracle Linux 10)

[3.7.7-10] - Related: CVE-2026-14164 [3.7.7-9] - Resolves: CVE-2026-14164

Aug 10, 2026
Medium max 7.5

ELSA-2026-43702 1 CVE

Moderate: libpng12 security update (Oracle Linux 7)

[1.2.50-10.0.3] - Fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE [Orabug: 39771480] [1.2.50-10.0.1] - Fix CVE-2026-25646: heap buffer overflow in png_set_quantize [Orabug: 39183864]

Aug 8, 2026
Medium max 6.7

ELSA-2026-500145 1 CVE

Moderate: libgcrypt security update (Oracle Linux 9)

[1.10.0-13_fips] - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35961378] - Update FIPS module name for Oracle Linux [Orabug: 35961378] [1.10.0-13] - Bump version to fix wrong build target. [1.10.0.12] - Fix CVE-2026-41989:…

Aug 7, 2026
Medium max 9.8

ELSA-2026-51295 1 CVE

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.44.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Aug 7, 2026
Medium max 6.7

ELSA-2026-500138 1 CVE

Moderate: libgcrypt security update (Oracle Linux 8)

[ 1.8.5-8_fips] - Add API to provide hash calculation in RSA/DSA/ECDSA signature operations [Orabug: 33081130] - Change Epoch from 1 to 10 [1.8.5-8] - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext

Aug 6, 2026
Medium max 7.8

ELSA-2026-51035 2 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.36.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Aug 6, 2026
Medium

ELSA-2026-49871 2 CVEs

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.43.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Aug 6, 2026
Medium max 8.2

ELSA-2026-47126 1 CVE

Moderate: resource-agents security update (Oracle Linux 8)

[4.9.0-54.36] - bundled urllib3: fix CVE-2026-44431 Resolves: RHEL-178598

Aug 5, 2026
Medium max 7.8

ELSA-2026-49857 1 CVE

Moderate: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.151.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Aug 5, 2026
Medium max 8.2

ELSA-2026-49927 1 CVE

Moderate: fence-agents security update (Oracle Linux 8)

[4.2.1-129.28] - bundled urllib3: fix CVE-2026-44431 Resolves: RHEL-178594

Aug 4, 2026
Medium max 6.2

ELSA-2026-49667 1 CVE

Moderate: p11-kit security update (Oracle Linux 9)

[0.26.2-1] - Rebase to 0.26.2 Resolves: RHEL-147825 [0.26.1-1] - Rebase to 0.26.1 Resolves: RHEL-139075, RHEL-118361, RHEL-126132 [0.25.10-1] - Update to new upstream release 0.25.10 Resolves: RHEL-115453 [0.25.3-3] - Fix regression in trust where file creati…

Aug 4, 2026
Medium max 6.2

ELSA-2026-49668 1 CVE

Moderate: p11-kit security update (Oracle Linux 10)

[0.26.4-1] - Rebase to 0.26.4

Aug 3, 2026
Medium max 5.0

ELSA-2026-47755 2 CVEs

Moderate: openssh security update (Oracle Linux 8)

[8.0p1-30.0.1] - Update upstream references [Orabug: 36587718] [8.0p1-30] - CVE-2026-55653: Fix double free in openssh DH-GEX client path during FIPS known-group validation that leads to client-side denial of service Resolves: RHEL-185775 - CVE-2026-55655: Fi…

Jul 31, 2026
Medium max 8.7

ELSA-2026-24342 2 CVEs

Moderate: python-tornado security update (Oracle Linux 7)

[4.2.1-5.0.3] - Backport fix for CVE-2026-31958 [Orabug: 39521310] - Backport fix for CVE-2026-35536 [Orabug: 39521310]

Jul 30, 2026
Medium max 6.7

ELSA-2026-47117 1 CVE

Moderate: libgcrypt security update (Oracle Linux 8)

[1.8.5-8] - Fix CVE-2026-41989: Denial of Service and buffer overflow via crafted ECDH ciphertext

Jul 29, 2026
Medium max 7.5

ELSA-2026-42733 3 CVEs

Moderate: glibc security update (Oracle Linux 8)

[2.28-251.0.4.40] - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: July-13-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.38 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi…

Jul 23, 2026
Medium max 7.5

ELSA-2026-22314 1 CVE

Moderate: openssl security update (Oracle Linux 10)

[3.5.5-5.0.1] - Replace upstream references [Orabug: 34340177] - Update FIPS provider name [Orabug: 35824276] [1:3.5.5-5] - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-169991 [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026…

Jul 23, 2026
Medium max 7.5

ELSA-2026-42952 3 CVEs

Moderate: glibc security update (Oracle Linux 9)

[2.34-274.0.1] - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: June-30-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-272.0.1 - F…

Jul 22, 2026
Medium max 7.1

ELSA-2026-19142 10 CVEs

Moderate: freerdp security update (Oracle Linux 10)

[2:3.10.3-12.6] - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 [2:3.10.3-12.5] - Lock appWindow to fix use-after-free in R…

Jul 22, 2026
Medium max 6.6

ELSA-2026-28210 1 CVE

Moderate: vim security update (Oracle Linux 10)

[9.1.083-9.0.1.el10_2.7] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.7] - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave() - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete [2:9.1.083-9…

Jul 22, 2026
Medium max 5.3

ELSA-2026-29980 1 CVE

Moderate: golang security, bug fix, and enhancement update (Oracle Linux 10)

[1.26.5-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.5-1] - Update to Go 1.26.5 (fips-1) [1.25.7-1] - Update to Go 1.25.7 (fips-1) [1.25.5-1] - Update to Go 1.25.5 (fips-1) [1.25.3-5] - gating.yaml: Add tier1 s390x tests [1.25.3-4] - Cl…

Jul 22, 2026
Medium max 4.1

ELSA-2026-22711 1 CVE

Moderate: vim security update (Oracle Linux 10)

[9.1.083-9.0.1.el10_2.7] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.7] - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave() - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete [2:9.1.083-9…

Jul 21, 2026
Medium max 9.8

ELSA-2026-18320 1 CVE

Moderate: edk2 security update (Oracle Linux 10)

[20251114-5.0.1.el10_2.2] - Replace upstream references [Orabug:36569119] [20251114-5.el10_2.2] - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/…

Jul 21, 2026
Medium max 5.5

ELSA-2026-18326 1 CVE

Moderate: libvirt security update (Oracle Linux 10)

[11.10.0-12.4.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [11.10.0-12.4.el10_2] - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags h…

Jul 21, 2026