Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

  • High max 7.0
    ELSA-2026-68233 2 CVEs

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [9.0.121-1.0.1] - Add support for Oracle Linux [9.0.121-1] - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252274

  • Medium max 7.5
    ELSA-2026-68266 1 CVE

    Moderate: libsoup security update (Oracle Linux 8)

    [2.62.3-15] - Backport patch for CVE-2026-15711

  • Medium max 6.5
    ELSA-2026-68316 1 CVE

    Moderate: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [8.0.131-1.0.1] - Add support for Oracle Linux [8.0.131-1] - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252244

  • High max 10.0
    ELSA-2026-68549 10 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.15.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.15.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.15.0-1] - …

  • High max 7.0
    ELSA-2026-68676 2 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

    [10.0.112-1.0.1] - Add support for Oracle Linux [10.0.112-1] - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252315

  • High max 7.5
    ELSA-2026-68787 1 CVE

    Important: perl-Net-DNS security update (Oracle Linux 8)

    [1.15-2] - Fix unbounded recursion in TSIG record processing (CVE-2026-81928) - Resolves: RHEL-256266 [1.15] - Resolves rhbz#1544065 Update to 1.15 - Maintenance only [1.14-2] - Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild [1.14-1] - Upda…

  • High max 9.2
    ELSA-2026-67908 6 CVEs

    Important: libevent security update (Oracle Linux 8)

    [2.1.8-11] - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Resolves: RHEL-253566 [2.1.8-10] - Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels - Resolves: RHEL-249889 [2.1.8-9] - Fix CVE-2026-63383: out-of-bounds read…

  • High max 9.8
    ELSA-2026-68677 8 CVEs

    Important: tomcat security update (Oracle Linux 8)

    [1:9.0.120-1] - Resolves: RHEL-192806 HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-219561 Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083) - Resolves: RHEL-219581 Insufficient documentation for E…

  • High max 9.8
    ELSA-2026-500329 6 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-324.217.5.3] - net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40035523] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 40035522] {CVE-2026-80844} - tcp: clear sock_ops cb…

  • Medium max 9.8
    ELSA-2026-68660 8 CVEs

    Moderate: tomcat security, bug fix, and enhancement update (Oracle Linux 9)

    [1:9.0.120-1] - Resolves: RHEL-192825 HTTP/2 request headers not validated (CVE-2026-41293) - Resolves: RHEL-192659 Improper Input Validation vulnerability due to incomplete fix (CVE-2026-32990) - Resolves: RHEL-219565 Security constraint bypass via improper …

  • High max 7.5
    ELSA-2026-68786 1 CVE

    Important: perl-Net-DNS security update (Oracle Linux 9)

    [1.29-6.1] - Fix CVE-2026-81928: Unbounded recursion when re-encoding message with misplaced TSIG - Resolves: RHEL-256275

  • High max 7.6
    ELSA-2026-68235 3 CVEs

    Important: libsoup3 security update (Oracle Linux 10)

    [3.6.5-14] - Fix CVE-2026-85197: http2 crash after connection destroyed [3.6.5-13] - Fix CVE-2026-15711: Reject oversized WebSocket control frames [3.6.5-12] - Fix CVE-2026-15709: bound decompressed WebSocket message size [3.6.5-11] - Add patches for CVE-2026…

  • Medium max 5.7
    ELSA-2026-68291 1 CVE

    Moderate: unbound security update (Oracle Linux 10)

    [1.24.2-20] - Backport additional fix of locks during initialization [1.24.2-19] - Fix CVE-2026-50252: prevent cache poisoning via shared ports [1.24.2-18] - Add unit tests for CVE-2026-{44690,55973} [1.24.2-17] - Fix CVE-2026-55973: dns-error-reporting stack…

  • High max 9.8
    ELSA-2026-500328 6 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-206.104.4.4] - net: tun: bound receive headroom (Asim Viladi Oglu Manizada) [Orabug: 40035126] {CVE-2026-81000} - xfrm: ah6: validate routing header segments_left (Asim Viladi Oglu Manizada) [Orabug: 40035125] {CVE-2026-80844} - RDMA/nldev: Fix lockin…

  • High max 9.8
    ELSA-2026-68507 19 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

    [6.12.0-211.56.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.8
    ELSA-2026-68692 1 CVE

    Important: sudo security, bug fix, and enhancement update (Oracle Linux 10)

    [1.9.17-6] - Fix CVE-2026-82474: execveat(2) intercept/log_subcmds bypass [1.9.17-5.p2] - Resolves: RHEL-212546 - Use canonicalized path if user path contains '..'

  • High max 6.8
    ELSA-2026-67832 1 CVE

    Important: tesseract security update (Oracle Linux 8)

    [4.1.1-3] - Resolves: CVE-2026-73066

  • Low max 7.5
    ELSA-2026-67583 1 CVE

    Low: rsyslog security update (Oracle Linux 9)

    [8.2510.0-2.0.1.el9_8.1] - Fixes rsyslog segfault during shutdown when relp is configured with TLS [Orabug: 37588023] [8.2510.0-2.1] - Backport: imptcp: guard regex-framing match against iCurrLine == 0 Resolves: RHEL-212699

  • Medium max 5.5
    ELSA-2026-67585 1 CVE

    Moderate: firewalld security update (Oracle Linux 9)

    [1.3.4-20.0.1] - Red Hat Satellite and Red Hat high availaibility reference found in cockpit UI [Orabug: 30257573] - discard empty RH-Satellite-6.xml [Orabug: 30328734] - Remove capsule file as well, since it references removed config [Orabug: 33513329] [1.3.…

  • High max 6.8
    ELSA-2026-67831 1 CVE

    Important: tesseract security update (Oracle Linux 9)

    [4.1.1-8] - Resolves: CVE-2026-73066

  • High max 7.0
    ELSA-2026-67613 2 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [10.0.112-1.0.1] - Add support for Oracle Linux [10.0.112-1] - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252319

  • High max 7.0
    ELSA-2026-67614 2 CVEs

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [9.0.121-1.0.1] - Add support for Oracle Linux [9.0.121-1] - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252278

  • High max 8.8
    ELSA-2026-67491 17 CVEs

    Important: postgresql:16 security update (Oracle Linux 9)

    pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pg_repack [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 [1.4.8-1] - Res…

  • High max 8.8
    ELSA-2026-67848 20 CVEs

    Important: postgresql:18 security update (Oracle Linux 9)

    pgaudit [18.0-1] - Update to 18.0 - Initial import for postgresql18 pg_repack [1.5.3-1] - Update to 1.5.3 - Initial import for postgresql18 [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604…

  • Medium max 7.5
    ELSA-2026-68234 2 CVEs

    Moderate: libsoup security update (Oracle Linux 9)

    [2.72.0-16.3] - Fix CVE-2026-15711: Reject oversized WebSocket control frames [2.72.0-16.2] - Backport patch for CVE-2026-15709

  • Medium max 5.7
    ELSA-2026-68292 1 CVE

    Moderate: unbound security update (Oracle Linux 9)

    [1.24.2-3.6] - Backport additional fix from 1.26.0 (CVE-2026-50252) [1.24.2-3.5] - Fix CVE-2026-50252 (RHEL-243479)

  • High max 9.2
    ELSA-2026-67910 8 CVEs

    Important: libevent security update (Oracle Linux 9)

    [2.1.13-1] - Update to 2.1.13. - The following CVEs are fixed: - CVE-2026-63383 - CVE-2026-63384 - CVE-2026-63388 - CVE-2026-63387 - CVE-2026-63379 - CVE-2026-63381 - CVE-2026-63382 - CVE-2026-63385

  • High max 6.8
    ELSA-2026-67830 1 CVE

    Important: tesseract security update (Oracle Linux 10)

    [5.3.4-7] - Resolves: CVE-2026-73066

  • Medium max 4.6
    ELSA-2026-67886 2 CVEs

    Moderate: coreutils security update (Oracle Linux 10)

    [9.5-8.0.1.el10_2.1] - clean up empty file if cp is failed [Orabug 15973168] [9.5-8.1] - uniq: fix CVE-2026-56391 (RHEL-216794) - fix read overrun with -w - unexpand: fix CVE-2026-56392 and related crashes (RHEL-216784) - fix direct.sh and unexpand/mb.sh test…

  • High max 8.5
    ELSA-2026-500239 14 CVEs

    Important: microcode_ctl security update (Oracle Linux 8)

    [4:20260812-1.0.3] - disable late update for 06-ad-01 - add support for UEK7/UEK8 and ueknext kernels - don't bother calling dracut if virtualized [Orabug: 35710077] - ensure UEK also rebuilds initramfs [Orabug: 34280058] - add support for UEK7 kernels - enab…

  • High max 9.2
    ELSA-2026-67909 8 CVEs

    Important: libevent security update (Oracle Linux 10)

    [2.1.13-1] - Update to 2.1.13. - The following CVEs are fixed: - CVE-2026-63383 - CVE-2026-63384 - CVE-2026-63388 - CVE-2026-63387 - CVE-2026-63379 - CVE-2026-63381 - CVE-2026-63382 - CVE-2026-63385

  • Medium max 7.5
    ELSA-2026-27746 1 CVE

    Moderate: openssl-fips-provider security update (Oracle Linux 10)

    [3.0.7-11.0.1] - Add bundle with Oracle Linux 9 OpenSSL FIPS module packages [Orabug: 40015480] - Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 40015480] [3.0.7-11] - Update sources and scripts for new build, to address CVE-2026…

  • Medium max 6.5
    ELSA-2026-67524 1 CVE

    Moderate: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

    [8.0.131-1.0.1] - Add support for Oracle Linux [8.0.131-1] - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252247

  • Medium max 6.5
    ELSA-2026-67525 1 CVE

    Moderate: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [8.0.131-1.0.1] - Add support for Oracle Linux [8.0.131-1] - Update to .NET SDK 8.0.131 and Runtime 8.0.31 - Resolves: RHEL-252248

  • High max 7.0
    ELSA-2026-67528 2 CVEs

    Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [9.0.121-1.0.1] - Add support for Oracle Linux [9.0.121-1] - Update to .NET SDK 9.0.121 and Runtime 9.0.20 - Resolves: RHEL-252279

  • High max 7.0
    ELSA-2026-67530 2 CVEs

    Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

    [10.0.112-1.0.1] - Add support for Oracle Linux [10.0.112-1] - Update to .NET SDK 10.0.112 and Runtime 10.0.12 - Resolves: RHEL-252320

  • Medium max 7.5
    ELSA-2026-67584 1 CVE

    Moderate: rsyslog security update (Oracle Linux 10)

    [8.2510.0-5.1] - Backport: guard regex-framing match against iCurrLine == 0 to fix crash Resolves: RHEL-212700

  • High max 9.1
    ELSA-2026-48790 5 CVEs

    Important: osbuild-composer security update (Oracle Linux 8)

    [101.5-1.0.1] - Bump to 101.5-1.0.1 - CVE-2026-32280 - CVE-2026-32282 - CVE-2026-32283 - CVE-2026-33186 - CVE-2026-34986

  • High max 7.5
    ELSA-2026-54752 2 CVEs

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 7)

    [1.10.4-4.0.5] - Security update for CVE-2026-59691 CVE-2026-59692 [Orabug: 39878399] [1.10.4-4.0.3] - Security update for CVE-2026-52720 CVE-2026-52722 [Orabug: 39799399] [1.10.4-4.0.1] - Security update for CVE-2026-3082 [Orabug: 39199326]

  • High max 8.9
    ELSA-2026-9031 1 CVE

    Important: python-urllib3 security update (Oracle Linux 7)

    [1.10.2-7.0.3] - Backport fix for CVE-2025-66471 [Orabug: 39233228]