Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

Medium max 7.5

ELSA-2026-42694 3 CVEs

Moderate: glibc security update (Oracle Linux 10)

[2.39-128.0.1] - Forward port Oracle changes to 2.39-128. - Reviewed-by: Elena Zannoni <elena.zannoni@oracle.com> Oracle history: Jul-15-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed…

Sep 7, 2026
High max 8.6

ELSA-2026-500247 1 CVE

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.359.3.1] - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39974845] {CVE-2026-80590} [5.4.17-2136.359.3] - Partial revert of 'x86/alternatives: Optimize optimize_nops()' (Harshit Mogalapalli) [Orabug: 39866546…

Sep 4, 2026
High max 10.0

ELSA-2026-500249 592 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-324.217.5.2] - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39974835] {CVE-2026-80590} [5.15.0-324.217.5.1] - crypto: qat: restore misc workqueue lifecycle (Manjunath Patil) [Orabug: 39937535] - LTS version: v5.1…

Sep 4, 2026
High max 10.0

ELSA-2026-500248 1168 CVEs 1 exploited

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-206.104.3.3] - inet: frags: strip GSO state from fragments before reassembly (Xinyang Ge) [Orabug: 39974840] {CVE-2026-80590} [6.12.0-206.104.3.2] - KVM: x86: Cancel delayed I/O APIC EOI handling before destroying vCPUs (Weiming Shi) [Orabug: 39931938…

Sep 4, 2026
Critical max 9.8

ELSA-2026-49758 1 CVE

Critical: perl-GD security update (Oracle Linux 7)

[2.49-3.0.1] - Security update for CVE-2026-11526 [Orabug: 39825996]

Sep 3, 2026
High max 9.1

ELSA-2026-23228 8 CVEs

Important: image-builder security update (Oracle Linux 9)

[72.0.0-1.0.1] - Adopt upstream image-builder 72.0.0 tarball and spec file [Orabug: 39666668] - Adopt Oracle Linux Support merged upstream in PR 2404

Sep 3, 2026
High

ELSA-2026-500245 0 CVEs

Important: qemu-kvm security update (Oracle Linux 9)

[7.2.0-43.el9] - dmg: reject inconsistent UDRW chunk sector count and length (CVE-2026-65928) (Stefan Hajnoczi) [Orabug: 39849788] {CVE-2026-65928} - dmg: fix out-of-bounds load in search_chunk() (CVE-2026-65929) (Stefan Hajnoczi) [Orabug: 39849747] {CVE-2026…

Sep 3, 2026
High max 7.5

ELSA-2026-42895 9 CVEs

Important: java-21-openjdk security update (Oracle Linux 8)

[1:21.0.12.1.1-1.2.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:21.0.12.1.1-1.2] - Bump release for PQC build - Related: RHEL-235625 [1:21.0.12.1.1-1.1] - Update to jdk-21.0.12.1+1 (GA) - Update release notes to 21.0.12.1+1 - Sync the copy of the po…

Sep 3, 2026
High max 8.5

ELSA-2026-38487 1 CVE

Important: xorg-x11-server security update (Oracle Linux 8)

[1.20.11-28.3] - CVE fix for CVE-2026-55999 Resolves: https://redhat.atlassian.net/browse/RHEL-191504

Sep 1, 2026
High max 7.8

ELSA-2026-500238 4 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.359.3] - Partial revert of 'x86/alternatives: Optimize optimize_nops()' (Harshit Mogalapalli) [Orabug: 39866546] - Revert 'x86/alternatives: Add alt_instr.flags' (Harshit Mogalapalli) [Orabug: 39866546] - x86/bugs: Make Safe-RET robust against in…

Sep 1, 2026
High max 9.0

ELSA-2026-38490 2 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 9)

[24.1.9-4.3] - CVE fix for: CVE-2026-55999, CVE-2026-56000 Resolves: https://redhat.atlassian.net/browse/RHEL-191532 Resolves: https://redhat.atlassian.net/browse/RHEL-191524

Sep 1, 2026
High max 9.0

ELSA-2026-38489 2 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

[24.1.9-4.3] - CVE fix for: CVE-2026-55999, CVE-2026-56000 Resolves: https://redhat.atlassian.net/browse/RHEL-191518 Resolves: https://redhat.atlassian.net/browse/RHEL-191517

Sep 1, 2026
High max 8.2

ELSA-2026-59490 2 CVEs

Important: nginx:1.24 security update (Oracle Linux 9)

[1.24.0-7.0.1.4] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-7.4] - Resolves: RHEL-219310 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2…

Aug 31, 2026
Medium max 7.5

ELSA-2026-27744 1 CVE

Moderate: openssl-fips-provider security update (Oracle Linux 9)

[3.0.7-11.0.1] - Drop OpenELA branding [Orabug: 37274593] - Add bundle with Oracle Linux 9 OpenSSL FIPS module packages [Orabug: 39910507] - Update extract-src.sh script to support non-hobbled openssl tarball [Orabug: 39910507] [3.0.7.openela.0.1] - Add OpenE…

Aug 28, 2026
High max 8.2

ELSA-2026-59362 2 CVEs

Important: nginx security update (Oracle Linux 9)

[1.20.1-28.0.1.el9_8.5] - Reference oracle-indexhtml within Requires [Orabug: 33802044] - Remove Red Hat references [Orabug: 29498217] - Update upstream references [Orabug: 36579090] [2:1.20.1-28.5] - Resolves: RHEL-219316 - nginx: NGINX: Heap buffer over-rea…

Aug 27, 2026
High max 9.8

ELSA-2026-59821 8 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.158.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Aug 26, 2026
High max 9.8

ELSA-2026-59723 13 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.42.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Aug 26, 2026
High max 7.8

ELSA-2026-59972 1 CVE

Important: gstreamer1-plugins-good security update (Oracle Linux 10)

[1.26.7-2.8] - Fix use-after-free vulnerability in RTP SBC depayloader (CVE-2026-18299) Resolves: RHEL-246613

Aug 26, 2026
Medium max 5.5

ELSA-2026-59997 1 CVE

Moderate: polkit security update (Oracle Linux 10)

[125-4.0.1.el10_2.1] - Increase timeout to avoid defunct processes [Orabug: 26930744] [125-4.1] - NOTICE (jrybar): the record 125-4 below was added in manually after Ymir's initial - commit 125-3.1. For some reason, 125-3.1 for rhel-10.2 was based on contents…

Aug 26, 2026
Medium max 8.2

ELSA-2026-59372 1 CVE

Moderate: assertj-core security update (Oracle Linux 10)

[3.24.2-9.1] - Fix CVE-2026-24400: add XXE protection to XmlStringPrettyFormatter - Resolves: RHEL-183469

Aug 26, 2026
High max 7.5

ELSA-2026-59241 1 CVE

Important: python-pyasn1 security update (Oracle Linux 8)

[0.3.7-6.2] - Fix denial of service in Real type __float__() method (CVE-2026-59886) - Resolves: RHEL-217908

Aug 25, 2026
High max 7.8

ELSA-2026-58938 2 CVEs

Important: sqlite security update (Oracle Linux 8)

[3.26.0-21] - Fixes CVE-2026-11822 and CVE-2026-11824

Aug 25, 2026
High max 8.2

ELSA-2026-59216 2 CVEs

Important: nginx:1.24 security update (Oracle Linux 8)

[1.24.0-3.4.0.1] - Remove Red Hat references [Orabug: 29498217] [1:1.24.0-3.4] - Resolves: RHEL-217957 - nginx:1.24/nginx: NGINX: Memory disclosure and denial of service in ngx_http_slice_module (CVE-2026-60005) - Resolves: RHEL-219309 - nginx:1.24/nginx: NGI…

Aug 25, 2026
High max 7.8

ELSA-2026-59487 1 CVE

Important: gstreamer1-plugins-base security update (Oracle Linux 8)

[1.16.1-6.0.1.el8_10.1] - Update origin URL [Orabug: 36209826] [1.16.1-6.1] - Add patch for CVE-2026-18297 Resolves: RHEL-246576

Aug 25, 2026
High max 7.8

ELSA-2026-54272 4 CVEs

Important: abrt security update (Oracle Linux 8)

[2.10.9-26.0.2] - Remove RHT patches - Drop libreport-rhel and libreport-plugin-rhtsupport requires [2.10.9-26.0.1] - Replaces sosreport to sos report in sosreport-event.conf [Orabug: 38590929] - abrt-dump-oops-Fix-vmcore-call-trace-parsing-arm [Orabug: 34184…

Aug 25, 2026
High max 7.8

ELSA-2026-59009 1 CVE

Important: python3.12 security update (Oracle Linux 9)

[3.12.14-1.0.1] - Remove upstream URL reference [3.12.14-1] - Update to Python 3.12.14 Resolves: RHEL-227215 [3.12.13-3.1] - Security fix for CVE-2026-15308 Resolves: RHEL-193793

Aug 25, 2026
High max 7.5

ELSA-2026-59242 1 CVE

Important: python-pyasn1 security update (Oracle Linux 9)

[0.4.8-7.1] - Fix CVE-2026-59886: prevent overflow in Real type float conversion - Resolves: RHEL-217915

Aug 25, 2026
High max 7.8

ELSA-2026-58901 1 CVE

Important: python3.14 security update (Oracle Linux 9)

[3.14.7-2] - On RHEL 9, also supports reparse deferral in expat Related: RHEL-227218 [3.14.7-1] - Update to Python 3.14.7, security fix for CVE-2026-11940 Resolves: RHEL-227218 [3.14.6-1] - Update to Python 3.14.6 Related: RHEL-227218

Aug 25, 2026
Low max 9.8

ELSA-2026-59347 1 CVE

Low: httpd security update (Oracle Linux 9)

[2.4.62-13.0.1.el9_8.6] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-13.6] - Resolves: RHEL-190807 - httpd: use-after-free in mod_ldap uldap_connection_find via per-directory client cert list (CVE-2026-29167) [2.4.62-13.5] - Resolv…

Aug 25, 2026
Medium max 7.3

ELSA-2026-59387 2 CVEs

Moderate: mod_http2 security, bug fix, and enhancement update (Oracle Linux 9)

[2.0.26-6.2] - Resolves: RHEL-190583 - address CVE-2026-43951 and CVE-2026-48913 in mod_http2

Aug 25, 2026
High max 8.2

ELSA-2026-59496 2 CVEs

Important: nginx:1.26 security update (Oracle Linux 9)

[1.26.3-9.0.1.3] - Require oracle-indexhtml [2:1.26.3-13] - Fixes CVE-2026-56434 and CVE-2026-60005 [2:1.26.3-12] - Resolves: RHEL-191774 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes [2:1.26.3-11] - nginx:1.26/nginx: HTTP/2: Remote Denia…

Aug 25, 2026
High max 8.2

ELSA-2026-59220 2 CVEs

Important: nginx security update (Oracle Linux 10)

[1.26.3-6.0.1.el10_2.6] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6.6] - Resolves: RHEL-219313 - nginx: NGINX: Heap buffer over-read allows memory modification or denial of service (CVE-2026-56434) - Resolves: RHEL-217956 - ngi…

Aug 25, 2026
Medium max 5.9

ELSA-2026-59379 1 CVE

Moderate: pam security update (Oracle Linux 10)

[1.6.1-9.1] - pam_userdb: fix password comparison timing leak. Resolves: CVE-2026-54411 and RHEL-191704

Aug 25, 2026
Medium max 7.1

ELSA-2026-59380 1 CVE

Moderate: attr security update (Oracle Linux 10)

[2.6.0-1] - rebase to 2.6.0 to fix the following CVEs: - CVE-2026-54371 - Symlink Traversal Privilege Escalation via getfattr (RHEL-186128)

Aug 25, 2026
High max 7.7

ELSA-2026-58819 4 CVEs

Important: nodejs24 security update (Oracle Linux 10)

[1:24.18.0-5.0.1] - Add c-ares as dependency [orabug 39781256] - Update upstream references [1:24.18.0-5] - Fix for CVE-2026-69192 & CVE-2026-54272 : ip-address [1:24.18.0-4] - Fix CVE-2026-13149 (brace-expansion)

Aug 25, 2026
High max 8.8

ELSA-2026-36205 2 CVEs

Important: 389-ds-base security update (Oracle Linux 7)

[1.3.11.1-5.0.11] - Security update for CVE-2026-11610 CVE-2026-11774 [Orabug: 39697075] [1.3.11.1-5.0.9] - Security fix for CVE-2026-9064 [Orabug: 39570202] [1.3.11.1-5.0.7] - Security fix for CVE-2025-14905 [Orabug: 39146844] [1.3.11.1-5.0.5] - Allow Unique…

Aug 24, 2026
Medium max 6.7

ELSA-2026-58555 1 CVE

Moderate: NetworkManager security update (Oracle Linux 8)

[1.40.16-21.0.1] - Add support for DAD_CONFLICT to nm-dispatcher - Drop 777 permissions from Networkmanager-dispatcher drop-in directory [Orabug: 37581862] - Add a dropin file to make Networkmanager-dispatcher persistent [Orabug: 36989910] - disable MPTCP han…

Aug 24, 2026
High max 9.8

ELSA-2026-58898 31 CVEs

Important: firefox security update (Oracle Linux 8)

[140.14.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.14.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.14.0-1] - …

Aug 24, 2026
High max 8.1

ELSA-2026-58562 1 CVE

Important: python-urwid security update (Oracle Linux 8)

[1.3.1-5] - Use secure random session identifiers in web display (CVE-2026-9323) - Resolves: RHEL-212562

Aug 24, 2026
High max 7.8

ELSA-2026-58971 1 CVE

Important: python3.12 security update (Oracle Linux 8)

[3.12.14-1] - Update to Python 3.12.14 Resolves: RHEL-227198

Aug 24, 2026