Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

  • High max 9.2
    ELSA-2026-47060 3 CVEs

    Important: nodejs:24 security update (Oracle Linux 8)

    nodejs [1:24.18.0-2] - Backport patches for various CVEs Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-194176 RHEL-194179 RHEL-208658 [1:24.18.0-1] - Update to version 24.18.0 Resolves: RHEL-168744 [1:24.14.1-2] - Update bundled nghttp2 t…

  • High max 7.1
    ELSA-2026-47178 1 CVE

    Important: yelp security update (Oracle Linux 9)

    [2:40.3-3.1] - Fix CVE-2026-13601 (RHEL-190224)

  • High max 7.5
    ELSA-2026-47179 2 CVEs

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 9)

    [1.22.12-7.3] - Fix incorrect bytes-per-pixel handling in rfbsrc plugin (CVE-2026-59691) Resolves: RHEL-193557 [1.22.12-7.2] - Fix buffer overflow in DTLS connection peer certificate subject DN handling (CVE-2026-59692) Resolves: RHEL-193572

  • High max 9.8
    ELSA-2026-45192 5 CVEs

    Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

    [5.14.0-687.30.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • High max 9.8
    ELSA-2026-47104 33 CVEs

    Important: firefox security update (Oracle Linux 9)

    [140.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.13.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis …

  • High max 9.2
    ELSA-2026-47058 3 CVEs

    Important: nodejs:22 security update (Oracle Linux 9)

    nodejs [1:22.23.1-2] - Fix CVE-2026-59873, CVE-2026-59874 (node-tar) by rebasing npm's bundled tar to 7.5.19 - Fix CVE-2026-13149 (brace-expansion) in npm's bundled brace-expansion Fixes: CVE-2026-59873 CVE-2026-59874 CVE-2026-13149 Resolves: RHEL-212550 RHEL…

  • High max 8.1
    ELSA-2026-45114 6 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-211.39.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • Low max 5.6
    ELSA-2026-48170 1 CVE

    Low: php security, bug fix, and enhancement update (Oracle Linux 10)

    [8.3.32-1] - rebase to 8.3.32

  • High max 8.8
    ELSA-2026-23329 7 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 7.7
    ELSA-2026-48032 1 CVE

    Important: nodejs-nodemon security update (Oracle Linux 10)

    [3.1.14-2] - Regenerete sources. [3.1.14-1] - Update to version 3.1.14 [3.0.3-7] - revert of ce0df1a [3.0.3-6] - deps: revert letting nodemon work with any node

  • High max 9.2
    ELSA-2026-48033 3 CVEs

    Important: nodejs22 security update (Oracle Linux 10)

    [1:22.23.1-4] - Fix CVE-2026-13149 (npm/brace-expansion) [1:22.23.1-3] - Fix for CVE-2026-59873 and Fix for CVE-2026-59874 (node-tar) [1:22.23.1-2] - CVE-2026-42338 ip-address HTML escaping fix. [1:22.23.1-1] - Update to version 22.23.1 [1:22.22.2-2] - De-bun…

  • High max 4.3
    ELSA-2026-46532 1 CVE

    Important: dovecot security update (Oracle Linux 8)

    [1:2.3.16-8] - fix CVE-2026-42006: fix IMAP parser list_count_limit to correctly limit open braces instead of close braces (RHEL-188480)

  • High max 8.5
    ELSA-2026-47103 3 CVEs

    Important: libXfont2 security update (Oracle Linux 8)

    [2.0.3-2.1] - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191877 Resolves: https://redhat.atlassian.net/browse/RHEL-191928 Resolves: https://redhat.atlassian.net/browse/RHEL-191948

  • High max 9.8
    ELSA-2026-47105 33 CVEs

    Important: firefox security update (Oracle Linux 8)

    [140.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079789] - diable wasi_sdk to prevent build failure with newer llvm [140.13.0] - Add debranding patches (Mustafa Gezen) - Add OpenELA default preferences (Louis Abel) [140.13.0-1] - …

  • High max 7.1
    ELSA-2026-47177 1 CVE

    Important: yelp security update (Oracle Linux 8)

    [2:3.28.1-3.2] - Fix CVE-2026-13601 (RHEL-190226)

  • High max 7.3
    ELSA-2026-47183 1 CVE

    Important: compat-libtiff3 security update (Oracle Linux 8)

    [3.9.4-16] - fix CVE-2026-12912: heap-buffer-overflow in PixarLog ABGR decoding (RHEL-189375)

  • High max 7.3
    ELSA-2026-47184 1 CVE

    Important: libtiff security update (Oracle Linux 8)

    [4.0.9-38] - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189371)

  • High max 8.8
    ELSA-2026-46990 2 CVEs

    Important: sssd security, bug fix, and enhancement update (Oracle Linux 8)

    [2.9.4-5.0.2.el8_10.5] - Missing ntohs to service port [Orabug: 37389651] - Restore default debug level for sss_cache [Orabug: 32810448] [2.9.4-5.5] - Resolves: RHEL-168415 - [Addition] Crash in 'sss_client/autofs/sss_autofs.c' [rhel-8.10.z] - Resolves: RHEL-…

  • High max 8.5
    ELSA-2026-47084 2 CVEs

    Important: libXfont2 security update (Oracle Linux 9)

    [2.0.3-12.1] - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191886 Resolves: https://redhat.atlassian.net/browse/RHEL-191933 Resolves: https://redhat.atlassian.net/browse/RHEL-191938

  • High max 9.8
    ELSA-2026-21557 18 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • High max 9.1
    ELSA-2026-25237 15 CVEs

    Important: openssl security update (Oracle Linux 10)

    [3.5.5-5.0.1] - Replace upstream references [Orabug: 34340177] - Update FIPS provider name [Orabug: 35824276] [1:3.5.5-5] - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-169991 [1:3.5.5-4] Fix CVE-2026-7383, CVE-2026-9076, CVE-2026-3…

  • High max 8.5
    ELSA-2026-47079 2 CVEs

    Important: libXfont2 security update (Oracle Linux 10)

    [2.0.6-5.1] - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003 Resolves: https://redhat.atlassian.net/browse/RHEL-191882 Resolves: https://redhat.atlassian.net/browse/RHEL-191930 Resolves: https://redhat.atlassian.net/browse/RHEL-191949

  • High max 8.8
    ELSA-2026-47083 1 CVE

    Important: pipewire security update (Oracle Linux 10)

    [1.4.11-1] - Rebase to 1.4.11 - Add fixes for CVE-2026-5674 Resolves: RHEL-164823 [1.4-6-1] - Update version to 1.4.6 Resolves: DESKTOP-1857 [1.2.7-1] - Update version to 1.2.7 - Resolves: RHEL-76017 [1.2.6-3] - Enable libcamera support in RHEL-10 - Resolves:…

  • High max 6.8
    ELSA-2026-47085 1 CVE

    Important: rest security update (Oracle Linux 10)

    [0.9.1-11.1] - Add patch for CVE-2026-16615 (Weak random number generation in PKCE implementation) Resolves: RHEL-213749

  • High max 7.5
    ELSA-2026-47180 2 CVEs

    Important: gstreamer1-plugins-bad-free security update (Oracle Linux 10)

    [1.26.7-2.5] - Fix rfbsrc hextile and color read handling for non-32bpp pixel formats (CVE-2026-59691) Resolves: RHEL-193550

  • High max 9.8
    ELSA-2026-47101 32 CVEs

    Important: firefox security update (Oracle Linux 10)

    [140.13.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.13.0-1] - Update to 140.13.0 ESR

  • High max 7.5
    ELSA-2026-42899 9 CVEs

    Important: java-25-openjdk security update (Oracle Linux 9)

    [25.0.4.0.7-1.1.0.1] - Add Oracle vendor bug URL [Orabug: 34340155] [1:25.0.4.0.7-1.0] - Update to jdk-25.0.4+7 (GA) - Update release notes to 25.0.4+7 - Bump freetype version to 2.14.3 following JDK-8385390 - Bump giflib version to 6.1.3 following JDK-838490…

  • High max 6.5
    ELSA-2026-46391 1 CVE

    Important: grafana security, bug fix, and enhancement update (Oracle Linux 8)

    [9.2.10-32.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-32] - Resolves RHEL-191816: CVE-2026-44740 - Resolves RHEL-188279: Remove Lua ExclusiveArch macro for Konflux build

  • High max 8.1
    ELSA-2026-46396 4 CVEs

    Important: libreswan security update (Oracle Linux 8)

    [4.12-2.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.12-2.6] - Backport fix for CVE-2026-14957 (RHEL-212498) [4.12-2.5] - Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190146, RHEL-190140, RHEL-190132)

  • High max 8.1
    ELSA-2026-46397 4 CVEs

    Important: libreswan security update (Oracle Linux 9)

    [4.15-10.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [4.15-10] - Backport fix for CVE-2026-14957 (RHEL-212107) [4.15-9] - Backport fixes for CVE-2026-12413, CVE-2026-50721 and CVE-2026-50722 (RHEL-190120, RHEL-190125, RHEL-190155)

  • High max 6.5
    ELSA-2026-46394 1 CVE

    Important: go-fdo-client security update (Oracle Linux 10)

    [1.0.0-5] - Rebuild against updated golang

  • High max 9.6
    ELSA-2026-46395 2 CVEs

    Important: go-fdo-server security update (Oracle Linux 10)

    [1.0.1-3] - Rebuild against updated golang

  • High max 8.1
    ELSA-2026-46398 4 CVEs

    Important: libreswan security update (Oracle Linux 10)

    [5.3.2-1.0.1] - Add libreswan-oracle.patch to detect Oracle Linux distro [5.3.2-1] - Update to libreswan-5.3.2 [5.3.1-1] - Update to libreswan-5.3.1

  • Medium max 7.5
    ELSA-2026-42733 3 CVEs

    Moderate: glibc security update (Oracle Linux 8)

    [2.28-251.0.4.40] - Forward port of Oracle patches Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: July-13-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.28-251.0.4.38 - Forward port of Oracle patches Reviewed-by: Jose E. Marchesi…

  • High max 8.1
    ELSA-2026-43218 1 CVE

    Important: pki-deps:10.6 security update (Oracle Linux 8)

    apache-commons-collections [3.2.2-10] - Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild [3.2.2-9] - Remove workaround for symlink->directory rpm bug [3.2.2-8] - Allow testframework to still be built even with tests disabled, which is needed …

  • High max 8.8
    ELSA-2026-44308 1 CVE

    Important: libpq security update (Oracle Linux 9)

    [13.23-3] - Add BuildRequires for perl-File-Compare needed by genbki.pl - Related: RHEL-192239 [13.23-2] - Backport fixes for CVE-2026-6478, CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473 from PostgreSQL 14.23 - Resolves: RHEL-192239

  • High max 8.8
    ELSA-2026-44438 1 CVE

    Important: compat-openssl11 security update (Oracle Linux 9)

    [1:1.1.1k-5.4] - Fixes CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7_verify()

  • High max 8.1
    ELSA-2026-43400 2 CVEs

    Important: dogtag-pki security update (Oracle Linux 10)

    [11.9.0-4.0.1] - Treat Oracle Linux the same as RHEL when selecting the Tomcat app server version. [11.9.0-4] - Update jackson bundled to 2.21.4 - Resolves: RHEL-188290 - Resolves: RHEL-190906

  • High max 8.8
    ELSA-2026-44391 1 CVE

    Important: libpq security update (Oracle Linux 10)

    [16.14-1] - Rebase to upstream release 16.14 - Resolves: RHEL-192240

  • Medium max 7.5
    ELSA-2026-22314 1 CVE

    Moderate: openssl security update (Oracle Linux 10)

    [3.5.5-5.0.1] - Replace upstream references [Orabug: 34340177] - Update FIPS provider name [Orabug: 35824276] [1:3.5.5-5] - Patch asn1_d2i_read_bio to read headers without blocking Resolves: RHEL-169991 [1:3.5.5-4] - Fix CVE-2026-7383, CVE-2026-9076, CVE-2026…