Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 7.4

ELSA-2026-25341 1 CVE

Important: tomcat9 update (Oracle Linux 10)

[1:9.0.117-2] - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds [1:9.0.117-1] - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) - Resolves: Tomcat: OCSP checks sometimes …

Jul 23, 2026
High max 7.8

ELSA-2026-44270 1 CVE

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.38.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 23, 2026
High max 9.1

ELSA-2026-37072 8 CVEs

Important: podman security, bug fix, and enhancement update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 23, 2026
High max 9.0

ELSA-2026-28132 2 CVEs

Important: samba security update (Oracle Linux 7)

[4.10.16-25.0.11] - Fix CVE-2026-4408 and CVE-2026-4480 [Orabug: 39599120] [4.10.16-25.0.9] - s3:winbindd: avoid using any netlogon call to get a dc name [Orabug: 38560263] - winbindd: use find_domain_from_name_noinit() in find_dns_domain_name() [Orabug: 3856…

Jul 22, 2026
High max 7.8

ELSA-2026-29952 1 CVE

Important: compat-poppler022 security update (Oracle Linux 7)

[0.22.5-4.0.1] - Fix for CVE-2026-10118 [Orabug: 39635559]

Jul 22, 2026
High max 9.8

ELSA-2026-42828 9 CVEs

Important: httpd:2.4 security, bug fix, and enhancement update (Oracle Linux 8)

httpd [2.4.37-65.0.1.8] - Replace index.html with Oracle's index page oracle_index.html [2.4.37-65.8] - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow (CVE-2026-28780) - Resol…

Jul 22, 2026
High max 7.1

ELSA-2026-43420 2 CVEs

Important: acl security update (Oracle Linux 8)

[2.4.0-1] - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111) - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Jul 22, 2026
Medium max 7.5

ELSA-2026-42952 3 CVEs

Moderate: glibc security update (Oracle Linux 9)

[2.34-274.0.1] - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Reviewed-by: David Faust <david.faust@oracle.com> Oracle history: June-30-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.34-272.0.1 - F…

Jul 22, 2026
High max 8.8

ELSA-2026-42122 2 CVEs

Important: sssd security update (Oracle Linux 9)

[2.9.8-4.0.1.el9_8.1] - Restore default debug level for sss_cache [Orabug: 32810448] [2.9.8-5] - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation - Reso…

Jul 22, 2026
High max 8.8

ELSA-2026-43307 5 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.29.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Jul 22, 2026
High max 7.5

ELSA-2026-19126 2 CVEs

Important: yggdrasil security update (Oracle Linux 10)

[0.4.9.2-1] - Update yggdrasil to 0.4.9.2 [0.4.9.1-1] - Update yggdrasil to 0.4.9.1 [0.4.9-5] - Bump release for rebuild [0.4.9-4] - Bump release for rebuild [0.4.9-3] - Bump release for rebuild

Jul 22, 2026
Medium max 7.1

ELSA-2026-19142 10 CVEs

Moderate: freerdp security update (Oracle Linux 10)

[2:3.10.3-12.6] - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 [2:3.10.3-12.5] - Lock appWindow to fix use-after-free in R…

Jul 22, 2026
High max 7.5

ELSA-2026-24386 1 CVE

Important: podman security update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 22, 2026
Medium max 6.6

ELSA-2026-28210 1 CVE

Moderate: vim security update (Oracle Linux 10)

[9.1.083-9.0.1.el10_2.7] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.7] - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave() - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete [2:9.1.083-9…

Jul 22, 2026
Medium max 5.3

ELSA-2026-29980 1 CVE

Moderate: golang security, bug fix, and enhancement update (Oracle Linux 10)

[1.26.5-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.5-1] - Update to Go 1.26.5 (fips-1) [1.25.7-1] - Update to Go 1.25.7 (fips-1) [1.25.5-1] - Update to Go 1.25.5 (fips-1) [1.25.3-5] - gating.yaml: Add tier1 s390x tests [1.25.3-4] - Cl…

Jul 22, 2026
High max 9.6

ELSA-2026-30855 1 CVE

Important: git-lfs security update (Oracle Linux 10)

[3.7.1-6] - Rebuild with new Golang [3.7.1-5] - Fix CVE-2026-39821 in vendored golang.org/x/net idna package [3.7.1-4] - Rebuild with new Golang

Jul 22, 2026
High max 7.5

ELSA-2026-24470 3 CVEs

Important: podman security update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 22, 2026
High max 8.8

ELSA-2026-42919 11 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.37.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 22, 2026
High max 8.1

ELSA-2026-29874 1 CVE

Important: nginx security update (Oracle Linux 10)

[1.26.3-6.0.1.el10_2.5] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6.5] - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution …

Jul 22, 2026
High max 6.9

ELSA-2026-43505 1 CVE

Important: mariadb-connector-c security update (Oracle Linux 10)

[3.4.4-2] - CVE-2026-44172 fix

Jul 22, 2026
High max 9.1

ELSA-2026-36199 4 CVEs

Important: buildah security update (Oracle Linux 10)

[1.43.1-4.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-4] - rebuild for CVE-2026-39822 - Resolves: RHEL-193643 [2:1.43.1-3] - bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830 - Resolves: RHEL-186266 …

Jul 22, 2026
High max 7.8

ELSA-2026-30044 1 CVE

Important: poppler security update (Oracle Linux 7)

[0.26.5-43.0.1.el7.1] - Fix for CVE-2026-10118 [Orabug: 39637155] [0.26.5-43.el7_9.1] - Handle bytestring representation of named dests - Resolves: #1857678

Jul 21, 2026
High max 7.3

ELSA-2026-30843 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 7)

[2.061-2.0.1] - Fix for CVE-2026-48962 [Orabug: 39658885]

Jul 21, 2026
High max 7.0

ELSA-2026-35838 1 CVE

Important: python3 security update (Oracle Linux 7)

[3.6.8-21.0.13] - Security update CVE-2026-4786 [Orabug: 39695277] [3.6.8-21.0.11] - Security update CVE-2026-4519 [Orabug: 39246828] [3.6.8-21.0.9] - Security update CVE-2025-15366, CVE-2025-15367, CVE-2026-1299 [Orabug: 39159999] [3.6.8-21.0.7] - Security u…

Jul 21, 2026
High max 8.8

ELSA-2026-41900 17 CVEs

Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 8)

[10.0.110-1.0.1] - Add support for Oracle Linux [10.0.110-1] - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192459

Jul 21, 2026
High max 8.8

ELSA-2026-41901 17 CVEs

Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 8)

[8.0.129-1.0.1] - Add support for Oracle Linux [8.0.129-1] - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192464

Jul 21, 2026
High max 8.8

ELSA-2026-42552 2 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.146.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Jul 21, 2026
High max 7.7

ELSA-2026-41947 13 CVEs

Important: nodejs:22 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:22.23.1-1] - Update to version 22.23.1 Resolves: RHEL-176170 Fixes: CVE-2026-12151 CVE-2026-48618 CVE-2026-48933 CVE-2026-48937 CVE-2026-48930 CVE-2026-48619 CVE-2026-48615 CVE-2026-48934 CVE-2026-48928 CVE-2026-48617 CVE-2026-48931 CVE-2026-48935 C…

Jul 21, 2026
High max 8.6

ELSA-2026-39323 1 CVE

Important: pacemaker security update (Oracle Linux 9)

[2.1.10-3.0.1] - Replace bug url [Orabug: 34202300] - Upstream reference in pacemaker crm_report binary [Orabug: 32825154] [2.1.10-3] - Fix integer overflows in remote message decompression code (CVE-2026-10649) - Resolves: RHEL-181150

Jul 21, 2026
High max 7.3

ELSA-2026-42668 1 CVE

Important: libtiff security update (Oracle Linux 9)

[4.4.0-18.1] - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189387)

Jul 21, 2026
High max 7.1

ELSA-2026-42736 2 CVEs

Important: acl security update (Oracle Linux 9)

[2.4.0-1] - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186111) - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186216)

Jul 21, 2026
High max 8.7

ELSA-2026-41949 1 CVE

Important: python3.14 security update (Oracle Linux 9)

[3.14.5-1.1] - Security fix for CVE-2026-15308 Resolves: RHEL-193779

Jul 21, 2026
High max 9.6

ELSA-2026-18536 3 CVEs

Important: tomcat9 security update (Oracle Linux 10)

[1:9.0.117-2] - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds [1:9.0.117-1] - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) - Resolves: Tomcat: OCSP checks sometimes …

Jul 21, 2026
High max 7.5

ELSA-2026-19133 4 CVEs

Important: git-lfs security update (Oracle Linux 10)

[3.7.1-6] - Rebuild with new Golang [3.7.1-5] - Fix CVE-2026-39821 in vendored golang.org/x/net idna package [3.7.1-4] - Rebuild with new Golang

Jul 21, 2026
High max 8.6

ELSA-2026-19146 1 CVE

Important: openexr security update (Oracle Linux 10)

[3.1.10-8.3] - fix CVE-2026-41142 - fix CVE-2026-42216 [3.1.10-8.2] - fix CVE-2026-34588

Jul 21, 2026
Critical max 8.1

ELSA-2026-19159 1 CVE

Critical: nginx security update (Oracle Linux 10)

[1.26.3-6.0.1.el10_2.5] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6.5] - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution …

Jul 21, 2026
Medium max 4.1

ELSA-2026-22711 1 CVE

Moderate: vim security update (Oracle Linux 10)

[9.1.083-9.0.1.el10_2.7] - Remove upstream references [Orabug: 31197557] [2:9.1.083-9.7] - RHEL-186660 CVE-2026-47162 vim: netrw code injection via NetrwBookHistSave() - RHEL-186671 CVE-2026-52858 vim: possible code execution with python3complete [2:9.1.083-9…

Jul 21, 2026
High max 9.1

ELSA-2026-23231 3 CVEs

Important: unbound security update (Oracle Linux 10)

[1.24.2-15] - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance [1.24.2-14] - Fix CVE-2026-41292: DoS via excessive EDNS options [1.24.2-13] - Add upstream unit test for CVE-2026-40622 [1.24.2-12] - Fix CVE-2026-44390: DoS with large RRs…

Jul 21, 2026
High max 7.5

ELSA-2026-24716 3 CVEs

Important: yggdrasil security update (Oracle Linux 10)

[0.4.9.2-1] - Update yggdrasil to 0.4.9.2 [0.4.9.1-1] - Update yggdrasil to 0.4.9.1 [0.4.9-5] - Bump release for rebuild [0.4.9-4] - Bump release for rebuild [0.4.9-3] - Bump release for rebuild

Jul 21, 2026
High max 7.5

ELSA-2026-26456 1 CVE

Important: 389-ds-base security, bug fix, and enhancement update (Oracle Linux 10)

[3.2.0-8] - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overf…

Jul 21, 2026