Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 7.8

ELSA-2026-32990 1 CVE

Important: cifs-utils security update (Oracle Linux 10)

[7.6-2] - resolves: RHEL-192935 - fix krb5 mount regression [7.6-1] - Update to version 7.6 - resolves: RHEL-185756 - CVE-2026-12505 cifs-utils: LPE via cifs.spnego

Jul 21, 2026
High max 7.1

ELSA-2026-42739 2 CVEs

Important: acl security update (Oracle Linux 10)

[2.4.0-1] - rebase to 2.4.0 to fix the following CVEs: - CVE-2026-54369 - Symlink traversal privilege escalation via libacl functions (RHEL-186106) - CVE-2026-54370 - TOCTOU Symlink Traversal via getfacl/setfacl (RHEL-186207)

Jul 21, 2026
High max 8.1

ELSA-2026-18289 1 CVE

Important: podman security update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 21, 2026
Medium max 9.8

ELSA-2026-18320 1 CVE

Moderate: edk2 security update (Oracle Linux 10)

[20251114-5.0.1.el10_2.2] - Replace upstream references [Orabug:36569119] [20251114-5.el10_2.2] - edk2-Revert-OvmfPkg-X86QemuLoadImageLib-flip-default-for-.patch [RHEL-182421] - edk2-Bumped-to-OpenSSL-3.5.5-3.patch [RHEL-165699] - Resolves: RHEL-182421 (edk2/…

Jul 21, 2026
Medium max 5.5

ELSA-2026-18326 1 CVE

Moderate: libvirt security update (Oracle Linux 10)

[11.10.0-12.4.0.1] - Set SOURCE_DATE_EPOCH from changelog [Orabug: 32019554] [11.10.0-12.4.el10_2] - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-180449) - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-180449) - qemu: Move domain caps flags h…

Jul 21, 2026
High max 9.6

ELSA-2026-18537 3 CVEs

Important: tomcat security update (Oracle Linux 10)

[1:10.1.49-3] - Related: RHEL-168577 Remove unnecessary patch [1:10.1.49-2] - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds Resolves: CVE-2026-29146 tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in Encrypt…

Jul 21, 2026
High max 7.5

ELSA-2026-22120 11 CVEs

Important: golang security update (Oracle Linux 10)

[1.26.5-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.5-1] - Update to Go 1.26.5 (fips-1) [1.25.7-1] - Update to Go 1.25.7 (fips-1) [1.25.5-1] - Update to Go 1.25.5 (fips-1) [1.25.3-5] - gating.yaml: Add tier1 s390x tests [1.25.3-4] - Cl…

Jul 21, 2026
High max 9.3

ELSA-2026-26228 2 CVEs

Important: hplip security update (Oracle Linux 10)

[3.23.12-10.5] - RHEL-192007 CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631 [3.23.12-10.4] - Fix more leaks in hpcups [3.23.12-10.3] - OSH fixes after CVE-2026-8631 [3.23.12-10.2] - CVE-2026-8631 hplip: Arbitrary code execution and privilege escalatio…

Jul 21, 2026
Low max 7.5

ELSA-2026-28234 1 CVE

Low: libxml2 security update (Oracle Linux 10)

[2.12.5-10.2] - Fix CVE-2025-6170 (RHEL-182007) [2.12.5-10.1] - Fix CVE-2024-34459 (RHEL-177890)

Jul 21, 2026
High max 9.8

ELSA-2026-19569 14 CVEs 1 exploited

Important: kernel security update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 21, 2026
High max 7.5

ELSA-2026-42096 1 CVE

Important: c-ares security update (Oracle Linux 10)

[1.34.6-2] - Fix double-free in process_timeouts() (CVE-2026-33630) Resolves: RHEL-192867

Jul 21, 2026
High max 7.5

ELSA-2026-29195 4 CVEs

Important: buildah security update (Oracle Linux 10)

[1.43.1-4.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-4] - rebuild for CVE-2026-39822 - Resolves: RHEL-193643 [2:1.43.1-3] - bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830 - Resolves: RHEL-186266 …

Jul 21, 2026
High max 8.8

ELSA-2026-41899 17 CVEs

Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 8)

[9.0.119-1.0.1] - Add support for Oracle Linux [9.0.119-1] - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192469

Jul 20, 2026
High max 8.8

ELSA-2026-42088 23 CVEs

Important: webkit2gtk3 security update (Oracle Linux 8)

[2.52.5-1] - Update to 2.52.5

Jul 20, 2026
High max 7.5

ELSA-2026-42090 1 CVE

Important: glib2 security update (Oracle Linux 8)

[2.56.4-170] - Add patch for CVE-2026-58016 - Resolves: RHEL-190622 [2.68.4-169] - Add patch for CVE-2025-14087 and CVE-2025-14512 [2.56.4-168] - Add patch for CVE-2025-13601 - Fix GUnixMount issues - Enable testsuite during RPM check phase [2.56.4-167] - gdb…

Jul 20, 2026
High max 7.7

ELSA-2026-39868 15 CVEs

Important: nodejs:24 security, bug fix, and enhancement update (Oracle Linux 8)

nodejs [1:24.18.0-1] - Update to version 24.18.0 Resolves: RHEL-168744 nodejs-nodemon [3.0.3-1] - Initial import into nodejs:24 module nodejs-packaging [2021.06-6] - Properly handle @group/package deps in nodejs-symlink-deps Resolves: RHEL-121576 [2021.06-5] …

Jul 20, 2026
High max 8.8

ELSA-2026-40841 1 CVE

Important: maven:3.8 security update (Oracle Linux 8)

apache-commons-cli [1.5.0-5] - Rebuild to regenerate auto-requires [1.5.0-4] - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild [1.5.0-3] - Rebuilt for java-17-openjdk as system jdk [1.5.0-2] - Rebuilt for https://fedoraproject.org/wiki/Fedor…

Jul 20, 2026
High max 8.8

ELSA-2026-41896 17 CVEs

Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

[9.0.119-1.0.1] - Add support for Oracle Linux [9.0.119-1] - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192472 [9.0.118-2] - Reduce time to detect hanging builds - Resolves: RHEL-191646

Jul 20, 2026
High max 9.8

ELSA-2026-41906 13 CVEs

Important: httpd security, bug fix, and enhancement update (Oracle Linux 9)

[2.4.62-13.0.1.el9_8.5] - Replace index.html with Oracle's index page oracle_index.html. [2.4.62-13.5] - Resolves: RHEL-192752 - mod_proxy_html regression in CVE-2026-34355 fix [2.4.62-13.4] - Resolves: RHEL-186217 - httpd: Apache HTTP Server: Heap-based Buff…

Jul 20, 2026
High max 8.8

ELSA-2026-41898 17 CVEs

Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

[10.0.110-1.0.1] - Add support for Oracle Linux [10.0.110-1] - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192462 [10.0.109-2] - Reduce time to detect hanging builds - Resolves: RHEL-191641

Jul 20, 2026
High max 8.8

ELSA-2026-38796 1 CVE

Important: plexus-utils security update (Oracle Linux 9)

[3.3.0-14] - Fix CVE-2025-67030: Directory Traversal in Expand.extractFile Resolves: RHEL-165350

Jul 20, 2026
High max 8.8

ELSA-2026-41894 17 CVEs

Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

[8.0.129-1.0.1] - Add support for Oracle Linux [8.0.129-1] - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192467 [8.0.128-2] - Reduce time to detect hanging builds - Resolves: RHEL-191652

Jul 20, 2026
High max 4.3

ELSA-2026-41905 1 CVE

Important: dovecot security update (Oracle Linux 9)

[1:2.3.16-18.1] - fix CVE-2026-42006: IMAP parser list_count_limit bypass via open parentheses (RHEL-188468)

Jul 20, 2026
High max 8.8

ELSA-2026-42062 23 CVEs

Important: webkit2gtk3 security update (Oracle Linux 9)

[2.52.5-1] - Update to 2.52.5

Jul 20, 2026
High max 7.5

ELSA-2026-42089 1 CVE

Important: glib2 security update (Oracle Linux 9)

[2.68.4-19.2] - Fix CVE-2026-58016: broken node element nesting validation in D-Bus introspection XML parsing - Resolves: RHEL-190632

Jul 20, 2026
High max 8.1

ELSA-2026-40895 2 CVEs

Important: jackson-annotations, jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update (Oracle Linux 9)

jackson-annotations [2.21-1] - Update to version 2.21 - Resolves: RHEL-188300 jackson-core [2.21.4-1] - Update to version 2.21.4 - Resolves: RHEL-188300 jackson-databind [2.21.4-1] - Update to version 2.21.4 - Resolves: RHEL-188300 jackson-jaxrs-providers [2.…

Jul 20, 2026
Medium max 4.7

ELSA-2026-18153 1 CVE

Moderate: systemd security update (Oracle Linux 10)

[257-23.0.1.el10_2.2] - Fix detection of Oracle Virtualization or BM envs [Orabug: 37531877] - Avoid udevadm warnings when using udev valid configs [Orabug: 37503197] - allow dm remove ioctl to co-operate with UEK3 [Orabug: 18467469] - set 'RemoveIPC=no' in l…

Jul 20, 2026
High max 7.5

ELSA-2026-25225 1 CVE

Important: mod_http2 security update (Oracle Linux 10)

[2.0.29-4.2] - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 [2.0.29-4.1] - Resolves: RHEL-182410 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.29-4] - Resolves: RHEL-16626…

Jul 20, 2026
Medium max 7.5

ELSA-2026-27740 1 CVE

Moderate: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

[0.9.27-7.2] - rebuilt with golang-1.26.4-1.el10_2 to fix CVE-2026-33811, CVE-2026-27145 [0.9.27-7.1] - rebuilt with golang-1.26.3-4.el10_2 to fix CVE-2026-32281 [0.9.27-7] - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810

Jul 20, 2026
High max 7.5

ELSA-2026-41892 2 CVEs

Important: libtiff security, bug fix, and enhancement update (Oracle Linux 10)

[4.6.0-8.4] - fix CVE-2026-12912: heap-buffer-overflow in PixarLog 8BITABGR decode with stride 3 (RHEL-189374) - make sure documentation is updated during build for CVE-2023-52355 (RHEL-178281) [4.6.0-8.3] - reintroduce ignore option -i as it is required for …

Jul 20, 2026
High max 9.8

ELSA-2026-19160 3 CVEs

Important: firefox security update (Oracle Linux 10)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.2-1] - Up…

Jul 20, 2026
High max 8.8

ELSA-2026-41895 16 CVEs

Important: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10)

[9.0.119-1.0.1] - Add support for Oracle Linux [9.0.119-1] - Update to .NET SDK 9.0.119 and Runtime 9.0.18 - Resolves: RHEL-192473 [9.0.118-2] - Reduce time to detect hanging builds - Resolves: RHEL-191644

Jul 20, 2026
High max 8.8

ELSA-2026-41897 16 CVEs

Important: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

[10.0.110-1.0.1] - Add support for Oracle Linux [10.0.110-1] - Update to .NET SDK 10.0.110 and Runtime 10.0.10 - Resolves: RHEL-192463 [10.0.109-2] - Reduce time to detect hanging builds - Resolves: RHEL-191640

Jul 20, 2026
Medium max 7.5

ELSA-2026-18139 1 CVE

Moderate: glibc security update (Oracle Linux 10)

[2.39-126.0.1] - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: Jul-15-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.39-124.0.1 - Forward port Oracle changes to 2.39-124. - Revie…

Jul 20, 2026
High max 7.5

ELSA-2026-19128 1 CVE

Important: yggdrasil-worker-package-manager security update (Oracle Linux 10)

[0.2.3-7] - Bump release for rebuild [0.2.3-6] - Bump release for rebuild

Jul 20, 2026
High max 9.8

ELSA-2026-21380 18 CVEs

Important: firefox security update (Oracle Linux 10)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.2-1] - Up…

Jul 20, 2026
High max 4.3

ELSA-2026-41988 1 CVE

Important: dovecot security update (Oracle Linux 10)

[1:2.3.21-19.1] - fix CVE-2026-42006: fix imap_parser list_count_limit to actually work (RHEL-188477)

Jul 20, 2026
Medium max 9.8

ELSA-2026-18134 28 CVEs

Moderate: kernel security update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 20, 2026
High max 9.6

ELSA-2026-19153 4 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.12.0-1.0.1] - Add Oracle prefs [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

Jul 20, 2026
Medium max 7.5

ELSA-2026-20594 1 CVE

Moderate: glibc security update (Oracle Linux 10)

[2.39-126.0.1] - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: Jul-15-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.39-124.0.1 - Forward port Oracle changes to 2.39-124. - Revie…

Jul 20, 2026