Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 7.5

ELSA-2026-26532 1 CVE

Important: dracut security update (Oracle Linux 10)

[107-8.0.1] - Suppress stderr for btrfs subvolume check [Orabug: 39059254] - fips: add logic for /boot subvolume on BTRFS [Orabug: 36028061] - Skip unneeded FIPS logic on UEK with special FIPS [Orabug: 38138800] [Orabug: 38709306] - Include correct modprobe i…

Jul 20, 2026
High max 8.8

ELSA-2026-41893 17 CVEs

Important: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

[8.0.129-1.0.1] - Add support for Oracle Linux [8.0.129-1] - Update to .NET SDK 8.0.129 and Runtime 8.0.29 - Resolves: RHEL-192468 [8.0.128-2] - Reduce time to detect hanging builds - Resolves: RHEL-191650

Jul 20, 2026
High max 8.8

ELSA-2026-41937 2 CVEs

Important: sssd security update (Oracle Linux 10)

[2.12.0-3.0.1.el10_2.1] - Restore default debug level for sss_cache [Orabug: 32810448] [2.12.0-3.1] - Resolves: RHEL-192056 - CVE-2026-14474 sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole - Resolves: RHEL-192064 - CVE-2026-14476 ss…

Jul 20, 2026
High max 7.5

ELSA-2026-42063 1 CVE

Important: glib2 security update (Oracle Linux 10)

[2.80.4-14] - Fix CVE-2026-58016: D-Bus introspection XML node nesting validation [2.80.4-13] - Fix CVE-2025-14087 and CVE-2025-14512

Jul 20, 2026
High max 9.8

ELSA-2026-19131 26 CVEs 1 exploited

Important: thunderbird security update (Oracle Linux 10)

[140.12.0-1.0.1] - Add Oracle prefs [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

Jul 20, 2026
Low max 5.6

ELSA-2026-40416 1 CVE

Low: php:8.2 security, bug fix, and enhancement update (Oracle Linux 9)

php [8.2.32-1] - rebase to 8.2.32 php-pecl-apcu [5.1.23-1] - update to 5.1.23 for PHP 8.2 RHEL-14699 php-pecl-rrd [2.0.3-4] - build for PHP 8.1 #2070040 [2.0.3-3] - Rebuilt for IMA sigs, glibc 2.34, aarch64 flags Related: rhbz#1991688 [2.0.3-2] - Rebuilt for …

Jul 17, 2026
High max 7.5

ELSA-2026-19134 3 CVEs

Important: grafana security update (Oracle Linux 10)

[10.2.6-27] - Resolves: RHEL-183694: CVE-2026-39821 [10.2.6-26] - Resolves RHEL-161791: CVE-2026-27877 - Resolves RHEL-166459: CVE-2026-32282 - Resolves RHEL-167494: CVE-2026-32283

Jul 17, 2026
High max 7.5

ELSA-2026-19136 2 CVEs

Important: grafana-pcp security update (Oracle Linux 10)

[5.3.0-7] - Resolves RHEL-183688: CVE-2026-39821 [5.3.0-6] - Resolves RHEL-183688: CVE-2026-39821 [5.3.0-5] - Resolves RHEL-166460: CVE-2026-32282 - Resolves RHEL-167495: CVE-2026-32283

Jul 17, 2026
High max 9.8

ELSA-2026-19137 2 CVEs

Important: go-fdo-server security update (Oracle Linux 10)

[1.0.1-2] - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 [1.0.1-1] - Update to 1.0.1 upstream release - Resolves: RHEL-165475 [1.0.0-3] - Rebuild to fix CVE-2026-32283

Jul 17, 2026
High max 7.5

ELSA-2026-19139 1 CVE

Important: go-fdo-client security update (Oracle Linux 10)

[1.0.0-4] - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 [1.0.0-3] - Rebuild to fix CVE-2026-32283

Jul 17, 2026
High max 7.5

ELSA-2026-21754 1 CVE

Important: .NET 9.0 security update (Oracle Linux 10)

[9.0.118-1.0.1] - Add support for Oracle Linux [9.0.118-1] - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181554 [9.0.117-1] - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173919

Jul 17, 2026
High max 7.5

ELSA-2026-22145 1 CVE

Important: .NET 10.0 security update (Oracle Linux 10)

[10.0.109-1.0.1] - Add support for Oracle Linux [10.0.109-1] - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181559 [10.0.108-1] - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173909 [10.0.106-3] - Adjust build limits - Re…

Jul 17, 2026
High max 9.6

ELSA-2026-27733 29 CVEs

Important: firefox security update (Oracle Linux 10)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.2-1] - Up…

Jul 17, 2026
High max 9.1

ELSA-2026-36189 1 CVE

Important: perl-HTTP-Daemon security update (Oracle Linux 10)

[6.16-7.1] - Fix CVE-2026-8450: send_file() shell-magic via 2-arg open() - Resolves: RHEL-184826

Jul 17, 2026
High max 7.5

ELSA-2026-19144 4 CVEs

Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

[0.9.27-7.2] - rebuilt with golang-1.26.4-1.el10_2 to fix CVE-2026-33811, CVE-2026-27145 [0.9.27-7.1] - rebuilt with golang-1.26.3-4.el10_2 to fix CVE-2026-32281 [0.9.27-7] - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810

Jul 17, 2026
High max 5.1

ELSA-2026-19154 1 CVE

Important: giflib security update (Oracle Linux 10)

[5.2.1-25] - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) [5.2.1-24] - rebuild [5.2.1-23] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850)

Jul 17, 2026
High max 9.6

ELSA-2026-19157 4 CVEs

Important: firefox security update (Oracle Linux 10)

[140.12.0-1.0.1] - Fix firefox-oracle-default-prefs.js for new nss [Orabug: 37079773] - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.2-1] - Up…

Jul 17, 2026
High max 8.3

ELSA-2026-20606 2 CVEs

Important: ruby4.0 security update (Oracle Linux 10)

[4.0.3-35] - Fix Net::IMAP ResponseReader quadratic complexity vulnerability (CVE-2026-42245) Includes core fix plus additional performance optimizations Resolves: RHEL-181675 - Fix Net::IMAP STARTTLS stripping vulnerability (CVE-2026-42246) Resolves: RHEL-18…

Jul 17, 2026
High max 9.8

ELSA-2026-21433 5 CVEs

Important: httpd security update (Oracle Linux 10)

[2.4.63-13.0.1.el10_2.4] - Replace index.html with Oracle's index page oracle_index.html. [2.4.63-13.4] - Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) - Resolves: RHEL-186195 - ht…

Jul 17, 2026
High max 9.8

ELSA-2026-22325 19 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.12.0-1.0.1] - Add Oracle prefs [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

Jul 17, 2026
Medium max 7.5

ELSA-2026-22528 1 CVE

Moderate: mod_http2 security update (Oracle Linux 10)

[2.0.29-4.2] - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 [2.0.29-4.1] - Resolves: RHEL-182410 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.29-4] - Resolves: RHEL-16626…

Jul 17, 2026
High max 8.1

ELSA-2026-19008 1 CVE

Important: pcs security update (Oracle Linux 10)

[0.12.2-3.el10_2.1] - Fixed CVE-2026-4800 by updating HA Cluster Management add-on to 0.1.24.3 Resolves: RHEL-164079 [0.12.2-3] - Fixed CVE-2025-13465 by updating pcs-web-ui to 0.1.24.2 Resolves: RHEL-144191

Jul 17, 2026
High max 7.3

ELSA-2026-22649 6 CVEs

Important: php8.4 security update (Oracle Linux 10)

[8.4.21-2] - rebase to 8.4.21

Jul 17, 2026
High max 8.8

ELSA-2026-27742 11 CVEs

Important: postgresql18 security update (Oracle Linux 10)

[18.4-1.0.1] - Replace upstream reference [18.4-1] - Update to 18.4 - Fix CVE-2026-6478

Jul 17, 2026
High max 8.8

ELSA-2026-27743 4 CVEs

Important: postgresql16 security update (Oracle Linux 10)

[16.14-1.0.1] - Replace upstream reference [Orabug: 37044148] [16.14-1] - Update to 16.14 - Fix CVE-2026-6478

Jul 17, 2026
High max 7.8

ELSA-2026-19125 3 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

[24.1.9-4.2] - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184290 [24.1.9-4.1] - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Re…

Jul 17, 2026
High max 7.5

ELSA-2026-19138 2 CVEs

Important: fence-agents security update (Oracle Linux 10)

[4.16.0-21.2] - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182314 [4.16.0-21.1] - bundled pyasn1: replace with dependency to fix CVE-2026-30922 - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597 Resolves: RHEL-157187, RHEL-1…

Jul 17, 2026
High max 7.4

ELSA-2026-19152 1 CVE

Important: rsync security update (Oracle Linux 10)

[3.4.4-1] - Resolves: RHEL-181630 - Rebase rsync to version 3.4.4 - Resolves: RHEL-174929 - TOCTOU symlink race condition (CVE-2026-29518) - Resolves: RHEL-174949 - Memory disclosure via int overflow (CVE-2026-43618) [3.4.1-3] - Resolves: RHEL-118549 - Do not…

Jul 17, 2026
High max 8.2

ELSA-2026-20613 13 CVEs

Important: gnutls security update (Oracle Linux 10)

[3.8.10-4] - Fix 3.8.13 CVEs and security issues, update Makefile.in - Fix CVE-2026-33846 - Fix CVE-2026-42009 - Fix CVE-2026-33845 - Fix CVE-2026-42010 - Fix CVE-2026-3833 - Fix CVE-2026-42011 - Fix CVE-2026-42012 - Fix CVE-2026-42013 - Fix CVE-2026-42014 - …

Jul 17, 2026
High max 7.5

ELSA-2026-21286 2 CVEs

Important: .NET 8.0 security update (Oracle Linux 10)

[8.0.128-1.0.1] - Add support for Oracle Linux [8.0.128-1] - Update to .NET SDK 8.0.128 and Runtime 8.0.28 - Resolves: RHEL-181056 [8.0.127-1] - Update to .NET SDK 8.0.127 and Runtime 8.0.27 - Resolves: RHEL-173924

Jul 17, 2026
High max 9.8

ELSA-2026-40894 1 CVE

Important: hplip security update (Oracle Linux 8)

[3.18.4-14] - RHEL-192009 CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631

Jul 16, 2026
High max 8.7

ELSA-2026-39771 1 CVE

Important: python3.12 security update (Oracle Linux 9)

[3.12.13-3.0.1.el9_8.1] - Remove upstream URL reference [3.12.13-3.1] - Security fix for CVE-2026-15308 Resolves: RHEL-RHEL-193793

Jul 16, 2026
High max 8.7

ELSA-2026-39798 1 CVE

Important: python3.9 security, bug fix, and enhancement update (Oracle Linux 9)

[3.9.25-7.0.1.el9_8.2] - Remove upstream URL reference [3.9.25-7.2] - Security fix for CVE-2026-15308 Resolves: RHEL-193786 [3.9.25-7.1] - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+ Resolves: RHEL-194207

Jul 16, 2026
High max 7.3

ELSA-2026-40751 2 CVEs

Important: gimp security update (Oracle Linux 9)

[2:3.0.4-4.6] - fix CVE-2026-58384 - Resolves: RHEL-192536

Jul 16, 2026
High max 9.8

ELSA-2026-40831 1 CVE

Important: hplip security update (Oracle Linux 9)

[3.21.2-6.5] - RHEL-192001 CVE-2026-14544 hplip: Incomplete Fix for CVE-2026-8631

Jul 16, 2026
High max 7.5

ELSA-2026-19127 1 CVE

Important: gdk-pixbuf2 security update (Oracle Linux 10)

[2.42.12-5] - jpeg: Reject unsupported number of components

Jul 16, 2026
High max 8.8

ELSA-2026-19141 1 CVE

Important: PackageKit security update (Oracle Linux 10)

[1.2.8-8.0.1] - remove RHEL vendor patch PackageKit-0.3.8-RHEL-Vendor.conf.patch

Jul 16, 2026
Medium max 5.9

ELSA-2026-19143 2 CVEs

Moderate: libsoup3 security update (Oracle Linux 10)

[3.6.5-11] - Add patches for CVE-2026-4271 and CVE-2026-5119 [3.6.5-10] - Add patch for CVE-2026-1761 [3.6.5-9] - Fix CVE-2026-0719 [3.6.5-8] - Fix CVE-2025-14523 [3.6.5-7] - Add patch for CVE-2025-12105 [3.6.5-6] - Fix integer overflow in date/time parsing […

Jul 16, 2026
High max 5.9

ELSA-2026-19145 2 CVEs

Important: krb5 security update (Oracle Linux 10)

[1.21.3-10.0.1] - Fixed race condition in krb5_set_password() [Orabug: 33609767] [1.21.3-10] - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356) Resolves: RHEL-171588 RHEL-171597

Jul 16, 2026
Medium max 6.5

ELSA-2026-19148 2 CVEs

Moderate: glib2 security update (Oracle Linux 10)

[2.80.4-13] - Fix CVE-2025-14087 and CVE-2025-14512

Jul 16, 2026