Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

High max 8.7

ELSA-2026-40856 1 CVE

Important: python3.14 security update (Oracle Linux 10)

[3.14.5-1.1] - Security fix for CVE-2026-15308 Resolves: RHEL-193775 [3.14.5-1] - Update to 3.14.5 Resolves: RHEL-176147 [3.14.5~rc1-1] - Update to 3.14.5rc1 - Move back to the generational from the incremental garbage collector - Security fix for CVE-2026-60…

Jul 16, 2026
Medium max 7.3

ELSA-2026-30845 1 CVE

Moderate: mod_md security update (Oracle Linux 10)

[1:2.4.26-5.1] - Resolves: RHEL-175647 - mod_md: OCSP response limits (CVE-2026-29168) [1:2.4.26-5] - Resolves: RHEL-134484 - httpd: Apache HTTP Server: mod_md (ACME), unintended retry intervals (CVE-2025-55753) [1:2.4.26-3] - Bump release for October 2024 ma…

Jul 16, 2026
High max 9.6

ELSA-2026-30846 29 CVEs

Important: thunderbird security update (Oracle Linux 10)

[140.12.0-1.0.1] - Add Oracle prefs [140.12.0-1] - Update to 140.12.0 ESR [140.11.0-1] - Update to 140.11.0 ESR [140.10.1-1] - Update to 140.10.1 ESR

Jul 16, 2026
High max 9.1

ELSA-2026-30857 1 CVE

Important: perl-Archive-Tar security update (Oracle Linux 10)

[3.02-512.1] - Fix CVE-2026-42496: validate symlink and hardlink targets in secure extract mode - Resolves: RHEL-181651

Jul 16, 2026
High max 7.3

ELSA-2026-30860 1 CVE

Important: perl-IO-Compress security update (Oracle Linux 10)

[2.212-512.1] - Fix CVE-2026-48962: remove use of eval in File::GlobMapper - Resolves: RHEL-180415

Jul 16, 2026
High max 7.4

ELSA-2026-20567 1 CVE

Important: qt6-qtdeclarative security update (Oracle Linux 10)

[6.10.1-1.1] - VectorImage: sanitize source string used in output (CVE-2025-14576) Resolves: RHEL-173494

Jul 16, 2026
Medium max 9.1

ELSA-2026-22141 4 CVEs

Moderate: go-fdo-client and go-fdo-server security update (Oracle Linux 10)

go-fdo-client [1.0.0-4] - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 [1.0.0-3] - Rebuild to fix CVE-2026-32283 go-fdo-server [1.0.1-2] - Rebuild to fix CVE-2026-32282 and CVE-2025-68121 [1.0.1-1] - Update to 1.0.1 upstream release - Resolves: RHEL-16547…

Jul 16, 2026
High max 8.1

ELSA-2026-24331 2 CVEs

Important: cockpit-image-builder security update (Oracle Linux 10)

[94.3-1.0.1] - Switch to old frotend [Orabug: 38011073] [Orabug: 37856296] [Orabug: 37856375] - Replaced additional upstream url [Orabug: 37856187] - Replaced upstream urls in documentation with oracle links [Orabug: 37856187] [94.3-1] - New upstream release …

Jul 16, 2026
High max 7.5

ELSA-2026-24758 1 CVE

Important: libyang security update (Oracle Linux 10)

[2.1.148-4] - DoS or arbitrary code execution via maliciously crafted LYB binary blob - Resolves: RHEL-177026 - CVE-2026-44673

Jul 16, 2026
High max 10.0

ELSA-2026-33093 1 CVE

Important: mariadb10.11 security, bug fix, and enhancement update (Oracle Linux 10)

[3:10.11.18-1] - Rebase to 10.11.18 [3:10.11.17-1] - Rebase to 10.11.17 [3:10.11.16-1] - Rebase to 10.11.16

Jul 16, 2026
Medium max 4.4

ELSA-2026-33124 1 CVE

Moderate: coreutils security update (Oracle Linux 10)

[9.5-8.0.1] - clean up empty file if cp is failed [Orabug 15973168] [9.5-8] - CVE-2025-5278 - Fix Heap Buffer Under-Read in sort via Key Specification (RHEL-180649)

Jul 16, 2026
High max 7.6

ELSA-2026-33540 3 CVEs

Important: ruby4.0 security update (Oracle Linux 10)

[4.0.3-35] - Fix Net::IMAP ResponseReader quadratic complexity vulnerability (CVE-2026-42245) Includes core fix plus additional performance optimizations Resolves: RHEL-181675 - Fix Net::IMAP STARTTLS stripping vulnerability (CVE-2026-42246) Resolves: RHEL-18…

Jul 16, 2026
High max 7.6

ELSA-2026-33565 3 CVEs

Important: ruby security update (Oracle Linux 10)

[3.3.10-13] - Fix DoS via crafted IMAP responses in net-imap. (CVE-2026-42245) Resolves: RHEL-181687 - Fix information disclosure via MITM attack bypassing TLS in net-imap. (CVE-2026-42246) Resolves: RHEL-181775 - Fix command injection via Symbol arguments in…

Jul 16, 2026
Medium max 7.8

ELSA-2026-33731 1 CVE

Moderate: rrdtool security update (Oracle Linux 10)

[1.8.0-21] - Fixed stack buffer overflow in rrdcached and added more security checks Resolves: RHEL-173264

Jul 16, 2026
High max 9.8

ELSA-2026-34109 7 CVEs

Important: httpd security, bug fix, and enhancement update (Oracle Linux 10)

[2.4.63-13.0.1.el10_2.4] - Replace index.html with Oracle's index page oracle_index.html. [2.4.63-13.4] - Resolves: RHEL-186221 - httpd: Apache HTTP Server: Heap-based Buffer Overflow via malicious backend servers (CVE-2026-34356) - Resolves: RHEL-186195 - ht…

Jul 16, 2026
Medium max 7.3

ELSA-2026-34355 2 CVEs

Moderate: mod_http2 security, bug fix, and enhancement update (Oracle Linux 10)

[2.0.29-4.2] - Resolves: RHEL-188008 - address CVE-2026-43951, CVE-2026-48913 [2.0.29-4.1] - Resolves: RHEL-182410 - mod_http2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack (CVE-2026-49975) [2.0.29-4] - Resolves: RHEL-16626…

Jul 16, 2026
High max 9.6

ELSA-2026-35826 1 CVE

Important: grafana-pcp security update (Oracle Linux 10)

[5.3.0-7] - Resolves RHEL-183688: CVE-2026-39821 [5.3.0-6] - Resolves RHEL-183688: CVE-2026-39821 [5.3.0-5] - Resolves RHEL-166460: CVE-2026-32282 - Resolves RHEL-167495: CVE-2026-32283

Jul 16, 2026
High max 9.6

ELSA-2026-35827 1 CVE

Important: grafana security update (Oracle Linux 10)

[10.2.6-27] - Resolves: RHEL-183694: CVE-2026-39821 [10.2.6-26] - Resolves RHEL-161791: CVE-2026-27877 - Resolves RHEL-166459: CVE-2026-32282 - Resolves RHEL-167494: CVE-2026-32283

Jul 16, 2026
High max 7.5

ELSA-2026-35832 2 CVEs

Important: golang-github-openprinting-ipp-usb security update (Oracle Linux 10)

[0.9.27-7.2] - rebuilt with golang-1.26.4-1.el10_2 to fix CVE-2026-33811, CVE-2026-27145 [0.9.27-7.1] - rebuilt with golang-1.26.3-4.el10_2 to fix CVE-2026-32281 [0.9.27-7] - rebuilt to fix CVE-2026-32280, CVE-2026-32282, CVE-2026-32283, CVE-2026-33810

Jul 16, 2026
High max 8.2

ELSA-2026-33502 1 CVE

Important: giflib security update (Oracle Linux 10)

[5.2.1-25] - fix CVE-2026-26740: buffer overflow in EGifGCBToExtension (RHEL-157086) [5.2.1-24] - rebuild [5.2.1-23] - fix CVE-2026-23868: double free in GifMakeSavedImage (RHEL-154850)

Jul 16, 2026
High max 4.1

ELSA-2026-36193 1 CVE

Important: python3.14-pip security update (Oracle Linux 10)

[25.2-5] - Fix gating plan - removed unnecessary older VERSION= tests - removed bootstrap test - fix pip_install_upgrade to run pip-3.14 - fix bash completion + remove unused metadata file [25.2-4] - Security fix for CVE-2026-8643: path traversal in wheel ent…

Jul 16, 2026
High max 7.5

ELSA-2026-19155 1 CVE

Important: python-markdown security update (Oracle Linux 10)

[3.5.1-6.1] - Fix CVE-2025-69534 (RHEL-153740)

Jul 16, 2026
Critical max 9.8

ELSA-2026-25191 7 CVEs

Critical: kernel security update (Oracle Linux 10)

[6.12.0-211.34.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Jul 16, 2026
Medium max 9.8

ELSA-2026-33092 1 CVE

Moderate: glibc security, bug fix, and enhancement update (Oracle Linux 10)

[2.39-126.0.1] - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E. Marchesi <jose.marchesi@oracle.com> Oracle history: Jul-15-2026 Cupertino Miranda <cupertino.miranda@oracle.com> - 2.39-124.0.1 - Forward port Oracle changes to 2.39-124. - Revie…

Jul 16, 2026
High max 10.0

ELSA-2026-33412 8 CVEs

Important: galera and mariadb11.8 security, bug fix, and enhancement update (Oracle Linux 10)

galera [26.4.27-1] - Rebased to 26.4.27 [26.4.26-1] - Rebased to 26.4.26 mariadb11.8 [3:11.8.8-1] - Rebase to 11.8.8 [3:11.8.7-1] - Rebase to 11.8.7

Jul 16, 2026
High max 8.8

ELSA-2026-36196 2 CVEs

Important: 389-ds-base security update (Oracle Linux 10)

[3.2.0-8] - Bump version to 3.2.0-8 - Resolves: RHEL-182152 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-10.2.z] - Resolves: RHEL-183105 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overf…

Jul 16, 2026
High max 8.8

ELSA-2026-36203 5 CVEs

Important: freerdp security update (Oracle Linux 10)

[2:3.10.3-12.6] - Backport several CVE fixes (CVE-2026-40033, CVE-2026-44420, CVE-2026-44421, CVE-2026-44422, CVE-2026-45700) Resolves: RHEL-186978, RHEL-186967, RHEL-186958, RHEL-186950, RHEL-186093 [2:3.10.3-12.5] - Lock appWindow to fix use-after-free in R…

Jul 16, 2026
Medium max 7.5

ELSA-2026-36211 1 CVE

Moderate: freeipmi security update (Oracle Linux 10)

[1.6.18-1] - Update to 1.6.18

Jul 16, 2026
High max 6.9

ELSA-2026-36320 4 CVEs

Important: unbound security update (Oracle Linux 10)

[1.24.2-15] - Fix CVE-2026-42534: Jostle logic bypass degrades resolution performance [1.24.2-14] - Fix CVE-2026-41292: DoS via excessive EDNS options [1.24.2-13] - Add upstream unit test for CVE-2026-40622 [1.24.2-12] - Fix CVE-2026-44390: DoS with large RRs…

Jul 16, 2026
High max 8.1

ELSA-2026-36364 1 CVE

Important: nginx security, bug fix, and enhancement update (Oracle Linux 10)

[1.26.3-6.0.1.el10_2.5] - Reference oracle-indexhtml within Requires [Orabug: 33802044] [2:1.26.3-6.5] - Resolves: RHEL-191778 - nginx: 'HTTP/2 bomb' nginx fix breaks module ABI causing crashes - Resolves: RHEL-188402 - nginx: NGINX: Arbitrary code execution …

Jul 16, 2026
Medium max 7.1

ELSA-2026-36673 1 CVE

Moderate: gstreamer1-plugins-ugly-free security update (Oracle Linux 10)

[1.26.7-2.1] - Fix CVE-2026-53703: multiple security issues in rmdemux Resolves: RHEL-184439

Jul 16, 2026
High max 7.6

ELSA-2026-36675 1 CVE

Important: gstreamer1-plugins-good security update (Oracle Linux 10)

[1.26.7-2.1] - Fix integer overflow vulnerabilities in wavpack decoder (CVE-2026-53705) Resolves: RHEL-184480

Jul 16, 2026
High max 8.8

ELSA-2026-36749 4 CVEs

Important: gstreamer1-plugins-bad-free security update (Oracle Linux 10)

[1.26.7-2.4] - Fix bytes/bits confusion in AV1 tile data size parsing (CVE-2026-52718) Resolves: RHEL-184391 [1.26.7-2.3] - Fix for CVE-2026-52719 Resolves: RHEL-184406 [1.26.7-2.2] - Fix integer overflows in VMnc decoder (CVE-2026-52722) Resolves: RHEL-18442…

Jul 16, 2026
Medium max 6.2

ELSA-2026-36782 1 CVE

Moderate: aardvark-dns security update (Oracle Linux 10)

[2:1.17.1-1] - update to https://github.com/containers/aardvark-dns/releases/tag/v1.17.1 - Resolves: RHEL-170143

Jul 16, 2026
High max 7.5

ELSA-2026-36788 2 CVEs 1 exploited

Important: tomcat security, bug fix, and enhancement update (Oracle Linux 10)

[1:10.1.49-3] - Related: RHEL-168577 Remove unnecessary patch [1:10.1.49-2] - Resolves: RHEL-168577 Remove tomcat clustering JAR from RPM builds Resolves: CVE-2026-29146 tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in Encrypt…

Jul 16, 2026
High max 7.5

ELSA-2026-36790 2 CVEs 1 exploited

Important: tomcat9 security, bug fix, and enhancement update (Oracle Linux 10)

[1:9.0.117-2] - Resolves: RHEL-185571 Remove tomcat clustering JAR from RPM builds [1:9.0.117-1] - Resolves: RHEL-150720 Tomcat: Certificate revocation bypass due to improper OCSP response validation (CVE-2026-24734) - Resolves: Tomcat: OCSP checks sometimes …

Jul 16, 2026
High max 9.6

ELSA-2026-37436 2 CVEs

Important: golang security, bug fix, and enhancement update (Oracle Linux 10)

[1.26.5-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.5-1] - Update to Go 1.26.5 (fips-1) [1.25.7-1] - Update to Go 1.25.7 (fips-1) [1.25.5-1] - Update to Go 1.25.5 (fips-1) [1.25.3-5] - gating.yaml: Add tier1 s390x tests [1.25.3-4] - Cl…

Jul 16, 2026
High max 7.8

ELSA-2026-38494 1 CVE

Important: buildah security update (Oracle Linux 10)

[1.43.1-4.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117178] [2:1.43.1-4] - rebuild for CVE-2026-39822 - Resolves: RHEL-193643 [2:1.43.1-3] - bump golang.org/x/crypto to v0.52.0 to fix CVE-2026-39830 - Resolves: RHEL-186266 …

Jul 16, 2026
High max 7.8

ELSA-2026-38495 1 CVE

Important: podman security update (Oracle Linux 10)

[5.8.2-5.0.1] - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404] [7:5.8.2-5] - rebuild for CVE-2026-39822 - Resolves: RHEL-193642 [7:5.8.2-4] - update to the latest state of the sustaining branch - fixes CVE-2026-42508 CVE-2026-3…

Jul 16, 2026
High max 8.8

ELSA-2026-38499 2 CVEs

Important: openexr security update (Oracle Linux 10)

[3.1.10-8.3] - fix CVE-2026-41142 - fix CVE-2026-42216 [3.1.10-8.2] - fix CVE-2026-34588

Jul 16, 2026