Skip to content
OpenAdvisories

Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,314 results · Feed

  • High max 7.5
    ELSA-2026-4450 2 CVEs

    Important: .NET 9.0 security update (Oracle Linux 10)

    [9.0.115-1.0.1] - Add support for Oracle Linux [9.0.115-1] - Update to .NET SDK 9.0.115 and Runtime 9.0.14 - Resolves: RHEL-152946

  • High max 7.5
    ELSA-2026-4451 1 CVE

    Important: .NET 8.0 security update (Oracle Linux 10)

    [8.0.125-1.0.1] - Add support for Oracle Linux [8.0.125-1] - Update to .NET SDK 8.0.125 and Runtime 8.0.25 - Resolves: RHEL-152937

  • High max 7.5
    ELSA-2026-4453 2 CVEs

    Important: .NET 10.0 security update (Oracle Linux 10)

    [10.0.104-1.0.1] - Add support for Oracle Linux [10.0.104-1] - Update to .NET SDK 10.0.104 and Runtime 10.0.4 - Resolves: RHEL-152954

  • High max 8.3
    ELSA-2026-4306 3 CVEs

    Important: mingw-libpng security update (Oracle Linux 8)

    [1.6.34-2] - Fix the following CVEs CVE-2026-22695 CVE-2026-22801 CVE-2026-25646 - Resolves: RHEL-148855 - Resolves: RHEL-146662 - Resolves: RHEL-148341

  • Medium max 5.9
    ELSA-2026-4235 1 CVE

    Moderate: nginx:1.26 security update (Oracle Linux 9)

    [2:1.26.3-2.0.1] - Require oracle-indexhtml

  • Medium max 6.0
    ELSA-2026-4216 3 CVEs

    Moderate: python3.11 security update (Oracle Linux 9)

    [3.11.13-5.1.0.1] - Remove upstream URL reference [Orabug: 36073032] [3.11.13-5.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143104 RHEL-143167 RHEL-144890

  • Medium max 5.3
    ELSA-2026-4188 2 CVEs

    Moderate: gnutls security update (Oracle Linux 9)

    [3.8.3-10] - Fix PKCS#11 token initialization label overflow (CVE-2025-9820) - Fix name constraint processing performance issue (CVE-2025-14831)

  • High max 8.1
    ELSA-2026-3058 2 CVEs

    Important: ImageMagick security update (Oracle Linux 7)

    [6.9.10.68-7.0.5] - Fix CVE-2025-62171 and CVE-2026-23876 [Orabug: 38997140] [6.9.10.68-7.0.3] - Security update CVE-2025-57803 [Orabug: 38455460] [6.9.10.68-7.0.1] - Fix for CVE-2025-55154 [Orabug: 38417011]

  • High max 8.8
    ELSA-2026-4064 3 CVEs

    Important: postgresql:12 security update (Oracle Linux 8)

    [12.22-6.0.1] - Add backport of CVE-2025-8714 [Orabug: 38667546] [12.22-6] - Fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006 [12.22-5] - Fix previous Backport [12.22-4] - Backport CVE-2025-8715 [12.22-3] - Fix backport for CVE-2025-1094 [12.22-2] - Backport fix…

  • High max 7.8
    ELSA-2026-3966 2 CVEs

    Important: kernel security update (Oracle Linux 9)

    [5.14.0-611.38.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

  • Medium max 6.0
    ELSA-2026-4168 3 CVEs

    Moderate: python3.9 security update (Oracle Linux 9)

    [3.9.25-3.0.1.el9_7.1] - Remove upstream URL reference [3.9.25-3.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143108 RHEL-143169 RHEL-144893

  • High max 7.8
    ELSA-2026-4173 5 CVEs

    Important: gimp security update (Oracle Linux 9)

    [2:3.0.4-1.4] - fix CVE-2026-0797 - fix CVE-2026-2044 - fix CVE-2026-2045 - fix CVE-2026-2047 - fix CVE-2026-2048

  • Medium max 6.0
    ELSA-2026-4165 3 CVEs

    Moderate: python3.12 security update (Oracle Linux 9)

    [3.12.12-4.0.1.el9_7.1] - Remove upstream URL reference [3.12.12-4.1] - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299 Resolves: RHEL-143106 RHEL-143168 RHEL-144891

  • High max 9.8
    ELSA-2026-50145 147 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

    [5.15.0-318.199.3.2] - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Eric Dumazet) [Orabug: 39057366] - macvlan: fix error recovery in macvlan_common_newlink() (Eric Dumazet) [Orabug: 39057366] {CVE-2026-23209} - netfilter: nf_t…

  • High max 7.8
    ELSA-2026-4012 10 CVEs

    Important: kernel security update (Oracle Linux 10)

    [6.12.0-124.43.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

  • Medium max 6.5
    ELSA-2026-4162 6 CVEs

    Moderate: mysql8.4 security update (Oracle Linux 10)

    [8.4.8-1] - Rebase to 8.4.8 [8.4.7-2] - Skip tests that are failing on Konflux - Resolves: ROK-831

  • High max 9.1
    ELSA-2026-4164 3 CVEs

    Important: git-lfs security update (Oracle Linux 10)

    [3.6.1-7] - Rebuild with new Golang [3.6.1-6] - Rebuild with new Golang [3.6.1-5] - Rebuild with new Golang

  • High max 9.8
    ELSA-2026-50144 58 CVEs

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

    [6.12.0-109.67.6] - net: tunnel: make skb_vlan_inet_prepare() return drop reasons (Menglong Dong) [Orabug: 39027305] [6.12.0-109.67.5] - uek-rpm: fixed specs to explicitly call python3 as set as a requirement (Mark Nicholson) [Orabug: 38933158] - Revert 'net/…

  • Medium max 6.3
    ELSA-2026-2713 1 CVE

    Moderate: python3 security update (Oracle Linux 7)

    [3.6.8-21.0.7] - Security update CVE-2025-12084 [Orabug: 38971895] [3.6.8-21.0.5] - tarfile now validates archives to ensure member offsets are non-negative [Orabug: 38442771][CVE-2025-8194] [3.6.8-21.0.3] - Fix DoS parsing crafted tarfile headers [Orabug: 37…

  • High max 7.8
    ELSA-2026-3963 2 CVEs

    Important: kernel security update (Oracle Linux 8)

    [4.18.0-553.111.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

  • High max 8.8
    ELSA-2026-3967 1 CVE

    Important: libvpx security update (Oracle Linux 8)

    [1.7.0-13] - Add patch for superframe index full Resolves: RHEL-150334

  • High max 9.1
    ELSA-2026-3985 2 CVEs

    Important: git-lfs security update (Oracle Linux 8)

    [3.4.1-8] - Rebuild with new Golang - Resolves: RHEL-146094, RHEL-149269

  • High max 8.8
    ELSA-2026-4024 3 CVEs

    Important: postgresql:13 security update (Oracle Linux 8)

    pgaudit [1.5.0-1] - Update to version 1.5.0 Related: #1855776 [1.4.0-4] - Bump release for rebuild against libpq-12.1-3 [1.4.0-3] - BuildRequires libpq-devel [1.4.0-2] - BuildRequires postgresql-server-devel [1.4.0-1] - Update to 1.4.0 [1.3.1-1] - Update to 1…

  • High max 8.8
    ELSA-2026-4059 3 CVEs

    Important: postgresql:15 security update (Oracle Linux 8)

    pgaudit [1.7.0-1] - Update to 1.7.0 - Support postgresql 15 - Related: #2128241 [1.5.0-1] - Update to version 1.5.0 Related: #1855776 [1.4.0-4] - Bump release for rebuild against libpq-12.1-3 [1.4.0-3] - BuildRequires libpq-devel [1.4.0-2] - BuildRequires pos…

  • High max 8.8
    ELSA-2026-4063 3 CVEs

    Important: postgresql:16 security update (Oracle Linux 8)

    pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pg_repack [1.5.1-1] - Update to 1.5.1 postgres-decoderbufs [2.4.0-1.Final] - Initial import for postgresql 16 stream - Related: RHEL-3636 postgre…

  • High max 7.5
    ELSA-2026-4146 1 CVE

    Important: python-pyasn1 security update (Oracle Linux 8)

    [0.3.7-6.el8_10.1] - Resolves: RHEL-148145

  • High max 8.8
    ELSA-2026-3896 3 CVEs

    Important: postgresql:15 security update (Oracle Linux 9)

    pgaudit [1.7.0-1] - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: #2128410 pg_repack [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 [1.4.8-1] - Update to version 1.4.8 …

  • High max 8.8
    ELSA-2026-4110 4 CVEs

    Important: postgresql:16 security update (Oracle Linux 9)

    pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pg_repack [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 [1.4.8-1] - Res…

  • High max 7.8
    ELSA-2026-50142 1 CVE

    Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

    [5.4.17-2136.353.3] - xfrm: flush all states in xfrm_state_fini (Sabrina Dubroca) [Orabug: 38934000] - xfrm: also call xfrm_state_delete_tunnel at destroy time for states that were never added (Sabrina Dubroca) [Orabug: 38934000] - Revert 'xfrm: destroy xfrm_…

  • Medium max 6.5
    ELSA-2026-3938 1 CVE

    Moderate: nfs-utils security update (Oracle Linux 8)

    [2.3.3-68.0.1] - nfsd: allow more than 64 backlogged connections - spec: remove multiple warnings when upgrading nfs-utils with gssproxy [Orabug: 35173372] [2.3.3-68] - Add requires for selinux-policy (RHEL-127095) [2.3.3-67] - mountd: Minor refactor of get_r…

  • High max 9.1
    ELSA-2026-3898 2 CVEs

    Important: osbuild-composer security update (Oracle Linux 8)

    [101.4-4.0.1] - Support using repository definitons with OCI variables [JIRA: OLDIS-38657] - Update repositories to contain OCI variables - Remove image types Minimal-raw and wsl [JIRA: OLDIS-38123] - Increase default /boot size to 1GB [Orabug: 36827079] - su…

  • High max 9.1
    ELSA-2026-3839 3 CVEs

    Important: image-builder security update (Oracle Linux 9)

    [45-1.0.3] - Rebuilt to fix CVE-2025-61726, CVE-2025-61729, CVE-2025-68121

  • High max 9.1
    ELSA-2026-3840 3 CVEs

    Important: image-builder security update (Oracle Linux 10)

    [45-1.0.3] - Rebuilt to fix CVE-2025-61726, CVE-2025-61729, CVE-2025-68121

  • High max 9.1
    ELSA-2026-3753 4 CVEs

    Important: osbuild-composer security update (Oracle Linux 9)

    [149-4.0.1] - Add missing dependency over dracut-config-rescue for image-installer [ORABUG: 38587453] - Switch to UEKR8 repositories for OL9.6 [Orabug: 37962207] - Add support to create OpenScap images [JIRA: OLDIS-35301] - Simplify repository names [JIRA: OL…

  • Medium max 9.1
    ELSA-2026-3842 1 CVE

    Moderate: delve security update (Oracle Linux 9)

    [1.25.2-2.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.25.2-2] - Rebuild without changes. - Resolves: RHEL-153104

  • High max 9.1
    ELSA-2026-3928 3 CVEs

    Important: git-lfs security update (Oracle Linux 9)

    [3.6.1-7] - Rebuild with new Golang - Resolves: RHEL-146860, RHEL-149620 [3.6.1-6] - Rebuild with new Golang - Resolves: RHEL-147080 [3.6.1-5] - Rebuild with new Golang - Resolves: RHEL-147103

  • High max 8.8
    ELSA-2026-3730 3 CVEs

    Important: postgresql security update (Oracle Linux 9)

    * Wed Feb 25 2026 Filip Janus <fjanus@redhat.com> - 13.23-2 - fix CVE-2026-2004 CVE-2026-2005 CVE-2026-2006

  • Medium max 6.5
    ELSA-2026-3940 1 CVE

    Moderate: nfs-utils security update (Oracle Linux 9)

    [2.5.4-38.0.1.el9_7.3] - spec: remove multiple warnings when upgrading nfs-utils with gssproxy [Orabug: 36044562] [2.5.4-38.3] - Add requires for selinux-policy (RHEL-127104) [2.5.4-38.2] - Replace statfs64 with statfs (RHEL-127104) - NFS export symlink vulne…

  • High max 9.1
    ELSA-2026-3752 4 CVEs

    Important: osbuild-composer security update (Oracle Linux 10)

    [149-5.0.1] - Add missing dependency over dracut-config-rescue for image-installer [Orabug: 38587453] - Add OL10 support - Update repository URLs for baseos, appstream and UERK - Fix the label for UEKR repository - Simplify repository names [JIRA: OLDIS-35893…

  • High max 9.1
    ELSA-2026-3864 3 CVEs

    Important: delve security update (Oracle Linux 10)

    [1.25.2-2.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.25.2-2] - Rebuild with latest Go