Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 7.5

ELSA-2026-86203 4 CVEs

Important: go-toolset:ol8 security, bug fix, and enhancement update (Oracle Linux 8)

delve [1.26.1-1.0.1] - Disable DWARF compression which has issues (Alex Burmashev) [1.26.1-1] - Update to Delve 1.26.1 - Related: RHEL-183712 [1.25.2-1] - Update to Delve 1.25.2 (Sync from CentOS Stream 9) - Related: RHEL-121223 [1.24.1-1] - Rebase to 1.24.1 …

Oct 21, 2026
High max 7.5

ELSA-2026-86196 4 CVEs

Important: golang security, bug fix, and enhancement update (Oracle Linux 9)

[1.26.10-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.10-1] - Update to Go 1.26.10 (fips-1) - Resolves: RHEL-287192

Oct 21, 2026
Critical max 9.4

ELSA-2026-86171 20 CVEs

Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 9)

[9.0.122-1.0.1] - Add support for Oracle Linux [9.0.122-1] - Update to .NET SDK 9.0.122 and Runtime 9.0.21 - Resolves: RHEL-277800

Oct 21, 2026
Critical max 9.4

ELSA-2026-86169 21 CVEs

Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 9)

[8.0.132-1.0.1] - Add support for Oracle Linux [8.0.132-1] - Update to .NET SDK 8.0.132 and Runtime 8.0.32 - Resolves: RHEL-277793

Oct 21, 2026
Critical max 9.4

ELSA-2026-86193 22 CVEs

Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 9)

[10.0.113-1.0.1] - Add support for Oracle Linux [10.0.113-1] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277808

Oct 21, 2026
Medium max 7.5

ELSA-2026-86706 2 CVEs

Moderate: jackson-core security update (Oracle Linux 9)

[2.21.6-1.2] - Resolves: RHEL-286626 - CVE-2026-89425 jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing unbounded StringBuilder growth during malformed token processing [2.21.6-1.1] - Resolves: …

Oct 21, 2026
Medium max 4.8

ELSA-2026-85958 3 CVEs

Moderate: openssh security update (Oracle Linux 9)

[9.9p1-13.0.1] - Restore pam_ssh_agent_rel values that were used for initial release - Fix PerSourcePenalties grace-exceeded using the crash penalty value [Orabug: 39825354] - Replace unsupported ML-KEM hybrid algorithm skip logic with v9.9p1-23.el10_2 ML-KEM…

Oct 21, 2026
Medium max 5.3

ELSA-2026-86981 1 CVE

Moderate: fetchmail security update (Oracle Linux 9)

[6.4.24-1.1] - Fix CVE-2026-94184: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) Resolves: RHEL-265195

Oct 21, 2026
High max 9.2

ELSA-2026-87151 3 CVEs 2 exploited

Important: php security update (Oracle Linux 9)

[8.0.30-8.1] - Fix FILTER_SANITIZE_ENCODED does not encode 0xFF - Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison CVE-2026-91768 - Fix Various packet overreads in mysqlnd wire protocol CVE-2025-1218 - Fix TLS hostname v…

Oct 21, 2026
High max 7.1

ELSA-2026-87082 2 CVEs

Important: qt5-qtbase security update (Oracle Linux 9)

[5.15.9-11.2] - Fix CVE-2026-19248: unbounded recursion and O(N2) behavior in QDom Resolves: RHEL-261136 - Fix CVE-2026-11573: denial of services via uncontrolled recursion in XML serialization Resolves: RHEL-277670

Oct 21, 2026
High max 8.2

ELSA-2026-604898 38 CVEs

Important: python-oci-sdk security update (Oracle Linux 9)

[2.187.0-1.0.5] - Fix multiple CVEs in pyjwt, aiohttp, pyOpenSSL, multidict

Oct 21, 2026
High max 8.4

ELSA-2026-86983 5 CVEs

Important: openexr security update (Oracle Linux 9)

[3.1.1-3.5] - fix CVE-2026-59982 - fix CVE-2026-59184 - fix CVE-2026-59189 - fix CVE-2026-59981 - fix CVE-2026-34544

Oct 21, 2026
High max 7.8

ELSA-2026-86921 1 CVE

Important: librsvg2 security update (Oracle Linux 9)

[2.50.7-3.1] - CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities entities

Oct 21, 2026
Critical max 9.4

ELSA-2026-86172 20 CVEs

Critical: .NET 9.0 security, bug fix, and enhancement update (Oracle Linux 10)

[9.0.122-1.0.1] - Add support for Oracle Linux [9.0.122-1] - Update to .NET SDK 9.0.122 and Runtime 9.0.21 - Resolves: RHEL-277801

Oct 21, 2026
Critical max 9.4

ELSA-2026-86195 22 CVEs

Critical: .NET 10.0 security, bug fix, and enhancement update (Oracle Linux 10)

[10.0.113-1.0.1] - Add support for Oracle Linux [10.0.113-1] - Update to .NET SDK 10.0.113 and Runtime 10.0.13 - Resolves: RHEL-277809

Oct 21, 2026
Medium max 5.5

ELSA-2026-86971 3 CVEs

Moderate: cockpit-machines security update (Oracle Linux 10)

[348.1-1.0.1] - Replace upstream references [Orabug: 34340088] [348.1-1] - CVE-2026-92768 (RHEL-263124) - CVE-2026-92747 (RHEL-263120) - CVE-2026-92745 (RHEL-263113)

Oct 21, 2026
High max 9.2

ELSA-2026-87070 3 CVEs 2 exploited

Important: php security update (Oracle Linux 10)

[8.3.36-1] - rebase to 8.3.36 [8.3.35-1] - rebase to 8.3.35

Oct 21, 2026
High max 9.2

ELSA-2026-87071 3 CVEs 2 exploited

Important: php8.4 security update (Oracle Linux 10)

[8.4.27-1] - rebase to 8.4.27

Oct 21, 2026
High max 7.5

ELSA-2026-86093 4 CVEs

Important: golang security, bug fix, and enhancement update (Oracle Linux 10)

[1.26.10-1.0.1] - EXPERIMENTAL: Introduce fipsnoenforceems GODEBUG var [1.26.10-1] - Update to Go 1.26.10 (fips-1)

Oct 21, 2026
Critical max 9.4

ELSA-2026-86168 21 CVEs

Critical: .NET 8.0 security, bug fix, and enhancement update (Oracle Linux 10)

[8.0.132-1.0.1] - Add support for Oracle Linux [8.0.132-1] - Update to .NET SDK 8.0.132 and Runtime 8.0.32 - Resolves: RHEL-277794

Oct 21, 2026
High max 7.8

ELSA-2026-86841 1 CVE

Important: librsvg2 security update (Oracle Linux 10)

[2.57.1-10] - CVE-2026-96889 librsvg2: Use-after-free when XML includes have duplicated entities

Oct 21, 2026
High max 7.8

ELSA-2026-84744 4 CVEs

Important: gimp:2.8 security update (Oracle Linux 8)

gimp [2:2.8.22-26.9] - fix CVE-2026-90947 - fix CVE-2026-90948 - fix CVE-2026-92248 - fix CVE-2026-97185 [2:2.8.22-26.8] - fix CVE-2026-59090 - fix CVE-2026-18301 - fix CVE-2026-18303 - fix CVE-2026-18305 - fix CVE-2026-18306 - fix CVE-2026-66758 - fix CVE-20…

Oct 20, 2026
High max 9.2

ELSA-2026-85239 3 CVEs

Important: python3 security update (Oracle Linux 8)

[3.6.8-79.0.1] - Add Oracle Linux distribution in platform.py [Orabug: 20812544] [3.6.8.openela.0] - Add openela to supported dists [3.6.8-79] - Security fixes for CVE-2026-12345, CVE-2026-19445, CVE-2026-19553 Resolves: RHEL-272935, RHEL-276260, RHEL-274107

Oct 20, 2026
High max 8.2

ELSA-2026-85968 2 CVEs

Important: openssl security update (Oracle Linux 8)

[1:1.1.1k-18] - Fix CVE-2026-63072: heap buffer overflow in CMS key unwrapping Resolves: RHEL-246295 - Fix CVE-2026-84782: DTLS Retransmits Handshake Messages From a Stale Buffer Offset Resolves: RHEL-264420

Oct 20, 2026
High max 7.5

ELSA-2026-84798 2 CVEs

Important: pcs security update (Oracle Linux 8)

[0.10.18-2.0.1.el8_10.10] - Replaced HAM-logo [0.10.18-2.el8_10.10] - Fixed CVE-2026-82397, CVE-2024-14029 by patching bundled Tornado Resolves: RHEL-271884, RHEL-271929

Oct 20, 2026
High max 9.8

ELSA-2026-85773 9 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.176.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 20, 2026
High max 9.1

ELSA-2026-500449 3 CVEs

Important: ca-certificates security update (Oracle Linux 8)

[2025.2.80_v9.0.304-80.2.0.1] - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Oct 20, 2026
High max 8.8

ELSA-2026-85791 1 CVE

Important: postgresql:16 security update (Oracle Linux 9)

pgaudit [16.0-1] - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3635 pg_repack [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604 [1.4.8-1] - Res…

Oct 20, 2026
High max 8.8

ELSA-2026-85814 1 CVE

Important: postgresql:18 security update (Oracle Linux 9)

pgaudit [18.0-1] - Update to 18.0 - Initial import for postgresql18 pg_repack [1.5.3-1] - Update to 1.5.3 - Initial import for postgresql18 [1.5.1-1] - Update to v1.5.1 [1.4.8-2] - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47604…

Oct 20, 2026
High max 8.9

ELSA-2026-85929 2 CVEs

Important: python3.12-urllib3 security update (Oracle Linux 9)

[1.26.19-3.2] - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282261 [1.26.19-3.1] - CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configurat…

Oct 20, 2026
High max 8.2

ELSA-2026-500448 1 CVE

Important: openssl security update (Oracle Linux 9)

[3.5.8-2.0.1_fips] - Replace upstream references in fips man pages [Orabug: 35824276] - Update additional upstream references - Add FIPS package change: add fips suffix to Release and set Epoch to 10 [Orabug: 35824276] - Update FIPS module name [Orabug: 35824…

Oct 20, 2026
High max 9.8

ELSA-2026-86033 15 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 9)

[5.14.0-687.59.1] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) […

Oct 20, 2026
High max 9.1

ELSA-2026-500450 3 CVEs

Important: ca-certificates security update (Oracle Linux 9)

[2025.2.80_v9.0.305-91.0.1] - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Oct 20, 2026
Medium max 4.8

ELSA-2026-85847 3 CVEs

Moderate: openssh security update (Oracle Linux 10)

[9.9p1-29.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-29] - CVE-2026-59998: Document caveat regarding GSSAPIStrictAcceptorCheck Resolves: RHEL-276225 - CVE-2026-59997: Fix internal-sftp server argument parsing limit Resolves: …

Oct 20, 2026
High max 8.9

ELSA-2026-85930 2 CVEs

Important: python-urllib3 security update (Oracle Linux 10)

[1.26.19-4.2] - CVE-2026-97689 python3.12-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser Resolves: RHEL-282258 [1.26.19-4.1] - CVE-2026-97687 python3.12-urllib3: urllib3: Traffic interception via HTTPS proxy TLS configurat…

Oct 20, 2026
High max 7.5

ELSA-2026-85848 2 CVEs

Important: rust-sequoia-sq security update (Oracle Linux 10)

[1.4.0.1-4.0.1] - Put 'Requires' openssl-libs in correct placeholder [Orabug: 38742109] - Hard require needed openssl-libs [Orabug: 38742109] [1.4.0.1-4] - Fix CVE-2026-93657 [1.4.0.1-3] - Fix CVE-2026-93599

Oct 20, 2026
Medium max 5.3

ELSA-2026-85959 1 CVE

Moderate: fetchmail security update (Oracle Linux 10)

[6.4.38-3.1] - Fix CVE-2026-94184: stack-based buffer overflow in NTLM authentication (fetchmail-SA-2026-01) Resolves: RHEL-265187

Oct 20, 2026
High max 7.5

ELSA-2026-86056 2 CVEs

Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 10)

[0.12.20-69] - Fix long-standing SIGSEGV bug when using the -s parameter without an argument (RHEL-282106) [0.12.20-68] - Backport tightened path handling from 0.13.1 (CVE-2026-105840) [0.12.20-67] - Remove 'Topipe' feature. (CVE-2026-105841)

Oct 20, 2026
High max 7.8

ELSA-2026-86331 1 CVE

Important: glycin-loaders security update (Oracle Linux 10)

[1.0.1-2] - Backport CVE-2026-96889 fix to vendored librsvg

Oct 20, 2026
High max 9.8

ELSA-2026-85321 17 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 10)

[6.12.0-211.67.1] - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782] - Disable UKI signing [Orabug: 36571828] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Sig…

Oct 20, 2026