Source

Oracle Linux Security Advisories (ELSA)

Source: https://linux.oracle.com/security/

All Critical High Medium Low With exploited CVEs

8,313 results · Feed

High max 9.1

ELSA-2026-500451 3 CVEs

Important: ca-certificates security update (Oracle Linux 10)

[2025.2.80_v9.0.305-102.0.1] - eMudhra: add 'emSign Root TLS CA - G3' and 'Comodo AAA Services root' to blocklist

Oct 20, 2026
Medium max 6.5

ELSA-2026-84590 1 CVE

Moderate: perl-URI security update (Oracle Linux 8)

[1.73-4] - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization

Oct 19, 2026
High max 8.6

ELSA-2026-84586 4 CVEs

Important: libsoup security update (Oracle Linux 8)

[2.62.3-19] - CVE-2026-102557 libsoup: libsoup: Heap buffer overflow during WebSocket message reassembly [2.62.3-18] - CVE-2026-102558 libsoup: libsoup: Heap buffer overflow during WebSocket receive-buffer growth [2.62.3-17] - CVE-2026-102556 libsoup: libsoup…

Oct 19, 2026
High max 8.8

ELSA-2026-85306 1 CVE

Important: bubblewrap security update (Oracle Linux 8)

[0.4.0-3] - Security fix for CVE-2026-87766

Oct 19, 2026
Critical max 9.6

ELSA-2026-84584 11 CVEs

Critical: webkit2gtk3 security, bug fix, and enhancement update (Oracle Linux 8)

[2.54.1-1] - Update to 2.54.1 - Add patch to update ANGLE even further

Oct 19, 2026
High max 8.9

ELSA-2026-84577 2 CVEs

Important: python3.14-urllib3 security update (Oracle Linux 9)

[2.6.3-6] - Fix a regression with Python 3.14.8 [2.6.3-5] - Fix test_start_closed_socket with latest Python [2.6.3-4] - CVE-2026-97689 python3.14-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser [2.6.3-3] - CVE-2026-97687 py…

Oct 19, 2026
High max 8.5

ELSA-2026-84574 5 CVEs

Important: xorg-x11-server security update (Oracle Linux 9)

[1.20.11-34.5] - CVE fix for: CVE-2026-93516, CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520 Resolves: https://redhat.atlassian.net/browse/RHEL-282169 Resolves: https://redhat.atlassian.net/browse/RHEL-282173 Resolves: https://redhat.atlassian…

Oct 19, 2026
Critical max 9.6

ELSA-2026-84583 11 CVEs

Critical: webkit2gtk3 security, bug fix, and enhancement update (Oracle Linux 9)

[2.54.1-1] - Update to 2.54.1 - Add patch to update ANGLE even further

Oct 19, 2026
Medium max 6.5

ELSA-2026-84588 1 CVE

Moderate: perl-URI security update (Oracle Linux 9)

[5.09-3.1] - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization incorrect hostname encoding via missing Unicode normalization Resolves: RHEL-275730

Oct 19, 2026
Medium max 7.3

ELSA-2026-84594 1 CVE

Moderate: environment-modules security update (Oracle Linux 9)

[5.3.0-2.1] - fix command injection in bash Tab completion (CVE-2026-85013)

Oct 19, 2026
High max 7.5

ELSA-2026-85231 1 CVE

Important: jackson-databind security update (Oracle Linux 9)

[2.21.6-1.1] - Resolves: RHEL-276419 - Fix CVE-2026-91777

Oct 19, 2026
High max 7.8

ELSA-2026-85245 1 CVE

Important: emacs security update (Oracle Linux 9)

[1:27.2-18.el9_8.3] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) - Resolves: RHEL-265110

Oct 19, 2026
High max 8.5

ELSA-2026-85193 9 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 9)

[24.1.9-4.4] - CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536 Resolves: https://redhat.atlassian.net/br…

Oct 19, 2026
High max 7.5

ELSA-2026-85234 2 CVEs

Important: resteasy security update (Oracle Linux 9)

[3.0.26-20.1] - Fix CVE-2026-89058: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config - Fix CVE-2026-89059: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) - Resolves: RHEL-278032 - Resolves: RHEL-277999

Oct 19, 2026
High max 8.8

ELSA-2026-85309 1 CVE

Important: bubblewrap security update (Oracle Linux 9)

[0.6.3-1.1] - Fix CVE-2026-87766 path traversal through symlinked mount targets - Use O_PATH for parent directory traversal during setup - Resolves: RHEL-256871

Oct 19, 2026
Medium max 6.5

ELSA-2026-85277 1 CVE

Moderate: hostapd security update (Oracle Linux 9)

[2.11-3] - Fix OOB memory access in Multi-Link Operation element parsing Resolves: RHEL-194042

Oct 19, 2026
Medium max 6.1

ELSA-2026-84595 2 CVEs

Moderate: cockpit-files security update (Oracle Linux 9)

[36.1-1] - CVE-2026-91202 - Don't de-reference a symlink when creating a directory (RHEL-263134) - CVE-2026-91205 - Don't de-reference a symlink when creating a directory (RHEL-263141)

Oct 19, 2026
Medium max 6.5

ELSA-2026-84587 1 CVE

Moderate: perl-URI security update (Oracle Linux 10)

[5.27-3.1] - CVE-2026-19953 perl-URI: URI (for Perl): Security bypass due to incorrect hostname encoding via missing Unicode normalization hostname encoding via missing Unicode normalization Resolves: RHEL-274901

Oct 19, 2026
High max 8.9

ELSA-2026-84578 2 CVEs

Important: python3.14-urllib3 security update (Oracle Linux 10)

[2.6.3-6] - Fix a regression with Python 3.14.8 [2.6.3-5] - Fix test_start_closed_socket with latest Python [2.6.3-4] - CVE-2026-97689 python3.14-urllib3: urllib3: Denial of Service via unbounded memory allocation in chunk parser [2.6.3-3] - CVE-2026-97687 py…

Oct 19, 2026
High max 7.8

ELSA-2026-84591 3 CVEs

Important: emacs security update (Oracle Linux 10)

[1:29.4-16] - Generalize trusted-content-p check to all Flymake backends (CVE-2026-96442) [1:29.4-15] - tramp: restrict user name to prevent shell injection (CVE-2026-79992) [1:29.4-14] - image: fix integer overflow in pbm_load (CVE-2026-77219)

Oct 19, 2026
High max 8.1

ELSA-2026-84721 8 CVEs

Important: wireshark security update (Oracle Linux 10)

[4.4.2-10.0.1.el10_2.8] - Fix post script to not fail during initial installation [Orabug: 37565359] [1:4.4.2-10.8] - Fix Heap-based Buffer Overflow in Wireshark (CVE-2026-95389) - Resolves: RHEL-272823 [1:4.4.2-10.7] - Fix DoS via heap-based buffer overflow …

Oct 19, 2026
High max 7.1

ELSA-2026-84795 1 CVE

Important: librabbitmq security update (Oracle Linux 10)

[0.14.0-3.1] - CVE-2026-44236 librabbitmq: rabbitmq-c: Heap buffer overflow leading to denial of service [rhel-8.10.z] denial of service [rhel-8.10.z] Resolves: RHEL-266736

Oct 19, 2026
High max 8.5

ELSA-2026-85191 9 CVEs

Important: xorg-x11-server-Xwayland security update (Oracle Linux 10)

[24.1.9-4.4] - CVE fix for: CVE-2026-88812, CVE-2026-93515, CVE-2026-93516 CVE-2026-93517, CVE-2026-93518, CVE-2026-93519, CVE-2026-93520, CVE-2026-93521, CVE-2026-93522, CVE-2026-93523, CVE-2026-93524, CVE-2026-93536 Resolves: https://redhat.atlassian.net/br…

Oct 19, 2026
High max 8.8

ELSA-2026-85308 1 CVE

Important: bubblewrap security update (Oracle Linux 10)

[0.10.0-5] - Fix CVE-2026-87766: harden sandbox mount paths [0.10.0-4] - Add tmt plans

Oct 19, 2026
High max 8.4

ELSA-2026-84796 5 CVEs

Important: openexr security update (Oracle Linux 10)

[3.1.10-8.5] - fix CVE-2026-59982 - fix CVE-2026-59184 - fix CVE-2026-59189 - fix CVE-2026-59981 - fix CVE-2026-34544

Oct 19, 2026
Medium max 6.5

ELSA-2026-85276 1 CVE

Moderate: hostapd security update (Oracle Linux 10)

[2.11-3] - Fix OOB memory access in Multi-Link Operation element parsing Resolves: RHEL-194049

Oct 19, 2026
High max 8.2

ELSA-2026-84799 3 CVEs

Important: mariadb11.8 security update (Oracle Linux 10)

[3:11.8.8-2] - Release bump for pcre2 CVE fixes - Resolves: CVE-2026-103111, CVE-2026-86145, CVE-2026-89161

Oct 19, 2026
High max 9.8

ELSA-2026-500397 3 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 7)

[5.4.17-2136.360.3.1] - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167664] {CVE-2026-98432} - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167666] {CVE-2026-99999} - netfilt…

Oct 16, 2026
High max 9.8

ELSA-2026-500398 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 8)

[5.15.0-325.221.6.4] - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167661] {CVE-2026-98432} - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167656] {CVE-2026-99999} - netfilte…

Oct 16, 2026
High max 9.8

ELSA-2026-500399 2 CVEs

Important: Unbreakable Enterprise kernel security update (Oracle Linux 9)

[6.12.0-207.111.5.4] - ipv4: free inet_opt and ireq_opt after an RCU grace period (Eric Dumazet) [Orabug: 40167669] {CVE-2026-98432} - ipv4: validate checksum_start before completing checksum (Michael S. Tsirkin) [Orabug: 40167684] {CVE-2026-99999}

Oct 16, 2026
High max 7.5

ELSA-2026-83525 2 CVEs

Important: lrzsz security, bug fix, and enhancement update (Oracle Linux 8)

[0.12.20-46] - Fix long-standing SIGSEGV bug when using the -s parameter without an argument (RHEL-282148) [0.12.20-45] - Backport tightened path handling from 0.13.1 (CVE-2026-105840) [0.12.20-44] - Remove 'Topipe' feature. (CVE-2026-105841)

Oct 15, 2026
High max 8.8

ELSA-2026-83544 1 CVE

Important: grafana security update (Oracle Linux 8)

[9.2.10-35.0.1] - Fixes CVE-2024-1442 Add email verification when updating user email [Orabug: 38550520] [9.2.10-35] - CVE-2026-15815 grafana: PLUGIN ARCHIVE EXTRACTION ESCAPES THE PLUGIN DIRECTORY, ALLOWING CODE EXECUTION - Resolves RHEL-253157 [9.2.10-34] -…

Oct 15, 2026
High max 7.5

ELSA-2026-83563 1 CVE

Important: rpcbind security update (Oracle Linux 8)

[1.2.5-11] - CVE-2026-94640 rpcbind: Unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service statistics tracking allows unauthenticated remote denial of service Resolves: RHEL-266668

Oct 15, 2026
High max 7.8

ELSA-2026-83552 2 CVEs

Important: ghostscript security update (Oracle Linux 8)

[9.27-19] - CVE-2026-101258 ghostscript: ghostscript: -dSAFER sandbox bypass via Type 5 shading OOB write and procedure-stream use-after-free via Type 5 shading OOB write and procedure-stream use-after-free - CVE-2026-103226 ghostscript: ghostscript: stack-ba…

Oct 15, 2026
Medium max 7.3

ELSA-2026-82919 1 CVE

Moderate: environment-modules security update (Oracle Linux 8)

[4.5.2-5] - Fix command injection in bash Tab completion via compgen -W expansion (CVE-2026-85013)

Oct 15, 2026
Critical max 9.8

ELSA-2026-83460 8 CVEs

Critical: idm:DL1 security, bug fix, and enhancement update (Oracle Linux 8)

bind-dyndb-ldap [11.6-6] - Fix rpminspect warnings Resolves: RHEL-22497 custodia [0.6.0-3] - Require platform-python-setuptools instead of python3-setuptools - Resolves: rhbz#1650508 ipa [4.9.13-21.3.0.2] - Set IPAPLATFORM=rhel when build on Oracle Linux [Ora…

Oct 15, 2026
Medium max 8.1

ELSA-2026-83657 4 CVEs

Moderate: wireshark security update (Oracle Linux 8)

[1:2.6.2-21] - Fix DoS vulnerability in H.245 protocol dissector (CVE-2026-76927) - Resolves: RHEL-257649 [1:2.6.2-20] - Fix DoS vulnerability in ESS protocol dissector (CVE-2026-76919) - Resolves: RHEL-257614 [1:2.6.2-19] - Fix DoS via C12.22 protocol dissec…

Oct 15, 2026
High max 8.3

ELSA-2026-82858 1 CVE

Important: python36:3.6 security update (Oracle Linux 8)

python36 [3.6.8-39] - Provide /usr/bin/python3 explicitly - Resolves: RHEL-2113 python-distro [1.4.0-2] - Port from Fedora to RHEL8, part of the python36 module - Resolves: rhbz#1678920 python-docs [3.6.7-2] - Bumping due to problems with modular RPM upgrade …

Oct 15, 2026
High max 10.0

ELSA-2026-83157 9 CVEs

Important: kernel security, bug fix, and enhancement update (Oracle Linux 8)

[4.18.0-553.174.1] - Update Oracle Linux certificates (Kevin Lyons) - Disable signing for aarch64 (Ilya Okomin) - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237] - Update x509.genkey […

Oct 15, 2026
High max 9.3

ELSA-2026-82882 11 CVEs

Important: hplip security, bug fix, and enhancement update (Oracle Linux 9)

[3.26.6-1.3] - Fix LEDM scanning [3.26.6-1.2] - fix OSH issues [3.26.6-1.1] - really fix missing /var/lib/hp [3.26.6-1] - Rebase to 3.26.6 [3.21.2-6.6] - RHEL-257310 [IMAGE-MODE] missing /var/lib/hp on image-mode

Oct 15, 2026