Skip to content
OpenAdvisories

Source

Rocky Linux Security Advisories

Source: https://errata.rockylinux.org/

All Critical High Medium Low With exploited CVEs

2,966 results · Clear filters · Feed

  • High max 9.1
    RLSA-2026:23231 3 CVEs

    Important: unbound security update

    The unbound packages provide a validating, recursive, and caching DNS or DNSSEC resolver. Security Fix(es): * unbound: Heap overflow and crash with multiple nsid, cookie, padding EDNS options (CVE-2026-42944) * unbound: Unbound DNSSEC Validator Denial of Serv…

  • High max 7.5
    RLSA-2026:23360 2 CVEs

    Important: bind9.16 security update

    The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …

  • High max 9.8
    RLSA-2026:22643 19 CVEs

    Important: thunderbird security update

    Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firef…

  • High max 2.9
    RLSA-2026:23230 1 CVE

    Important: expat security update

    Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related informa…

  • High max 7.5
    RLSA-2026:23102 3 CVEs

    Important: delve security update

    Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. Wit…

  • High max 9.1
    RLSA-2026:22937 8 CVEs

    Important: image-builder security update

    A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected sessi…

  • High max 7.3
    RLSA-2026:22649 6 CVEs

    Important: php8.4 security update

    PHP is an HTML-embedded scripting language. PHP attempts to make it easy for developers to write dynamically generated web pages. PHP also offers built-in database integration for several commercial and non-commercial database management systems, so writing a…

  • High max 9.1
    RLSA-2026:22450 11 CVEs

    Important: osbuild-composer security update

    A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-compos…

  • High max 9.8
    RLSA-2026:22325 19 CVEs

    Important: thunderbird security update

    Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firef…

  • High max 9.1
    RLSA-2026:23228 8 CVEs

    Important: image-builder security update

    A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood. Security Fix(es): * golang: net/url: Memory exhaustion in query parameter parsing in net/url (CVE-2025-61726) * crypto/tls: Unexpected sessi…

  • High max 2.9
    RLSA-2026:22715 1 CVE

    Important: expat security update

    Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related informa…

  • High max 7.5
    RLSA-2026:22145 1 CVE

    Important: .NET 10.0 security update

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

  • High max 8.2
    RLSA-2026:20613 13 CVEs

    Important: gnutls security update

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: F…

  • High max 2.9
    RLSA-2026:22721 1 CVE

    Important: expat security update

    Expat is a C library for parsing XML documents. Security Fix(es): * libexpat: denial of service via crafted XML input (CVE-2026-45186) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related informa…

  • High max 9.3
    RLSA-2026:21755 2 CVEs

    Important: flatpak security update

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary f…

  • High max 8.0
    RLSA-2026:21676 1 CVE

    Important: cockpit security update

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Arbitra…

  • High max 9.8
    RLSA-2026:21380 18 CVEs

    Important: firefox security update

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the Ja…

  • High max 9.3
    RLSA-2026:21757 2 CVEs

    Important: flatpak security update

    Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Security Fix(es): * flatpak: Flatpak: Arbitrary code execution via crafted symlinks in sandbox-expose options (CVE-2026-34078) * flatpak: Flatpak: Arbitrary f…

  • High max 7.5
    RLSA-2026:21754 1 CVE

    Important: .NET 9.0 security update

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

  • High max 9.8
    RLSA-2026:21557 18 CVEs

    Important: kernel security update

    The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: can: j1939: j1939_session_new(): fix skb reference counting (CVE-2024-56645) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing …

  • High max 9.8
    RLSA-2026:21433 5 CVEs

    Important: httpd security update

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-…

  • High max 7.5
    RLSA-2026:21286 2 CVEs

    Important: .NET 8.0 security update

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

  • High max 8.3
    RLSA-2026:20606 2 CVEs

    Important: ruby4.0 security update

    Ruby is the interpreted scripting language for quick and easy object-oriented programming. It has many features to process text files and to do system management tasks (as in Perl). It is simple, straight-forward, and extensible. Security Fix(es): * ruby/json…

  • High max 7.4
    RLSA-2026:20567 1 CVE

    Important: qt6-qtdeclarative security update

    Qt6 - QtDeclarative component. Security Fix(es): * qt: Qt SVG: Arbitrary QML/JavaScript code injection via malicious SVG file (CVE-2025-14576) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related…

  • High max 7.8
    RLSA-2026:20600 2 CVEs

    Important: wireshark security update

    The wireshark packages contain a network protocol analyzer used to capture and browse the traffic running on a computer network. Security Fix(es): * wireshark: Heap-based Buffer Overflow in Wireshark (CVE-2026-5405) * wireshark: Improper Limitation of a Pathn…

  • High max 7.5
    RLSA-2026:22304 1 CVE

    Important: postgresql-jdbc security update

    PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Servic…

  • High max 8.2
    RLSA-2026:20612 13 CVEs

    Important: gnutls security update

    The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Fix qsort comparator in DTLS reassembly (CVE-2026-42009) * gnutls: F…

  • High max 7.5
    RLSA-2026:19173 1 CVE

    Important: podman security update

    The podman tool manages pods, container images, and containers. It is part of the libpod library, which is for applications that use container pods. Container pods is a concept in Kubernetes. Security Fix(es): * github.com/go-jose/go-jose/v3: github.com/go-jo…

  • High max 9.8
    RLSA-2026:22140 6 CVEs

    Important: httpd:2.4 security update

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase (CVE-2025-53020) * httpd: mod_proxy_ajp: heap-based buffer over-read and memory d…

  • High max 7.3
    RLSA-2026:22305 4 CVEs

    Important: php:8.2 security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting v…

  • High max 7.3
    RLSA-2026:22143 4 CVEs

    Important: php:8.2 security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting v…

  • High max 7.3
    RLSA-2026:22142 4 CVEs

    Important: php:8.3 security update

    PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * PHP: PHP: Denial of Service via improper handling of signed characters in ctype functions (CVE-2026-7258) * PHP: PHP-FPM: PHP-FPM: Cross-Site Scripting v…

  • High max 9.4
    RLSA-2026:21745 18 CVEs

    Important: kernel-rt security update

    The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: ima: don't clear IMA_DIGSI…

  • High max 9.4
    RLSA-2026:21706 18 CVEs

    Important: kernel security update

    The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Bluetooth: MGMT: Fix possible UAFs (CVE-2025-39981) * kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-6…

  • High max 9.4
    RLSA-2026:21556 19 CVEs

    Important: kernel security update

    The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CVE-2025-38653) * kernel: ima: don't clear IMA_DIGSIG flag whe…

  • High max 8.0
    RLSA-2026:21468 1 CVE

    Important: cockpit security update

    Cockpit enables users to administer GNU/Linux servers using a web browser. It offers network configuration, log inspection, diagnostic reports, SELinux troubleshooting, interactive command-line sessions, and more. Security Fix(es): * cockpit: Cockpit: Arbitra…

  • High max 9.8
    RLSA-2026:21391 5 CVEs

    Important: httpd security update

    The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server. Security Fix(es): * httpd: mod_proxy_ajp: heap-based buffer over-read and memory disclosure in ajp_parse_data() (CVE-2026-34059) * httpd: mod_proxy_ajp: heap-…

  • High max 9.8
    RLSA-2026:21381 19 CVEs

    Important: thunderbird security update

    Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the JavaScript Engine component (CVE-2026-8391) * firef…

  • High max 9.8
    RLSA-2026:21378 18 CVEs

    Important: firefox security update

    Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: Incorrect boundary conditions in the JavaScript Engine: JIT component (CVE-2026-8388) * firefox: Other issue in the Ja…

  • High max 7.5
    RLSA-2026:21297 1 CVE

    Important: .NET 10.0 security update

    .NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…