Source

Rocky Linux Security Advisories

Source: https://errata.rockylinux.org/

All Critical High Medium Low With exploited CVEs

2,966 results · Clear filters · Feed

High max 5.1

RLSA-2026:8859 1 CVE

Important: giflib security update

giflib is a library for reading and writing gif images. Security Fix(es): * giflib: Giflib: Double-free vulnerability leading to memory corruption (CVE-2026-23868) For more details about the security issue(s), including the impact, a CVSS score, acknowledgmen…

Apr 21, 2026
High max 7.5

RLSA-2026:8842 2 CVEs

Important: delve security update

Delve is a debugger for the Go programming language. The goal of the project is to provide a simple, full featured debugging tool for Go. Delve should be easy to invoke and easy to use. Chances are if you're using a debugger, things aren't going your way. Wit…

Apr 21, 2026
High max 7.5

RLSA-2026:8474 4 CVEs

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 19, 2026
High max 7.5

RLSA-2026:8469 4 CVEs

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 19, 2026
High max 7.5

RLSA-2026:8510 2 CVEs

Important: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, a…

Apr 19, 2026
High max 9.8

RLSA-2026:8459 5 CVEs

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information disclosure and denial of service via out-of-bounds r…

Apr 19, 2026
High max 7.5

RLSA-2026:8471 4 CVEs

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 19, 2026
High max 7.5

RLSA-2026:8457 2 CVEs

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Heap buffe…

Apr 19, 2026
High max 7.5

RLSA-2026:8534 2 CVEs

Important: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, a…

Apr 18, 2026
High max 7.5

RLSA-2026:8473 4 CVEs

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 18, 2026
High max 7.5

RLSA-2026:8472 4 CVEs

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 18, 2026
High max 7.5

RLSA-2026:8470 4 CVEs

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 18, 2026
High max 7.5

RLSA-2026:8458 2 CVEs

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * FreeRDP: FreeRDP: Heap buffe…

Apr 18, 2026
High max 7.5

RLSA-2026:8467 4 CVEs

Important: .NET 10.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 18, 2026
High max 7.5

RLSA-2026:8468 4 CVEs

Important: .NET 8.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 18, 2026
High max 7.5

RLSA-2026:8492 1 CVE

Important: libarchive security update

The libarchive programming library can create and read several different streaming archive formats, including GNU tar, cpio, and ISO 9660 CD-ROM images. Libarchive is used notably in the bsdtar utility, scripting language bindings such as python-libarchive, a…

Apr 18, 2026
High max 7.5

RLSA-2026:8475 4 CVEs

Important: .NET 9.0 security update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK…

Apr 18, 2026
High max 7.5

RLSA-2026:8352 1 CVE

Important: bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …

Apr 18, 2026
High max 7.5

RLSA-2026:8312 1 CVE

Important: bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …

Apr 16, 2026
High max 8.4

RLSA-2026:7682 1 CVE

Important: openexr security update

OpenEXR is an open-source high-dynamic-range floating-point image file format for high-quality image processing and storage. This document presents a brief overview of OpenEXR and explains concepts that are specific to this format. This package containes the …

Apr 16, 2026
High max 9.8

RLSA-2026:8052 5 CVEs

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information dis…

Apr 16, 2026
High max 5.6

RLSA-2026:8259 3 CVEs

Important: vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted sw…

Apr 16, 2026
High max 7.5

RLSA-2026:7667 1 CVE

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the se…

Apr 16, 2026
High max 8.7

RLSA-2026:8339 4 CVEs

Important: nodejs:20 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * minimatch: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) * minimatch…

Apr 16, 2026
High max 9.2

RLSA-2026:8317 2 CVEs

Important: squid:4 security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526) * Squid: Squid: Denial of Servi…

Apr 16, 2026
High max 9.8

RLSA-2026:7680 2 CVEs

Important: perl-XML-Parser security update

This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then use…

Apr 15, 2026
High max 5.6

RLSA-2026:7711 3 CVEs

Important: vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted sw…

Apr 15, 2026
High max 9.2

RLSA-2026:7675 18 CVEs

Important: nodejs24 security update

Node.js is a platform built on Chrome's JavaScript runtime for easily building fast, scalable network applications. Node.js uses an event-driven, non-blocking I/O model that makes it lightweight and efficient, perfect for data-intensive real-time applications…

Apr 15, 2026
High max 7.5

RLSA-2026:8075 1 CVE

Important: bind security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …

Apr 15, 2026
High max 9.8

RLSA-2026:7679 2 CVEs

Important: perl-XML-Parser security update

This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then use…

Apr 15, 2026
High max 9.8

RLSA-2026:7671 5 CVEs

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information dis…

Apr 15, 2026
High max 7.5

RLSA-2026:7992 1 CVE

Important: golang-github-openprinting-ipp-usb security update

HTTP reverse proxy, backed by IPP-over-USB connection to device. It enables driverless support for USB devices capable of using IPP-over-USB protocol. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more de…

Apr 15, 2026
High max 7.5

RLSA-2026:7668 1 CVE

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the se…

Apr 15, 2026
High max 9.8

RLSA-2026:7672 5 CVEs

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * libpng: libpng: Arbitrary code execution due to use-after-free vulnerability (CVE-2026-33416) * libpng: libpng: Information dis…

Apr 15, 2026
High max 7.5

RLSA-2026:7915 1 CVE

Important: bind9.18 security update

BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), which resolves host names to IP addresses; a resolver library (routines for applications to use when interfacing with DNS)…

Apr 15, 2026
High max 7.5

RLSA-2026:7666 1 CVE

Important: nghttp2 security update

libnghttp2 is a library implementing the Hypertext Transfer Protocol version 2 (HTTP/2) protocol in C. Security Fix(es): * nghttp2: nghttp2: Denial of Service via malformed HTTP/2 frames after session termination (CVE-2026-27135) For more details about the se…

Apr 15, 2026
High max 7.5

RLSA-2026:8155 1 CVE

Important: bind9.16 security update

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS …

Apr 15, 2026
High max 9.2

RLSA-2026:8119 2 CVEs

Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526) * Squid: Squid: Denial of Servi…

Apr 15, 2026
High max 8.8

RLSA-2026:7677 4 CVEs

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Rem…

Apr 14, 2026
High max 9.8

RLSA-2026:7681 2 CVEs

Important: perl-XML-Parser security update

This module provides ways to parse XML documents. It is built on top of XML::Parser::Expat, which is a lower level interface to James Clark's expat library. Each call to one of the parsing methods creates a new instance of XML::Parser::Expat which is then use…

Apr 14, 2026