Source

Rocky Linux Security Advisories

Source: https://errata.rockylinux.org/

All Critical High Medium Low With exploited CVEs

4,991 results · Feed

High max 7.0

RLSA-2026:6766 1 CVE

Important: python3.9 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

Apr 9, 2026
High max 7.8

RLSA-2026:5941 2 CVEs

Important: golang security update

The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For m…

Apr 9, 2026
Medium max 0.0

RLSA-2026:6622 1 CVE

Moderate: crun security update

crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related in…

Apr 9, 2026
Medium max 4.3

RLSA-2026:6825 1 CVE

Moderate: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used…

Apr 9, 2026
High max 4.8

RLSA-2026:6817 2 CVEs

Important: capstone security update

Capstone is a disassembly framework with the target of becoming the ultimate disasm engine for binary analysis and reversing in the security community. Security Fix(es): * capstone: Capstone: Memory corruption via unchecked vsnprintf return (CVE-2025-68114) *…

Apr 9, 2026
High max 8.2

RLSA-2026:6906 4 CVEs

Important: nginx security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * …

Apr 9, 2026
High max 2.7

RLSA-2026:6461 1 CVE

Important: openssh security update

OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server. Security Fix(es): * openssh: OpenSSH GSSAPI: Information disclosure or …

Apr 9, 2026
High max 5.6

RLSA-2026:6915 3 CVEs

Important: vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417) * vim: Vim: Denial of service and information disclosure via crafted sw…

Apr 9, 2026
High max 8.3

RLSA-2026:6445 1 CVE

Important: libpng12 security update

The libpng12 package provides libpng 1.2, which is the previous version of the libpng library for manipulating PNG (Portable Network Graphics) image format files. This version should be used in case that it is not possible to use the current version of libpng…

Apr 9, 2026
High max 8.3

RLSA-2026:6439 1 CVE

Important: libpng15 security update

The libpng15 package provides libpng 1.5, an older version of the libpng. library for manipulating PNG (Portable Network Graphics) image format files. This version should be used only if you are unable to use the current version of libpng. Security Fix(es): *…

Apr 9, 2026
High max 9.1

RLSA-2026:6470 1 CVE

Important: perl-YAML-Syck security update

This module provides a Perl interface to the libsyck data serialization library. It exports the Dump and Load functions for converting Perl data structures to YAML strings, and the other way around. Security Fix(es): * perl-YAML-Syck: YAML::Syck versions thro…

Apr 9, 2026
Medium max 4.3

RLSA-2026:6436 1 CVE

Moderate: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used…

Apr 9, 2026
High max 9.3

RLSA-2026:6918 13 CVEs

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-use-af…

Apr 9, 2026
High max 8.8

RLSA-2026:6750 6 CVEs

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, and gstreamer1-plugins-good security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via AS…

Apr 9, 2026
High max 8.2

RLSA-2026:6907 4 CVEs

Important: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * …

Apr 9, 2026
High max 9.2

RLSA-2026:7123 9 CVEs

Important: nodejs:22 security update

Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language. Security Fix(es): * brace-expansion: brace-expansion: Denial of Service via unbounded brace range expansion (CVE-2026-25547)…

Apr 9, 2026
High max 8.8

RLSA-2026:6628 1 CVE

Important: fontforge security update

FontForge is a font editor for outline and bitmap fonts. It supports a range of font formats, including PostScript (ASCII and binary Type 1, some Type 3 and Type 0), TrueType, OpenType (Type2) and CID-keyed fonts. Security Fix(es): * fontforge: FontForge: Rem…

Apr 8, 2026
High max 7.8

RLSA-2026:6949 2 CVEs

Important: go-toolset:rhel8 security update

Go Toolset provides the Go programming language tools and libraries. Go is alternatively known as golang. Security Fix(es): * cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host li…

Apr 8, 2026
Medium max 8.8

RLSA-2026:6153 8 CVEs

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180) * kernel: drm/sched: Fix potential double free in drm_sched_job_add_…

Apr 8, 2026
Medium max 0.0

RLSA-2026:6621 1 CVE

Moderate: crun security update

crun is a OCI runtime Security Fix(es): * crun: crun: Privilege escalation due to incorrect parsing of the `--user` option (CVE-2026-30892) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related in…

Apr 8, 2026
High max 8.2

RLSA-2026:6923 4 CVEs

Important: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files (CVE-2026-32647) * …

Apr 8, 2026
High max 9.2

RLSA-2026:6301 2 CVEs

Important: squid security update

Squid is a high-performance proxy caching server for web clients, supporting FTP, and HTTP data objects. Security Fix(es): * squid: Squid: Denial of Service via heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526) * Squid: Squid: Denial of Servi…

Apr 7, 2026
High max 7.5

RLSA-2026:6383 1 CVE

Important: grafana-pcp security update

The Grafana plugin for Performance Co-Pilot includes datasources for scalable time series from pmseries and Redis, live PCP metrics and bpftrace scripts from pmdabpftrace, as well as several dashboards. Security Fix(es): * net/url: Incorrect parsing of IPv6 h…

Apr 7, 2026
Medium max 6.8

RLSA-2026:5603 1 CVE

Moderate: opencryptoki security update

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. These packages includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11 firmware loaded), the IBM …

Apr 7, 2026
High max 7.5

RLSA-2026:6382 1 CVE

Important: grafana security update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For more details about the security issue(s), includ…

Apr 7, 2026
High max 8.8

RLSA-2026:6300 7 CVEs

Important: gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, and gstreamer1-plugins-ugly-free security update

GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-bad-free package contains a collection of plug-ins for GStreamer. Security Fix(es): * GStreamer: GStreamer: Arbitrary code execution via AS…

Apr 7, 2026
High max 7.0

RLSA-2026:6285 1 CVE

Important: python3.12 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

Apr 7, 2026
High max 10.0

RLSA-2026:6188 39 CVEs

Important: thunderbird security update

Mozilla Thunderbird is a standalone mail and newsgroup client. Security Fix(es): * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) * firefox: thunderbird: Memory safety bugs fixed in Firefox ESR 115.34, Firefox ESR 140.…

Apr 7, 2026
Medium max 6.6

RLSA-2026:5602 1 CVE

Moderate: vim security update

Vim (Vi IMproved) is an updated and improved version of the vi editor. Security Fix(es): * vim: Vim: Arbitrary code execution via 'helpfile' option processing (CVE-2026-25749) For more details about the security issue(s), including the impact, a CVSS score, a…

Apr 7, 2026
High max 7.0

RLSA-2026:6286 1 CVE

Important: python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

Apr 7, 2026
High max 10.0

RLSA-2026:5930 37 CVEs

Important: firefox security update

Mozilla Firefox is an open-source web browser, designed for standards compliance, performance, and portability. Security Fix(es): * firefox: thunderbird: Use-after-free in the JavaScript Engine component (CVE-2026-4701) * firefox: thunderbird: Memory safety b…

Apr 7, 2026
High max 9.3

RLSA-2026:6340 13 CVEs

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP heap-use-af…

Apr 7, 2026
Medium

RLSA-2026:6266 1 CVE

Moderate: libxslt security update

libxslt is a library for transforming XML files into other textual formats (including HTML, plain text, and other XML representations of the underlying data) using the standard XSLT stylesheet transformation mechanism. Security Fix(es): * libxslt: Processing …

Apr 7, 2026
Medium max 4.3

RLSA-2026:6390 1 CVE

Moderate: rsync security update

The rsync utility enables the users to copy and synchronize files locally or across a network. Synchronization with rsync is fast because rsync only sends the differences in files over the network instead of sending whole files. The rsync utility is also used…

Apr 7, 2026
High max 7.8

RLSA-2026:5942 2 CVEs

Important: golang security update

The golang packages provide the Go programming language compiler. Security Fix(es): * cmd/go: cmd/go: Arbitrary file write via malicious pkg-config directive (CVE-2025-61731) * net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679) For m…

Apr 7, 2026
Medium max 7.8

RLSA-2026:6037 3 CVEs

Moderate: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: Use-After-Free vulnerability in ATM subsystem (CVE-2025-38180) * kernel: macvlan: fix error recovery in macvlan_common_newlink() (C…

Apr 7, 2026
High max 7.0

RLSA-2026:6281 1 CVE

Important: python3.11 security update

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to vario…

Apr 7, 2026
Medium max 5.3

RLSA-2026:5585 2 CVEs

Moderate: gnutls security update

The gnutls packages provide the GNU Transport Layer Security (GnuTLS) library, which implements cryptographic algorithms and protocols such as SSL, TLS, and DTLS. Security Fix(es): * gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function (…

Apr 7, 2026
Medium max 5.9

RLSA-2026:5581 1 CVE

Moderate: nginx:1.24 security update

nginx is a web and proxy server supporting HTTP and other protocols, with a focus on high concurrency, performance, and low memory usage. Security Fix(es): * nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied connections (CVE-2026-1642) …

Apr 7, 2026
High max 8.8

RLSA-2026:6005 2 CVEs

Important: freerdp security update

FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox. Security Fix(es): * freerdp: FreeRDP: Arbitrary …

Apr 7, 2026