Oracle Linux 9 : kernel (ELSA-2026-54443)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54443 advisory. - net/sched: actapi: use RCU with deferred freeing for action lifecycle CKI Backport Bot RHEL-218181 CVE-2026-53264 Tenable has extracted the precedin...

Oracle Linux 9 : python-idna (ELSA-2026-54484)

The remote Oracle Linux 9 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2026-54484 advisory. 2.10-8 - Security fix for CVE-2026-45409 Resolves: RHEL-215653 Tenable has extracted the preceding description block directly from the Oracle Linux security...

RockyLinux 9 : php:8.2 (RLSA-2026:40416)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:40416 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.2.32 for...

RockyLinux 9 : kernel (RLSA-2026:54443)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54443 advisory. kernel: accel/ivpu: Fix signed integer truncation in IPC receive CVE-2026-53202 kernel: net/sched: actapi: use RCU with deferred freeing for action...

RockyLinux 9 : nghttp2 (RLSA-2026:54662)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:54662 advisory. nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests CVE-2026-58055 Tenable has extracted the...

Oracle Linux 9 : dracut (ELSA-2026-54571)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-54571 advisory. 057-120.git20260728.0.1 - Skip the default FIPS logic on special UEK kernels where the FIPS module is linked directly into the kernel. Orabug: 38705580 - Ship...

MiracleLinux 9 : pipewire-1.4.11-1.el9_8 (AXSA:2026-1540:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1540:02 advisory. pipewire: PipeWire: Sandbox escape and arbitrary code execution via malicious library loading CVE-2026-5674 Tenable has extracted the preceding description...

RockyLinux 9 : freerdp (RLSA-2026:54487)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async messa...

RockyLinux 9 : bind (RLSA-2026:54510)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:54510 advisory. bind9: bind: Potential wildcard CNAME RPZ policy bypass CVE-2026-11331 bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field...

Oracle Linux 9 : .NET / 8.0 (ELSA-2026-54574)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54574 advisory. 8.0.130-1.0.1 - Add support for Oracle Linux 8.0.130-1 - Update to .NET SDK 8.0.130 and Runtime 8.0.30 - Resolves: RHEL-235471 Tenable has extracted t...

AlmaLinux 9 : freerdp (ALSA-2026:54487)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:54487 advisory. FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files CVE-2026-64624 FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async messag...

Oracle Linux 9 : freerdp (ELSA-2026-54487)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-54487 advisory. 2:2.11.7-7.5 - Backport several CVE fixes CVE-2026-64624, CVE-2026-67289, CVE-2026-67299, CVE-2026-68580 Resolves: RHEL-213169, RHEL-222785,...

Oracle Linux 9 : iscsi-initiator-utils (ELSA-2026-53844)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-53844 advisory. - fix CVE-2026-44943: path traversal via IQN names in discovery - fix CVE-2026-44944: iscsiuio socket credential verification bypass - fix...

RockyLinux 9 : php:8.3 (RLSA-2026:48197)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:48197 advisory. php: PHP OpenSSL extension: Denial of Service due to buffer allocation flaw in AES-WRAP-PAD CVE-2026-14355 Bug Fixes and Enhancements: Rebase PHP to 8.3.32 for...

Moderate: Red Hat Security Advisory: nghttp2 security update

An update for nghttp2 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

bind: bind9: Unexpected exit with NSEC and NSEC3 both present

If a provably insecure domain is covered by both an NSEC and NSEC3 record at the parent, and there exist an RRSIG for only one of these types, then BIND may exit unexpectedly with an assertion while validating this proof...

Important: Red Hat Security Advisory: dracut security update

An update for dracut is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

python-idna security update

An update is available for python-idna. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Python is an interpreted, interactive, object-oriented programming...

bind: bind: Denial of Service via long query names in RPZ processing

A flaw was found in BIND. A remote attacker can send specially crafted, excessively long query names to a resolver configured with Response Policy Zones RPZ and wildcard policies. Improper handling of the resulting error condition can cause the service to terminate unexpectedly, leading to a Deni...

bind: bind: Denial of Service via long query names in RPZ processing

A flaw was found in BIND. A remote attacker can send specially crafted, excessively long query names to a resolver configured with Response Policy Zones RPZ and wildcard policies. Improper handling of the resulting error condition can cause the service to terminate unexpectedly, leading to a Deni...