Important: kernel-livepatch-6.12.83-113.160

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.83-113.160 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.18.35-68.127

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.18.35-68.127 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Medium: php8.3

Issue Overview: PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Affected Packages: php8.3 Issue Correction: Run dnf update php8.3 --releasever...

Important: kernel-livepatch-6.18.30-61.119

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.18.30-61.119 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Amazon Linux 2023 : python3.11, python3.11-devel, python3.11-idle (ALAS2023-2026-1953)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1953 advisory. When using the configparser module to write configuration filescontaining multi-line text values with carriage return characters \r theresulting file could be injected with unexpected keys and...

Amazon Linux 2023 : jackson-databind (ALAS2023-2026-1949)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1949 advisory. jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.13.0 until 2.14.0, a potential Denial-of-Service exists when attacker sends...

Amazon Linux 2 : unbound, --advisory ALAS2UNBOUND-1.17-2026-008 (ALASUNBOUND-1.17-2026-008)

The version of unbound installed on the remote host is prior to 1.17.0-2. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2UNBOUND-1.17-2026-008 advisory. NLnet Labs Unbound 1.19.1 up to and including version 1.25.0 has a vulnerability in the DNSSEC validator that...

Amazon Linux 2023 : php8.3, php8.3-bcmath, php8.3-cli (ALAS2023-2026-1961)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1961 advisory. PHP: Failure to setup TLS with a remote server can result in a remote DoS CVE-2026-12184 PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD...

Amazon Linux 2023 : golang-github-burntsushi-toml, golang-github-burntsushi-toml-devel (ALAS2023-2026-1978)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1978 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Amazon Linux 2023 : php8.5, php8.5-bcmath, php8.5-cli (ALAS2023-2026-1957)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1957 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

Amazon Linux 2023 : php8.4, php8.4-bcmath, php8.4-cli (ALAS2023-2026-1959)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2026-1959 advisory. PHP: ext/openssl: Memory corruption zendmmheap corrupted in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 Tenable has extracted the preceding description block directly from the tested product securi...

Amazon Linux 2023 : golist (ALAS2023-2026-1976)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1976 advisory. On Unix systems, opening a file in an os.Root improperly follows symlinks to locations outside of the Root when the final path component of the a path is a symbolic link and the path ends in /...

Important: libssh2

Issue Overview: libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation numattrs sizeoflibssh2publickeyattribute without bounds checking, so on 32-bit platforms the multiplication overflows to an undersized buffe...

Amazon Linux 2023 : libssh2, libssh2-devel (ALAS2023-2026-1966)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1966 advisory. libssh2 through 1.11.1 reads an attacker-controlled 32-bit attribute count from a publickey-subsystem response and uses it in the allocation numattrs sizeoflibssh2publickeyattribute without...

Amazon Linux 2023 : libXfont2, libXfont2-devel (ALAS2023-2026-1967)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1967 advisory. BitmapScaleBitmaps Integer Overflow Heap Buffer Overflow CVE-2026-56001 PCF Font Parsing Heap Buffer Overflow CVE-2026-56002 computeProps Property Buffer Heap Buffer Overflow CVE-2026-56003...

Amazon Linux 2023 : vim-common, vim-data, vim-default-editor (ALAS2023-2026-1940)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1940 advisory. Vim is an open source, command line text editor. Prior to 9.2.0653, the treecountwords function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it...

Important: kernel6.18

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: sctp: disable BH before calling udptunnelxmitskb CVE-2026-53070 In the Linux kernel, the following vulnerability has been resolved: bpf: Fix same-register dst/src OOB read and pointer leak in sockops CVE-2026-5307...

Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)

"It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-1968 advisory. In the Linux kernel, the following vulnerability has been resolved: mm/pagealloc: clear page-private in freepagesprepare CVE-2026-43303 In the Linux kernel, the following vulnerability has be...

Important: kernel-livepatch-6.1.176-220.358

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.1.176-220.358 Issue Correction: Please ensure you have live patching enabled. Run dnf update...

Important: kernel-livepatch-6.12.80-105.147

Issue Overview: In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path CVE-2026-53362 Affected Packages: kernel-livepatch-6.12.80-105.147 Issue Correction: Please ensure you have live patching enabled. Run dnf update...