grafana security update

10.2.6-22 - Resolves RHEL-161803: CVE-2026-27877 - Resolves RHEL-166678: CVE-2026-32282 - Resolves RHEL-167678: CVE-2026-32283...

jmc security update

8.2.0-5 - Remove the websocket plugin. Related: RHEL-168615 8.2.0-4 - Bump LZ4 Version to 1.10.2. Related: RHEL-135478...

dovecot security update

1:2.3.16-18 - rebuild 1:2.3.16-17 - fix CVE-2026-27858: denial of service via crafted message before authentication RHEL-161640 - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command RHEL-162288 - fix CVE-2026-27857: denial of service via...

rsync security update

3.2.5-7.2 - Fix integer overflow in compressed-token decoding CVE-2026-43618 - Resolves: RHEL-174932 3.2.5-7.1 - Fix TOCTOU symlink race in daemon no-chroot mode CVE-2026-29518 - Resolves: RHEL-174952 3.2.5-4 - Resolves: RHEL-104404 - Do not clear DISPLAY unconditionally...

python3.14-urllib3 security update

2.6.3-2 - Security fix for CVE-2026-44431 and CVE-2026-44432 - Resolves: RHEL-184902 - Resolves: RHEL-185127...

tomcat security update

1:9.0.117-1 - Resolves: RHEL-150714 Certificate revocation bypass due to improper OCSP response validation - Resolves: Tomcat: OCSP checks sometimes soft-fail with FFM even when soft-fail is disabled CVE-2026-34500 - Resolves: Tomcat: Cloud membership for clustering component exposed the Kubernet...

postfix security update

2:3.5.25-3 - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code. Resolves: RHEL-176550...

expat security update

2.5.0-6.1 - Fix CVE-2026-45186 - Resolves: RHEL-177988...

firefox security update

140.12.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079773 - Add firefox-oracle-default-prefs.js and remove the corresponding Red Hat file 140.12.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.12.0-1 - Update to 140.12.0 ESR...

samba security update

0:4.23.5-10 - Bump build number 0:4.23.5-9 - Security release for CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 CVE-2026-4480 CVE-2026-40170 CVE-2026-4408 - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba: various flaws - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba...

webkit2gtk3 security update

2.52.4-1 - Update to 2.52.4...

redis:7 security update

7.2.14-1.0.1 - Build with 64k pages to support redis on UEK on aarch64 7.2.14-1 - rebase to 7.2.14 for CVE-2026-23479 CVE-2026-25243 CVE-2026-23631...

xorg-x11-server-Xwayland security, bug fix, and enhancement update

24.1.9-4.2 - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184292 24.1.9-4.1 - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Resolves:...

libtasn1 security update

4.16.0-10 - Backport the fix for CVE-2025-13151 RHEL-139568...

podman security update

5.8.2-3.0.1 - Rework CNI/Netavark detection logic JIRA: EVG-3769 - Rebuild on new golang to support experimental GODEBUG fipsnoenforceems - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 6:5.8.2-3 - Rebuild for CVE-2026-32283 - Resolves: RHEL-167685 6:5.8.2-2 - Rebui...

grafana-pcp security update

5.1.1-15 - Resolves RHEL-166679: CVE-2026-32282 - Resolves RHEL-167679: CVE-2026-32283...

mod_http2 security update

2.0.26-6.1 - Resolves: RHEL-182417 - modhttp2: HTTP/2: Remote Denial of Service via compression bomb and Slowloris-style attack CVE-2026-49975 2.0.26-6 - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory Increase CVE-2025-53020...

jq security update

1.6-19.2 - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions - Resolves: RHEL-168185 1.6-19.1 - Fix CVE-2026-39979 out-of-bounds read in jvparsesized - Resolves: RHEL-168202...

.NET 10.0 security update

10.0.109-1.0.1 - Add support for Oracle Linux 10.0.109-1 - Update to .NET SDK 10.0.109 and Runtime 10.0.9 - Resolves: RHEL-181558 10.0.108-1 - Update to .NET SDK 10.0.108 and Runtime 10.0.8 - Resolves: RHEL-173910...

.NET 9.0 security update

9.0.118-1.0.1 - Add support for Oracle Linux 9.0.118-1 - Update to .NET SDK 9.0.118 and Runtime 9.0.17 - Resolves: RHEL-181553 9.0.117-1 - Update to .NET SDK 9.0.117 and Runtime 9.0.16 - Resolves: RHEL-173918...

libxslt security update

1.1.34-14.0.1.el98.1 - Fix memory leak in exclPrefixPush Orabug: 37871881 - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball 1.1.34-14.1 - Fix CVE-2025-10911 RHEL-171991 1.1.34-14.1 - Fix upgrade path for CVE-2023-40403 RHEL-82213 1.1.34-12.1 - Fix CVE-2023-40403...

openexr security update

3.1.1-3.2 - fix CVE-2026-34588...

unbound security update

1.24.2-3.1 - Fix CVE-2026-33278 RHEL-177822 Fix CVE-2026-42944 RHEL-177936 Fix CVE-2026-42959 RHEL-177797 1.24.2-3 - Install correct trust anchor source in Image Mode RHEL-127540...

fence-agents security update

4.10.0-110.3 - bundled PyJWT: upgrade to v2.13.0 to fix CVE-2026-48526 Resolves: RHEL-182313 4.10.0-110.2 - bundled pyasn1: fix CVE-2026-30922 Resolves: RHEL-157202 4.10.0-110.1 - bundled cryptography: replace with dependency to fix CVE-2026-26007 - bundled PyJWT: upgrade to v2.12.1 to fix...

evince security update

40.5-4.el98.1 - Sanitize arguments CVE-2026-46529 - Resolves: RHEL-184047...

libexif security update

0.6.22-6.1 - Fix integer underflow in MakerNote decoding CVE-2026-40386 - Fix integer overflow in Nikon MakerNote handling CVE-2026-40385 Resolves: RHEL-170253, RHEL-170234...

freerdp security update

2:2.11.7-7.3 - Lock appWindow to fix use-after-free in RAIL mode CVE-2026-25952 Resolves: RHEL-159860 2:2.11.7-7.2 - Fix double free in xfrailwindowcommon cleanup CVE-2026-26986 - Fix growth of preallocated buffers CVE-2026-27951 - Fix heap-buffer-overflow in bitmapcacheput CVE-2026-29775 - Add D...

poppler security update

21.01.0-24.el98.1 - Fix integer overflow in tilingPatternFill CVE-2026-10118 - Resolves: RHEL-180580...

kernel security, bug fix, and enhancement update

4.18.0-553.136.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

firefox security update

140.12.0-1.0.1 - Fix firefox-oracle-default-prefs.js for new nss Orabug: 37079789 - diable wasisdk to prevent build failure with newer llvm 140.12.0 - Add debranding patches Mustafa Gezen - Add OpenELA default preferences Louis Abel 140.12.0-1 - Update to 140.12.0 ESR...

libpq security update

13.23-2 - Backport fixes for CVE-2026-6478, CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473 from PostgreSQL 14.23 - Resolves: RHEL-179806...

redis:6 security update

6.2.22-1.0.1 - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 6.2.22-1 - rebase to 6.2.22 for CVE-2026-25243...

postgresql:15 security update

pgaudit 1.7.0-1 - Update to 1.7.0 - Support postgresql 15 - Related: 2128241 1.5.0-1 - Update to version 1.5.0 Related: 1855776 1.4.0-4 - Bump release for rebuild against libpq-12.1-3 1.4.0-3 - BuildRequires libpq-devel 1.4.0-2 - BuildRequires postgresql-server-devel 1.4.0-1 - Update to 1.4.0...

389-ds:1.4 security update

1.4.3.39-24 - Bump version to 1.4.3.39-24 - Resolves: RHEL-170278 - Memory leaks in syncrepl plugin during persistent search operations rhel-8.10.z - Resolves: RHEL-163375 - WARN - keys2idl - received NULL idl from indexreadextallids - Resolves: RHEL-159306 - ns-slapd crash in libdb possible memo...

openssl security update

1:1.1.1k-16 - Fix CVE-2026-45447: Heap Use-After-Free in OpenSSL PKCS7verify Resolves: RHEL-180978 - Fix CVE-2024-4741: Use After Free with SSLfreebuffers Resolves: RHEL-180983 1:1.1.1k-15 - Fix CVE-2025-69419: Arbitrary code execution due to out-of-bounds write in PKCS12 processing...

openssh security update

7.4p1-23.0.5 - Fix privilege escalation via scp legacy protocol when not in preserving file mode CVE-2026-35385Orabug: 39480251...

httpd:2.4 security update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

kernel security update

4.18.0-553.134.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

xorg-x11-server security, bug fix, and enhancement update

1.20.11-28.2 - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184289 1.20.11-28.1 - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263, CVE-2026-50264 Resolves:...

xorg-x11-server-Xwayland security, bug fix, and enhancement update

21.1.3-20.2 - Other security related fixes Resolves: https://redhat.atlassian.net/browse/RHEL-184293 21.1.3-20.1 - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258, CVE-2026-50259, CVE-2026-50260, CVE-2026-50261, CVE-2026-50262, CVE-2026-50263 Resolves:...

dracut security update

049-244.git20260529.0.1 - Refactor getucodefile Orabug: 36989953 - Revert the fixes for bugs 33676753 and 33888951 due to regressions Orabug: 35656614 - Fix typo in orabug33888951-dracut-Enable-the-code-to-create-ifcfg-file.patch Orabug: 35268918 - Enable the code to create ifcfg file Orabug:...

opencryptoki security update

3.22.0-3.3 - Resolves: RHEL-171558, Fix possible out-of-bounds access in BER decode functions...

hplip security update

3.18.4-13 - Fix more leaks in hpcups 3.18.4-12 - OSH fixes after CVE-2026-8631 3.18.4-11 - CVE-2026-8631 hplip: Arbitrary code execution and privilege escalation via integer overflow in hpcups 3.18.4-10 - CVE-2026-8632 hplip: Privilege escalation and arbitrary code execution via OS command...

libxslt security update

1.1.32-6.4.0.1 - Added libxslt-oracle-enterprise.patch and replaced doc/redhat.gif in tarball 1.1.32-6.4 - Fix CVE-2025-10911 RHEL-171739...

libpng12 security update

1.2.57-7 - fix CVE-2026-33416: use-after-free via pointer aliasing in pngsettRNS and pngsetPLTE RHEL-161345...

libpng15 security update

1.5.30-9 - fix CVE-2026-33416: use-after-free via pointer aliasing in pngsettRNS and pngsetPLTE RHEL-161346...

libxml2 security update

2.9.7-21.5 - Fix CVE-2024-34459 RHEL-36405...

Unbreakable Enterprise kernel security update

6.12.0-203.76.7.5 - uek-rpm: avoid final module link in early FIPS symvers pass Sherry Yang Orabug: 39563330 - netfilter: nftables: unconditionally bump set-nelems before insertion Pablo Neira Ayuso Orabug: 39562729 CVE-2026-23272 6.12.0-203.76.7.4 - net: bonding: fix use-after-free in...

postfix security update

2:3.5.8-8 - Fix for CVE-2026-43964: buffer over-read via malformed enhanced status code. Resolves: RHEL-176548...

rsync security update

3.1.3-27 - Integer overflow in compressed-token decoding CVE-2026-43618 - Resolves: RHEL-174951 3.1.3-26 - Resolves: RHEL-174950 - CVE-2026-29518 - TOCTOU symlink race in non-chrooted daemon modules...