image-builder security update

72.0.0-1.0.2 - Rebuid to fix CVE-2026-32280, CVE-2026-32281, CVE-2026-33810, CVE-2026-33811, CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862...

osbuild-composer security update

101.5-1.0.1 - Bump to 101.5-1.0.1 - CVE-2026-32280 - CVE-2026-32282 - CVE-2026-32283 - CVE-2026-33186 - CVE-2026-34986...

freerdp security update

2:3.10.3-12.11 - Fix RPC gateway fragment size and capacity checks CVE-2026-55193 Resolves: RHEL-247346...

osbuild-composer security update

176-1.0.2 - Rebuild for CVE-2026-33810, CVE-2026-33818, CVE-2026-39820, CVE-2026-42499,CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862...

osbuild-composer security update

175-1.0.2 - Rebuild to fix CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862...

nginx security update

1.20.1-28.0.1.el98.6 - Reference oracle-indexhtml within Requires Orabug: 33802044 - Remove Red Hat references Orabug: 29498217 - Update upstream references Orabug: 36579090 2:1.20.1-28.6 - Resolves: RHEL-212458 - nginx: NGINX: Arbitrary code execution via crafted HTTP requests CVE-2026-42533...

gstreamer1-plugins-base security update

1.26.7-2.2 - Fix crash in RTSP auth credential parsing CVE-2026-85150 Resolves: RHEL-253746...

image-builder security update

72.0.0-1.0.2 - Rebuild to fix CVE-2026-32280, CVE-2026-32281, CVE-2026-33811, CVE-2026-33818, CVE-2026-39820, CVE-2026-39821, CVE-2026-42499, CVE-2026-42504, CVE-2026-56853, CVE-2026-56858, CVE-2026-56859, CVE-2026-56860, CVE-2026-56862...

python-lxml security update

4.6.5-3.1 - Security fix for CVE-2026-49825 - Resolves: RHEL-251499...

kernel security, bug fix, and enhancement update

6.12.0-211.53.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

httpd:2.4 security update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

coreutils security update

8.32-41.0.1.el98.1 - clean up empty file if cp is failed Orabug 15973168 8.32-41.1 - unexpand: fix CVE-2026-56392 and related crashes RHEL-216788 - fix direct.sh and unexpand/mb.sh tests - fix heap overflow with large tab stops - fix heap overflow when a wide blank overshoots a tab stop...

vim security update

9.1.083-9.0.1.el102.20 - Remove upstream references Orabug: 31197557 2:9.1.083-9.20 - RHEL-253668 CVE-2026-28420 buffer overflow in terminal emulator 2:9.1.083-9.19 - RHEL-215660 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes 2:9.1.083-9.18 - RHEL-215683 CVE-2026-59857 vim: stack...

vim security update

8.2.2637-26.0.1.el98.21 - Remove upstream references Orabug: 31197557 2:8.2.2637-26.21 - RHEL-253669 CVE-2026-28420 vim: buffer overflow in terminal emulator 2:8.2.2637-26.20 - RHEL-215664 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes 2:8.2.2637-26.19 - RHEL-215684 CVE-2026-59857...

apr-util security update

1.6.1-23.1 - Resolves: RHEL-236631 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 - Resolves: RHEL-236266 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 - Resolve...

kernel security, bug fix, and enhancement update

5.14.0-687.46.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

ansible-core security update

2.16.3-4 - Fix CVE-2026-11332 ansible-galaxy role installs could allow arbitrary git configuration injection via malformed role requirements RHEL-194126...

glib2 security update

2.56.4-178 - Fix CVE-2026-16118: heap-buffer-overflow in xdgmime magic parsing...

freerdp security update

2:2.11.7-7.7 - Fix RPC gateway fragment size and capacity checks CVE-2026-55193 Resolves: RHEL-247356...

perl-DBI security update

1.643-26.4 - Fix CVE-2026-19546: incomplete fix for CVE-2026-14380 in DBI::Profile Resolves: RHEL-236830...

389-ds:1.4 security, bug fix, and enhancement update

1.4.3.39-28 - Bump version to 1.4.3.39-28 - Resolves: RHEL-222326 - EMBARGOED CVE-2026-18453 389-ds:1.4/389-ds-base: 389-ds-base: pre-authentication NULL pointer dereference via paged results and USEONEBACKEND control in opsharedsearch rhel-8.10.z - Resolves: RHEL-220511 - EMBARGOED CVE-2026-1835...

glibc security update

2.39-128.0.1 - Forward port Oracle changes to 2.39-128. - Reviewed-by: Elena Zannoni Oracle history: Jul-15-2026 Cupertino Miranda - 2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E. Marchesi Jul-15-2026 Cupertino Miranda - 2.39-124.0.1 - Forward port Oracle changes t...

python3.12-lxml security update

4.9.3-2.1 - Fix CVE-2026-49825: add xlink:href to known HTML link attributes Resolves: RHEL-251488...

vim security update

8.0.1763-31.0.1.el810.7 - Remove upstream references Orabug: 31197557 - Added glibc-gconv-extra to common requires to provide ISO-8859-2 Orabug: 34114984 2:8.0.1763-31.7 - RHEL-253666 CVE-2026-28420 buffer overflow in terminal emulator 2:8.0.1763-31.6 - RHEL-215662 CVE-2026-55892 vim: stack...

gzip security update

1.9-15 - Fix the wrong date in the previous changelog message - There's an updated version of the CVE-2026-41992 fix Resolves: CVE-2026-41992 1.9-14 - Fix an issue with a temporary file creations when mktemp is missing 41991 - Fix a global buffer overflow vulnerability in the LZH decompression...

git-lfs security update

3.7.1-4.3 - Rebuild with updated golang - Resolves: RHEL-241575, RHEL-242274, RHEL-241799...

apr-util security update

1.6.3-23.1 - Resolves: RHEL-236629 - apr-util: Apache Portable Runtime Utility: Information disclosure via timing attack in password validation CVE-2025-49506 - Resolves: RHEL-236264 - apr-util: Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client CVE-2026-34502 - Resolve...

kernel security update

5.14.0-687.45.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

postgresql16-postgis security update

3.5.3-4.1 - Fix CVE-2026-73515: validate flatgeobuf input buffers before decoding...

kernel security, bug fix, and enhancement update

4.18.0-553.162.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

perl-DBI security update

1.643-9.5 - Use Module::Load for safer package loading in DBI::Profile CVE-2026-19546 Related: RHEL-236831...

python-urllib3 security update

1.10.2-7.0.3 - Backport fix for CVE-2025-66471 Orabug: 39233228...

redis:7 security update

7.2.16-1.0.1 - Build with 64k pages to support redis on UEK on aarch64 7.2.16-1 - rebase to 7.2.16 for CVE-2026-66373 and backport CVE-2026-72568...

qt5-qtbase security update

5.15.3-9 - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName Resolves: RHEL-247206...

qt6-qt5compat security update

6.10.1-1.1 - Fix out-of-bounds read in QTextCodec::codecForName CVE-2026-9499 Resolves: RHEL-247204...

gpsd-minimal security update

3.26.1-2.0.1.el98.2 - Replaced upstream reference Orabug: 35865525 1:3.26.1-2.el98.2 - fix another command injection in gpsprof CVE-2026-60122...

thunderbird security update

140.14.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 140.14.0 - Add OpenELA debranding 140.14.0-1 - Update to 140.14.0 ESR...

buildah security update

1.43.1-6.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117178 2:1.43.1-6 - Rebuild for golang CVE fixes - Resolves: RHEL-229833 RHEL-241142 RHEL-241389 RHEL-241658 RHEL-241706 RHEL-242148 RHEL-251830...

gstreamer1-plugins-bad-free security update

1.10.4-4.0.5 - Security update for CVE-2026-59691 CVE-2026-59692 Orabug: 39878399 1.10.4-4.0.3 - Security update for CVE-2026-52720 CVE-2026-52722 Orabug: 39799399 1.10.4-4.0.1 - Security update for CVE-2026-3082 Orabug: 39199326...

python3.14-cryptography security update

45.0.4-5 - Security fixes for CVE-2026-69248 and CVE-2026-69249...

redis:6 security update

6.2.24-1.0.1 - Build with 64k pages to support redis on both UEK6 and UEK7 on aarch64 6.2.24-1 - rebase to 6.2.24 for CVE-2026-66373...

mrtg security update

2.17.7-1.1 - Fix CVE-2026-72694: symlink-following chown in PID file handling Resolves: RHEL-236037...

qt5-qtbase security update

5.15.9-11.1 - Fix CVE-2026-9499: out-of-bounds read in QTextCodec::codecForName Resolves: RHEL-247216...

expat security update

2.5.0-2.2 - Fix CVE-2026-56132: out-of-bound scaffolding index store in doProlog - Resolves: RHEL-221012 2.5.0-2.1 - Fix CVE-2026-50219 - Resolves: RHEL-220979...

kernel security, bug fix, and enhancement update

5.14.0-687.44.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

git-lfs security update

3.7.1-7 - Rebuild with new Golang 3.7.1-6 - Rebuild with new Golang...

gpsd security update

3.26.1-3.0.1.el102.2 - Replace upstream reference Orabug: 37033219 1:3.26.1-3.el102.2 - fix another command injection in gpsprof CVE-2026-60122...

xmlrpc-c security update

1.51.0-11.1 - Fix HTML injection in Abyss HTTP server responses CVE-2026-15928...

xz security update

1:5.6.2-4.1 - Fix: a buffer overflow in lzmaindexappend - Add test for the issue above needs a special build config to actually fail - does not fail in our environemnt - Resolves: CVE-2026-34743...

skopeo security update

2:1.22.2-5 - Rebuild for golang CVE fixes - Resolves: RHEL-241177 RHEL-241425 RHEL-241563 RHEL-241763 RHEL-242151 RHEL-251832 2:1.22.2-4 - re-add test file installation to fix tier0 tests 2:1.22.2-3 - Rebuild for CVE-2026-27145...