pipewire security update

1.4.11-1.2 - CVE-2026-14330 pipewire: Pulse Server alloca Stack Overflow Resolves: RHEL-296741...

util-linux security update

2.40.2-18.0.1.el102.20 - fix -d -t output regression OLDIS-51984 2.40.2-20 - libblkid: validate EBR data CVE-2026-53615 2.40.2-19 - libmount and blkid security fixes - libblkid: fix use-after-free in nested partition probing CVE-2026-13595 - nsenter: close cgroup.procs fd after join to prevent...

kernel security, bug fix, and enhancement update

6.12.0-211.72.1 - Add new Oracle Linux Driver Signing key 1 certificate Orabug: 37985782 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list...

kernel security update

4.18.0-553.182.1 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

glibc security update

2.39-145.0.1 - Forward port Oracle chnages to 2.39-145. Oracle history: Sep-01-2026 Jose E. Marchesi - 2.39-128.0.1 - Forward port Oracle changes to 2.39-128. - Reviewed-by: Elena Zannoni Jul-15-2026 Cupertino Miranda - 2.39-126.0.1 - Forward port Oracle changes to 2.39-126. - Reviewed-by: Jose E...

libXi security update

1.7.10-8.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293452 1.7.10-8.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293398...

libXi security update

1.8.1-7.3 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293447 1.8.1-7.2 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293391...

grafana security update

10.2.6-23.7 - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting - Resolves RHEL-290771 10.2.6-23.6 - Rebuild against updated golang - Resolves RHEL-287510 - Resolves RHEL-279380 - Resolves RHEL-279012 - Resolves RHEL-278733 10.2.6-23.5 - Resolves RHEL-25315...

python-pillow security update

5.1.1-36 - CVE-2026-112900 python-pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE Resolves: RHEL-295960 5.1.1-35 - CVE-2026-112398 python-pillow: Pillow: Heap buffer overflow in FlashPix FPX JPEG decoding leads to code execution Resolves: RHEL-294549 5.1.1-34 ...

Unbreakable Enterprise kernel security update

5.15.0-326.222.4 - rtnetlink: advertise allmulti counter Nicolas Dichtel Orabug: 40234417 5.15.0-326.222.3 - vhost-scsi: fix page reference leak in misaligned I/O fallback Jia Jia Orabug: 40193939 - vhost-scsi: zero misaligned I/O bounce pages Shubham Antil Orabug: 40193939 - KVM: x86: Use active...

podman security update

5.8.2-12.0.1 - Drop nmap-ncat requirement and skip ignore-socket test case Orabug: 34117404 7:5.8.2-12 - update to the latest upstream commit aae8b839 - fixes CVE-2025-11395 - Resolves: RHEL-119569...

tomcat security update

1:9.0.121-1 - Resolves: RHEL-255800 tomcat: Security constraint bypass due to improper access control CVE-2026-65182 - Resolves: tomcat: Local information disclosure via Unix domain socket TOCTOU race condition CVE-2026-65183 - Resolves: RHEL-271827 tomcat: Improper Input Validation allows HTTP/2...

Unbreakable Enterprise kernel security update

5.4.17-2136.361.4 - vhost-scsi: zero misaligned I/O bounce pages Shubham Antil Orabug: 40193932 5.4.17-2136.361.3 - KVM: x86: Use active memslots for the per-vCPU MMIO cache Jinu Kim Orabug: 40180571 - drbd: fix 'LOGIC BUG' in drbdalbeginiononblock Lars Ellenberg Orabug: 39130967 CVE-2026-23356 -...

bind9.16 security update

32:9.16.23-0.22.21 - CVE-2026-94300 bind9.16: bind: Arbitrary code execution via GSS-TSIG UDP message replay 32:9.16.23-0.22.20 - CVE-2026-97313 bind9.16: bind: Denial of service via assertion failure in RPZ query processing 32:9.16.23-0.22.19 - CVE-2026-96888 bind9.16: bind: Denial of Service vi...

glibc security, bug fix, and enhancement update

2.34-283.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Kris Van Hees Oracle history: August-03-2026 Cupertino Miranda - 2.34-275.0.1 - Forward-port Oracle patches for ol9-u8 Reviewed-by: Jose E. Marchesi July-22-2026 Cupertino Miranda - 2.34-274.0.1 - Forward-port Oracle patches for...

bind security, bug fix, and enhancement update

32:9.11.36-18 - CVE-2026-94300 bind: bind: Arbitrary code execution via GSS-TSIG UDP message replay 32:9.11.36-17 - CVE-2026-19630 bind: BIND: Denial of Service via unbounded processing of crafted DNS messages processing of crafted DNS messages 32:9.11.36-16.17 - Backport additional checks for th...

qt5-qtbase security update

5.15.3-10 - Fix CVE-2026-19248: unbounded recursion and ON2 behavior in QDom Resolves: RHEL-261130 - Fix CVE-2026-11573: denial of services via uncontrolled recursion in XML serialization Resolves: RHEL-277662...

kernel security, bug fix, and enhancement update

5.14.0-687.64.1 - Disable UKI signing Orabug: 36571828 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug:...

freerdp security update

2:2.11.7-7.9 - Backport several CVE fixes CVE-2026-109242, CVE-2026-110837, CVE-2026-111880 Resolves: RHEL-282296, RHEL-283722, RHEL-286609...

java-17-openjdk security update for RHEL 9

1:17.0.21.0.9-2.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:17.0.21.0.9-2.2 - Set rpmrelease to 2 for PQC signing 1:17.0.21.0.9-2.1 - Set portablerelease to 2 for new final portable - Set rpmrelease to 1 - Update sources to new final tarball for jdk-17.0.21+9 GA - Update NEWS with CVE li...

bind security update

9.16.23-40.0.1.el98.13 - Fix warning when changing device file permissions Orabug: 36518580 32:9.16.23-40.13 - Fix CVE-2026-94300: Arbitrary code execution via GSS-TSIG UDP message replay. - Fix CVE-2026-97313: Denial of Service via assertion failure in RPZ query processing. - Fix CVE-2026-96888:...

brotli security update

1.0.9-10.0.1 - Fix out-of-bounds write in the Brotli decoder CVE-2026-111497...

grafana security update

10.2.6-28.9 - Rebuild against updated golang - Resolves RHEL-290737 10.2.6-28.9 - CVE-2026-17183 grafana: Grafana: Information disclosure vulnerability in Unified Alerting in Unified Alerting - Resolves RHEL-290765 10.2.6-28.8 - Rebuild against updated golang - Resolves RHEL-287475 - Resolves...

wireshark security update

1:2.6.2-22 - DoS via heap-based buffer overflow in SPDY dissector CVE-2026-95387 - Resolves: RHEL-272318...

.NET 10.0 security, bug fix, and enhancement update

10.0.114-1.0.1 - Add support for Oracle Linux 10.0.114-1 - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291744...

libXi security update

1.7.10-4 - CVE-2026-109089 libXi: libXi: Arbitrary code execution via DEVICERESOLUTION heap-based buffer overflow Resolves: RHEL-293443 1.7.10-3 - CVE-2026-109090 libXi: libXi: Arbitrary code execution via oversized DEVICEENABLE reply Resolves: RHEL-293385...

thunderbird security, bug fix, and enhancement update

153.5.0-1.0.1 - Fix prefs for new nss Orabug: 37079813 - Add Oracle prefs 153.5.0-1 - Update to 153.5.0 ESR 140.16.0-1 - Update to 140.16.0 ESR 140.15.0-1 - Update to 140.15.0 ESR 140.14.0-1 - Update to 140.14.0 ESR 140.13.0-1 - Update to 140.13.0 ESR 140.12.0-1 - Update to 140.12.0 ESR 140.11.0-...

python-jwt security update

1.6.1-2.1 - Fix CVE-2026-32597 Resolves: RHEL-271640...

.NET 8.0 security, bug fix, and enhancement update

8.0.133-1.0.1 - Add support for Oracle Linux 8.0.133-1 - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291718...

httpd:2.4 security, bug fix, and enhancement update

httpd 2.4.37-65.0.1.8 - Replace index.html with Oracle's index page oracleindex.html 2.4.37-65.8 - Resolves: RHEL-173558 - httpd:2.4/httpd: Apache HTTP Server modproxyajp: Arbitrary code execution via heap-based buffer overflow CVE-2026-28780 - Resolves: RHEL-175074 - httpd:2.4/httpd: NULL pointe...

.NET 8.0 security, bug fix, and enhancement update

8.0.133-1.0.1 - Add support for Oracle Linux 8.0.133-1 - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: RHEL-291717...

nodejs:24 security, bug fix, and enhancement update

nodejs 1:24.21.0-1.0.1 - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging...

python-pillow security update

5.1.1-33 - CVE-2026-112892 python-pillow: pillow: Denial of Service via unbounded memory expansion in MSP image decoder Resolves: RHEL-290437 5.1.1-32 - CVE-2026-96640 python-pillow: pillow: Denial of Service via duplicate page references in PDF files Resolves: RHEL-289281 5.1.1-31 -...

bind9.18 security update

32:9.18.29-14.12 - Prevent arbitrary code execution via GSS-TSIG UDP message replay CVE-2026-94300 - Fix Denial of service via assertion failure in RPZ query processing CVE-2026-97313 - Prevent Denial of Service via assertion failure during redirect processing CVE-2026-96888 - Prevent Denial of...

nodejs:24 security, bug fix, and enhancement update

nodejs 1:24.21.0-1.0.1 - Fix out-of-bounds write in bundled Brotli decoder CVE-2026-111497 - Expose the decoder block-switch error and add regression coverage - Require the patched system Brotli for shared builds nodejs-nodemon nodejs-packaging...

gcc security update

8.5.0-30.0.1 - Merge Oracle patches to 8.5.0-30. Oracle history: August-26-2025 Qing Zhao 8.5.0-28.0.1 - Merge Oracle patches to 8.5.0-28. March-31-2025 Jose E. Marchesi 8.5.0-26.0.1 - Merge Oracle patches to 8.5.0-26. Reviewed-by: David Faust March-11 2025 Qing Zhao 8.5.0-24.0.1 - Merge Oracle...

.NET 10.0 security, bug fix, and enhancement update

10.0.114-1.0.1 - Add support for Oracle Linux 10.0.114-1 - Update to .NET SDK 10.0.114 and Runtime 10.0.14 - Resolves: RHEL-291745...

.NET 9.0 security, bug fix, and enhancement update

9.0.123-1.0.1 - Add support for Oracle Linux 9.0.123-1 - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291727...

java-1.8.0-openjdk security update

1.8.0.504.b01-1.0.1 - update to open-jdk 8u504-b01 GA Orabug: 39966086 - Security update for CVE-2026-60589 CVE-2026-61308 and CVE-2026-70907...

pki-deps:10.6 security update

apache-commons-collections apache-commons-lang 2.6-21 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild apache-commons-net bea-stax 1.2.0-16 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild glassfish-fastinfoset 1.2.13-9 - Regenerate BRs 1.2.13-8 - Rebuilt for...

.NET 9.0 security, bug fix, and enhancement update

9.0.123-1.0.1 - Add support for Oracle Linux 9.0.123-1 - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291728...

java-21-openjdk security update for RHEL 10

1:21.0.13.0.9-1.2.0.1 - Add Oracle vendor bug URL Orabug: 34340155 1:21.0.13.0.9-1.2 - Bump release for PQC build 1:21.0.13.0.9-1.1 - Update to jdk-21.0.13+9 GA - This tarball is embargoed until 2026-10-20 @ 1pm PT. - Update release notes to OpenJDK 21.0.13+9 - Update FIPS patch to ad9e4df7698...

.NET 8.0 security, bug fix, and enhancement update

8.0.133-1.0.1 - Add support for Oracle Linux 8.0.133-1 - Update to .NET SDK 8.0.133 and Runtime 8.0.33 - Resolves: -RHEL-291714...

.NET 9.0 security, bug fix, and enhancement update

9.0.123-1.0.1 - Add support for Oracle Linux 9.0.123-1 - Update to .NET SDK 9.0.123 and Runtime 9.0.22 - Resolves: RHEL-291723...

python-pyasn1 security update

0.1.9-7.0.3 - Fix CVE-2026-59886 Real float conversion Orabug: 39925524 0.1.9-7.0.1 - Fixes CVE-2026-23490 fixes potential memory exhaustion Orabug: 39060516...

tomcat security, bug fix, and enhancement update

1:10.1.49-5 - Resolves: RHEL-264918 tomcat: Stalled TLS handshake when the server's first flight is too large - Resolves: RHEL-255786 tomcat: Security constraint bypass due to improper access control CVE-2026-65182 - Resolves: RHEL-271888 tomcat: Authentication bypass via limited replay attack in...

aspell security update

12:0.60.8-9 - Backport fix for CVE-2026-103658...

cjose security update

0.6.1-17.2 - CVE-2026-53939 cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption Encryption Key for AES-CBC-HMAC JWE encryption Resolves: RHEL-287912...

webkit2gtk3 security update

2.54.2-0.1 - Update to 2.54.2...

ignition security update

2.26.0-3.0.1.4 - Drop RHCK specific module inclusion Orabug: 39718726 - Remove sgdisk requirement and create symbolic link to sgdisk Orabug: 37470782 2.26.0-4 - Rebuild ignition against updated golang 2.26.0-3 - Rebuild ignition against updated golang...