Linux · Oracle Linux · Security advisory · January 29, 2026

ELSA-2026-1409: Security update for 31 packages

ELSA-2026-1409, released January 29, 2026, fixes 3 CVEs across 31 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Highest CVSS
8.2
Base score, 0 to 10
Highest EPSS
0.0070
53rd percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
apcu-panelol 90:5.1.23-1.module+el9.4.0+90261+af5cc950
phpol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-bcmathol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-cliol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-commonol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-dbaol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-dbgol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-develol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-embeddedol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-enchantol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-ffiol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-fpmol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-gdol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-gmpol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-intlol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-ldapol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-mbstringol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-mysqlndol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-odbcol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-opcacheol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-pdool 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-pecl-apcuol 90:5.1.23-1.module+el9.4.0+90261+af5cc950
php-pecl-apcu-develol 90:5.1.23-1.module+el9.4.0+90261+af5cc950
php-pecl-rrdol 90:2.0.3-4.module+el9.4.0+90261+af5cc950
php-pecl-xdebug3ol 90:3.2.2-2.module+el9.4.0+90261+af5cc950
php-pecl-zipol 90:1.22.3-1.module+el9.4.0+90261+af5cc950
php-pgsqlol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-processol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-snmpol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-soapol 90:8.2.30-1.module+el9.7.0+90777+7055ad44
php-xmlol 90:8.2.30-1.module+el9.7.0+90777+7055ad44

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2025-14180 apache2-mod_php8: This update for php8 fixes the following issues: Security fixes: - CVE-2025-14177: getimagesize() function may le...7.5 0.0070 None reported
High CVE-2025-14177 php-pecl-xdebug3: PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fix(es): * php: pgsq...7.5 0.0050 None reported
High CVE-2025-14178 php7-embed: This update for php7 fixes the following issues: Security fixes: - CVE-2025-14178: heap buffer overflow occurs in a...8.2 0.0046 None reported
Showing 1 to 3 of 3 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.