Linux · Oracle Linux · Security advisory · July 1, 2026

ELSA-2026-33722: Security update for 32 packages

ELSA-2026-33722, released July 1, 2026, fixes 5 CVEs across 32 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Highest CVSS
9.1
Base score, 0 to 10
Highest EPSS
0.0083
57th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 5 Routine 0

Fixed package versions

ProductReleaseFixed in
aardvark-dnsol 82:1.10.1-2.module+el8.10.0+90937+f3690799
buildahol 82:1.33.14-3.module+el8.10.0+90937+f3690799
buildah-testsol 82:1.33.14-3.module+el8.10.0+90937+f3690799
cockpit-podmanol 80:84.1-1.module+el8.10.0+90937+f3690799
conmonol 83:2.1.10-1.module+el8.10.0+90937+f3690799
container-selinuxol 82:2.229.0-2.module+el8.10.0+90937+f3690799
containernetworking-pluginsol 81:1.4.0-8.module+el8.10.0+90937+f3690799
containers-commonol 82:1-82.0.1.module+el8.10.0+90937+f3690799
critol 80:3.18-5.module+el8.10.0+90937+f3690799
criuol 80:3.18-5.module+el8.10.0+90937+f3690799
criu-develol 80:3.18-5.module+el8.10.0+90937+f3690799
criu-libsol 80:3.18-5.module+el8.10.0+90937+f3690799
crunol 80:1.14.3-2.module+el8.10.0+90937+f3690799
fuse-overlayfsol 80:1.13-1.module+el8.10.0+90937+f3690799
libslirpol 80:4.4.0-2.module+el8.10.0+90937+f3690799
libslirp-develol 80:4.4.0-2.module+el8.10.0+90937+f3690799
netavarkol 82:1.10.3-1.module+el8.10.0+90937+f3690799
oci-seccomp-bpf-hookol 80:1.2.10-1.module+el8.10.0+90937+f3690799
podmanol 84:4.9.4-31.0.1.module+el8.10.0+90937+f3690799
podman-catatonitol 84:4.9.4-31.0.1.module+el8.10.0+90937+f3690799
podman-dockerol 84:4.9.4-31.0.1.module+el8.10.0+90937+f3690799
podman-gvproxyol 84:4.9.4-31.0.1.module+el8.10.0+90937+f3690799
podman-pluginsol 84:4.9.4-31.0.1.module+el8.10.0+90937+f3690799
podman-remoteol 84:4.9.4-31.0.1.module+el8.10.0+90937+f3690799
podman-testsol 84:4.9.4-31.0.1.module+el8.10.0+90937+f3690799
python3-criuol 80:3.18-5.module+el8.10.0+90937+f3690799
python3-podmanol 80:4.9.0-3.module+el8.10.0+90937+f3690799
runcol 84:1.2.9-4.module+el8.10.0+90937+f3690799
skopeool 82:1.14.6-2.module+el8.10.0+90937+f3690799
skopeo-testsol 82:1.14.6-2.module+el8.10.0+90937+f3690799
slirp4netnsol 80:1.2.3-1.module+el8.10.0+90937+f3690799
udicaol 80:0.2.6-21.module+el8.10.0+90937+f3690799

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2026-25679 Incorrect parsing of IPv6 host literals in net/url9.1 0.0083 None reported
High CVE-2026-34986 osbuild-composer: A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood9.1 0.0066 None reported
High CVE-2026-32283 Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls9.1 0.0063 None reported
High CVE-2026-32280 Unexpected work during chain building in crypto/x5099.1 0.0063 None reported
High CVE-2026-32281 Inefficient policy validation in crypto/x5099.1 0.0036 None reported
Showing 1 to 5 of 5 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.