Linux · 
Oracle Linux · Security advisory · November 7, 2026
Oracle Linux · Security advisory · November 7, 2026ELSA-2026-604898: Security update for 2 packages
ELSA-2026-604898, released November 7, 2026, fixes 38 CVEs across 2 products. None of them is reported as exploited. Patch Radar priority: High.
High
CVEs closed
38
None rated Critical
Exploited
0
None reported
Highest CVSS
7.5
Base score, 0 to 10
Highest EPSS
0.0058
48th percentile
Priority of the 38 CVEs
Patch now 0
Urgent 0
High 18
Routine 20
Fixed package versions
| Product | Release | Fixed in |
|---|---|---|
| python39-oci-sdk | ol 9 | 0:2.187.0-1.0.5.el9 |
| python39-oci-sdk-docs | ol 9 | 0:2.187.0-1.0.5.el9 |
CVEs this fix closes
| Priority | CVE | Title | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|
| High | CVE-2025-69223 | python-aiohttp: Fixed aiohttp HTTP Parser auto_decompress feature susceptible to zip bomb (bsc#1256017). | 7.5 | 0.0058 | None reported |
| High | CVE-2026-54277 | python-aiohttp: `max_line_size` bypass when using the optimised C HTTP parser can lead to excessive resource | 7.5 | 0.0056 | None reported |
| High | CVE-2026-54274 | python-aiohttp: incomplete websocket frame payloads can bypass memory use limits and cause a DoS via excessive | 7.5 | 0.0054 | None reported |
| High | CVE-2026-50269 | python-aiohttp: improper validation of user-controlled strings allows for CRLF injection in multipart headers | 7.5 | 0.0053 | None reported |
| High | CVE-2026-69244 | python-aiohttp: out-of-bounds heap read in the C response parser while building an error message for a malformed | 7.5 | 0.0053 | None reported |
| High | CVE-2026-54273 | python-aiohttp: no limit in the HTTP/1 pipelined request queue can lead to excessive resource consumption | 7.5 | 0.0049 | None reported |
| High | CVE-2026-54278 | python-aiohttp: unread compressed request bodies can bypass `client_max_size` during cleanup and cause a DoS | 7.5 | 0.0049 | None reported |
| High | CVE-2026-54279 | python-aiohttp: host-only cookies become domain cookies after `CookieJar` persistence (bsc#1268560). | 7.5 | 0.0049 | None reported |
| High | CVE-2026-54275 | python-aiohttp: `server_hostname` TLS SNI check bypass when an existing connection is reused (bsc#1268549). | 7.5 | 0.0047 | None reported |
| High | CVE-2026-34513 | python3-aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python | 7.5 | 0.0046 | None reported |
| High | CVE-2026-69243 | python-aiohttp: HTTP request smuggling via the WebSocket upgrade procedure (bsc#1273553). | 7.0 | 0.0044 | None reported |
| High | CVE-2026-111066 | python39-oci-sdk: ELSA-2026-604898: python-oci-sdk security update (IMPORTANT) | 7.5 | 0.0041 | None reported |
| High | CVE-2025-69228 | python-aiohttp: Fixed denial of service through large payloads (bsc#1256022). | 7.5 | 0.0041 | None reported |
| High | CVE-2026-111064 | python39-oci-sdk: ELSA-2026-604898: python-oci-sdk security update (IMPORTANT) | 7.5 | 0.0040 | None reported |
| High | CVE-2025-69227 | python-aiohttp: Fixed DoS when bypassing asserts (bsc#1256021). | 7.5 | 0.0040 | None reported |
| High | CVE-2025-53643 | python-aiohttp: request smuggling vulnerability due to incorrect parsing trailer sections of an HTTP request | 7.5 | 0.0036 | None reported |
| High | CVE-2026-34993 | python-aiohttp: loading untrusted input in `CookieJar.load()` can lead to arbitrary code execution (bsc#1267471). | 7.3 | 0.0018 | None reported |
| High | CVE-2026-47265 | python-aiohttp: cookies set with the `cookies` parameter on requests are sent after following a cross-origin redirect | 7.5 | 0.0015 | None reported |
| Routine | CVE-2026-59881 | python-aiohttp: excessive resource consumption due to WebSocket client accepting compressed frames without negotiated | 5.3 | 0.0052 | None reported |
| Routine | CVE-2026-34520 | python-aiohttp: improper character handling by C parser can lead to header injection (bsc#1261335). | 3.7 | 0.0048 | None reported |
| Routine | CVE-2026-22815 | python3-aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python | 5.3 | 0.0046 | None reported |
| Routine | CVE-2026-34516 | python3-aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python | 5.3 | 0.0046 | None reported |
| Routine | CVE-2026-104874 | python39-oci-sdk: ELSA-2026-604898: python-oci-sdk security update (IMPORTANT) | 5.3 | 0.0045 | None reported |
| Routine | CVE-2025-69229 | python-aiohttp: Fixed DoS through chunked messages (bsc#1256023). | 5.8 | 0.0040 | None reported |
| Routine | CVE-2026-34517 | python-aiohttp: large multipart form fields read into memory without size check can cause a denial of service | 5.3 | 0.0040 | None reported |
Showing 1 to 25 of 38
1Next
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.