[El-errata] ELSA-2026-90909 Important: Oracle Linux 8 pki-deps:10.6 security update

Errata Announcements for Oracle Linux el-errata at oss.oracle.com
Tue Nov 3 14:42:19 UTC 2026 

Oracle Linux Security Advisory ELSA-2026-90909

http://linux.oracle.com/errata/ELSA-2026-90909.html

The following updated rpms for Oracle Linux 8 have been uploaded to the Unbreakable Linux Network:

x86_64:
apache-commons-collections-3.2.2-10.module+el8.10.0+90642+1ede0e5a.noarch.rpm
apache-commons-lang-2.6-21.module+el8.10.0+91095+797d7a50.noarch.rpm
apache-commons-net-3.6-3.module+el8.10.0+90642+1ede0e5a.noarch.rpm
bea-stax-api-1.2.0-16.module+el8.10.0+91095+797d7a50.noarch.rpm
glassfish-fastinfoset-1.2.13-9.module+el8.10.0+91095+797d7a50.noarch.rpm
glassfish-jaxb-api-2.2.12-8.module+el8.10.0+91095+797d7a50.noarch.rpm
glassfish-jaxb-core-2.2.11-12.module+el8.10.0+90642+1ede0e5a.noarch.rpm
glassfish-jaxb-runtime-2.2.11-12.module+el8.10.0+90642+1ede0e5a.noarch.rpm
glassfish-jaxb-txw2-2.2.11-12.module+el8.10.0+90642+1ede0e5a.noarch.rpm
jackson-annotations-2.21-1.module+el8.10.0+91095+797d7a50.noarch.rpm
jackson-core-2.21.4-1.module+el8.10.0+91095+797d7a50.3.noarch.rpm
jackson-databind-2.21.4-1.module+el8.10.0+91095+797d7a50.1.noarch.rpm
jackson-jaxrs-json-provider-2.21.4-1.module+el8.10.0+91095+797d7a50.noarch.rpm
jackson-jaxrs-providers-2.21.4-1.module+el8.10.0+91095+797d7a50.noarch.rpm
jackson-module-jaxb-annotations-2.21.4-2.module+el8.10.0+91095+797d7a50.noarch.rpm
jakarta-commons-httpclient-3.1-28.module+el8.10.0+91095+797d7a50.noarch.rpm
javassist-3.18.1-8.module+el8.10.0+91095+797d7a50.noarch.rpm
javassist-javadoc-3.18.1-8.module+el8.10.0+91095+797d7a50.noarch.rpm
pki-servlet-engine-9.0.62-1.module+el8.10.0+90642+1ede0e5a.noarch.rpm
relaxngDatatype-2011.1-7.module+el8.10.0+91095+797d7a50.noarch.rpm
slf4j-1.7.25-4.module+el8.10.0+91095+797d7a50.noarch.rpm
slf4j-jdk14-1.7.25-4.module+el8.10.0+91095+797d7a50.noarch.rpm
stax-ex-1.7.7-8.module+el8.10.0+91095+797d7a50.noarch.rpm
velocity-1.7-24.module+el8.10.0+90642+1ede0e5a.noarch.rpm
xalan-j2-2.7.1-38.module+el8.10.0+91095+797d7a50.noarch.rpm
xerces-j2-2.11.0-34.module+el8.10.0+90642+1ede0e5a.noarch.rpm
xml-commons-apis-1.4.01-25.module+el8.10.0+91095+797d7a50.noarch.rpm
xml-commons-resolver-1.2-26.module+el8.10.0+90642+1ede0e5a.noarch.rpm
xmlstreambuffer-1.5.4-8.module+el8.10.0+91095+797d7a50.noarch.rpm
xsom-0-19.20110809svn.module+el8.10.0+91095+797d7a50.noarch.rpm

aarch64:
apache-commons-collections-3.2.2-10.module+el8.10.0+90642+1ede0e5a.noarch.rpm
apache-commons-lang-2.6-21.module+el8.10.0+91095+797d7a50.noarch.rpm
apache-commons-net-3.6-3.module+el8.10.0+90642+1ede0e5a.noarch.rpm
bea-stax-api-1.2.0-16.module+el8.10.0+91095+797d7a50.noarch.rpm
glassfish-fastinfoset-1.2.13-9.module+el8.10.0+91095+797d7a50.noarch.rpm
glassfish-jaxb-api-2.2.12-8.module+el8.10.0+91095+797d7a50.noarch.rpm
glassfish-jaxb-core-2.2.11-12.module+el8.10.0+90642+1ede0e5a.noarch.rpm
glassfish-jaxb-runtime-2.2.11-12.module+el8.10.0+90642+1ede0e5a.noarch.rpm
glassfish-jaxb-txw2-2.2.11-12.module+el8.10.0+90642+1ede0e5a.noarch.rpm
jackson-annotations-2.21-1.module+el8.10.0+91095+797d7a50.noarch.rpm
jackson-core-2.21.4-1.module+el8.10.0+91095+797d7a50.3.noarch.rpm
jackson-databind-2.21.4-1.module+el8.10.0+91095+797d7a50.1.noarch.rpm
jackson-jaxrs-json-provider-2.21.4-1.module+el8.10.0+91095+797d7a50.noarch.rpm
jackson-jaxrs-providers-2.21.4-1.module+el8.10.0+91095+797d7a50.noarch.rpm
jackson-module-jaxb-annotations-2.21.4-2.module+el8.10.0+91095+797d7a50.noarch.rpm
jakarta-commons-httpclient-3.1-28.module+el8.10.0+91095+797d7a50.noarch.rpm
javassist-3.18.1-8.module+el8.10.0+91095+797d7a50.noarch.rpm
javassist-javadoc-3.18.1-8.module+el8.10.0+91095+797d7a50.noarch.rpm
pki-servlet-engine-9.0.62-1.module+el8.10.0+90642+1ede0e5a.noarch.rpm
relaxngDatatype-2011.1-7.module+el8.10.0+91095+797d7a50.noarch.rpm
slf4j-1.7.25-4.module+el8.10.0+91095+797d7a50.noarch.rpm
slf4j-jdk14-1.7.25-4.module+el8.10.0+91095+797d7a50.noarch.rpm
stax-ex-1.7.7-8.module+el8.10.0+91095+797d7a50.noarch.rpm
velocity-1.7-24.module+el8.10.0+90642+1ede0e5a.noarch.rpm
xalan-j2-2.7.1-38.module+el8.10.0+91095+797d7a50.noarch.rpm
xerces-j2-2.11.0-34.module+el8.10.0+90642+1ede0e5a.noarch.rpm
xml-commons-apis-1.4.01-25.module+el8.10.0+91095+797d7a50.noarch.rpm
xml-commons-resolver-1.2-26.module+el8.10.0+90642+1ede0e5a.noarch.rpm
xmlstreambuffer-1.5.4-8.module+el8.10.0+91095+797d7a50.noarch.rpm
xsom-0-19.20110809svn.module+el8.10.0+91095+797d7a50.noarch.rpm


SRPMS:
http://oss.oracle.com/ol8/SRPMS-updates/apache-commons-collections-3.2.2-10.module+el8.10.0+90642+1ede0e5a.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/apache-commons-lang-2.6-21.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/apache-commons-net-3.6-3.module+el8.10.0+90642+1ede0e5a.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/bea-stax-1.2.0-16.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/glassfish-fastinfoset-1.2.13-9.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/glassfish-jaxb-2.2.11-12.module+el8.10.0+90642+1ede0e5a.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/glassfish-jaxb-api-2.2.12-8.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/jackson-annotations-2.21-1.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/jackson-core-2.21.4-1.module+el8.10.0+91095+797d7a50.3.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/jackson-databind-2.21.4-1.module+el8.10.0+91095+797d7a50.1.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/jackson-jaxrs-providers-2.21.4-1.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/jackson-modules-base-2.21.4-2.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/jakarta-commons-httpclient-3.1-28.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/javassist-3.18.1-8.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/pki-servlet-engine-9.0.62-1.module+el8.10.0+90642+1ede0e5a.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/relaxngDatatype-2011.1-7.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/slf4j-1.7.25-4.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/stax-ex-1.7.7-8.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/velocity-1.7-24.module+el8.10.0+90642+1ede0e5a.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/xalan-j2-2.7.1-38.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/xerces-j2-2.11.0-34.module+el8.10.0+90642+1ede0e5a.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/xml-commons-apis-1.4.01-25.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/xml-commons-resolver-1.2-26.module+el8.10.0+90642+1ede0e5a.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/xmlstreambuffer-1.5.4-8.module+el8.10.0+91095+797d7a50.src.rpm
http://oss.oracle.com/ol8/SRPMS-updates/xsom-0-19.20110809svn.module+el8.10.0+91095+797d7a50.src.rpm

Related CVEs:

CVE-2026-68498
CVE-2026-89425
CVE-2026-91777




Description of changes:

apache-commons-collections
apache-commons-lang
[2.6-21]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

apache-commons-net
bea-stax
[1.2.0-16]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

glassfish-fastinfoset
[1.2.13-9]
- Regenerate BRs

[1.2.13-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

glassfish-jaxb
glassfish-jaxb-api
[2.2.12-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

jackson-annotations
[2.21-1]
- Rebase to version 2.21
- Resolves: RHEL-188291

jackson-core
[2.21.4-1.3]
- Fix patch order
- Resolves: RHEL-287959

[2.21.4-1.2]
- Fix CVE-2026-68498
- Resolves: RHEL-287959

[2.21.4-1.1]
- Fix CVE-2026-89425
- Resolves: RHEL-284419

jackson-databind
[2.21.4-1.1]
- Fix CVE-2026-91777
- Resolves: RHEL-284554

jackson-jaxrs-providers
[2.21.4-1]
- Rebase to upstream version 2.21.4
- Resolves: RHEL-188291

jackson-modules-base
[2.21.4-1]
- Update to version 2.21.4
- Resolves: RHEL-188291

jakarta-commons-httpclient
[1:3.1-28]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

javassist
[3.18.1-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

pki-servlet-engine
relaxngDatatype
[2011.1-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

slf4j
[0:1.7.25-4]
- Disallow EventData deserialization by default (CVE-2018-8088)
- Resolves rhbz#1549928

[0:1.7.25-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

stax-ex
[1.7.7-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

velocity
xalan-j2
[0:2.7.1-38]
- Update license of subpackages

[0:2.7.1-37]
- Remove BR on xml-stylebook

[0:2.7.1-36]
- Repack the tarball without binaries

[0:2.7.1-35]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

xerces-j2
xml-commons-apis
[1.4.01-25]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

xml-commons-resolver
xmlstreambuffer
[1.5.4-8]
- Avoid test dependencies

[1.5.4-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

xsom
[0-19.20110809svn]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

More information about the El-errata mailing list