Linux · Security advisory · July 13, 2026

ALSA-2026:38514: Security update for 2 packages

ALSA-2026:38514, released July 13, 2026, fixes 1 CVE across 2 products. None of them is reported as exploited. Patch Radar priority: High.

High

CVEs closed

None rated Critical

Exploited

None reported

Exploitation more likely

Vendor assessment

Highest EPSS

0.0069

52nd percentile

Fixed package versions

Product	Release	Fixed in
plexus-utils	almalinux 10	3.5.1-9.el10_2
plexus-utils-javadoc	almalinux 10	3.5.1-9.el10_2

CVEs this fix closes

Priority	CVE	Title	Impact	CVSS	EPSS	Exploitation
High	CVE-2025-67030	Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code		8.8	0.0069	None reported

Also fixes CVE-2025-67030

ELSA-2026-41948
ant-antlr, ant-apache-bcel, ant-apache-bsf and 416 more on ol 8
RLSA-2026:38796
plexus-utils on rocky 9
RLSA-2026:41948
ant, ant-contrib, antlr and 179 more on rocky 8
ALSA-2026:41948
ant, ant-antlr, ant-apache-bcel and 507 more on almalinux 8
ELSA-2026-40841
apache-commons-cli, apache-commons-codec, apache-commons-io and 28 more on ol 8
RHSA-2026:40841
guava, jakarta-annotations, maven-openjdk11 and 4 more on RHEL 8
RHSA-2026:41948
ant, ant-antlr, ant-apache-bcel and 507 more on RHEL 8
RLSA-2026:40841
guava, jakarta-annotations on rocky 8

Vendor advisory

https://osv.dev/vulnerability/ALSA-2026:38514

For tools and AI agents

This page as data: JSON · Markdown

Which servers are still behind?

Patchblox compares the installed package on every Linux machine against the fixed version for its release, including machines reported through Azure Update Manager.

Get a demo