Linux · Security advisory · July 20, 2026

ELSA-2026-40841: Security update for 31 packages

ELSA-2026-40841, released July 20, 2026, fixes 1 CVE across 31 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
1
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0069
52nd percentile

Fixed package versions

ProductReleaseFixed in
apache-commons-cliol 80:1.5.0-5.module+el8.10.0+90966+8bcb551f
apache-commons-codecol 80:1.15-8.module+el8.10.0+90966+8bcb551f
apache-commons-iool 81:2.11.0-3.module+el8.10.0+90966+8bcb551f
apache-commons-lang3ol 80:3.12.0-8.module+el8.10.0+90966+8bcb551f
atinjectol 80:1.0.5-5.module+el8.10.0+90966+8bcb551f
cdi-apiol 80:2.0.2-7.module+el8.10.0+90966+8bcb551f
google-guiceol 80:4.2.3-10.module+el8.10.0+90966+8bcb551f
guavaol 80:31.0.1-5.module+el8.10.0+90966+8bcb551f
httpcomponents-clientol 80:4.5.13-6.module+el8.10.0+90966+8bcb551f
httpcomponents-coreol 80:4.4.13-8.module+el8.10.0+90966+8bcb551f
jakarta-annotationsol 80:1.3.5-15.module+el8.10.0+90966+8bcb551f
jansiol 80:2.4.0-7.module+el8.10.0+90966+8bcb551f
jcl-over-slf4jol 80:1.7.32-5.module+el8.10.0+90966+8bcb551f
jsr-305ol 80:3.0.2-7.module+el8.10.0+90966+8bcb551f
mavenol 81:3.8.5-6.module+el8.10.0+90966+8bcb551f
maven-libol 81:3.8.5-6.module+el8.10.0+90966+8bcb551f
maven-openjdk11ol 81:3.8.5-6.module+el8.10.0+90966+8bcb551f
maven-openjdk17ol 81:3.8.5-6.module+el8.10.0+90966+8bcb551f
maven-openjdk21ol 81:3.8.5-6.module+el8.10.0+90966+8bcb551f
maven-openjdk8ol 81:3.8.5-6.module+el8.10.0+90966+8bcb551f
maven-resolverol 81:1.7.3-6.module+el8.10.0+90966+8bcb551f
maven-shared-utilsol 80:3.3.4-6.module+el8.10.0+90966+8bcb551f
maven-wagonol 80:3.5.1-3.module+el8.10.0+90966+8bcb551f
plexus-cipherol 80:2.0-3.module+el8.10.0+90966+8bcb551f
plexus-classworldsol 80:2.6.0-13.module+el8.10.0+90966+8bcb551f
plexus-containers-component-annotationsol 80:2.1.1-3.module+el8.10.0+90966+8bcb551f
plexus-interpolationol 80:1.26-13.module+el8.10.0+90966+8bcb551f
plexus-sec-dispatcherol 80:2.0-5.module+el8.10.0+90966+8bcb551f
plexus-utilsol 80:3.3.0-11.module+el8.10.0+90966+8bcb551f.1
sisuol 81:0.3.5-3.module+el8.10.0+90966+8bcb551f
slf4jol 80:1.7.32-5.module+el8.10.0+90966+8bcb551f

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2025-67030 Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code 8.8 0.0069 None reported
Showing 1 to 1 of 1 1