Linux · Security advisory · November 7, 2026

ELSA-2026-90909: Security update for 30 packages

ELSA-2026-90909, released November 7, 2026, fixes 3 CVEs across 30 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
3
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0065
51st percentile

Priority of the 3 CVEs

Patch now 0 Urgent 0 High 3 Routine 0

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsol 80:3.2.2-10.module+el8.10.0+90642+1ede0e5a
apache-commons-langol 80:2.6-21.module+el8.10.0+91095+797d7a50
apache-commons-netol 80:3.6-3.module+el8.10.0+90642+1ede0e5a
bea-stax-apiol 80:1.2.0-16.module+el8.10.0+91095+797d7a50
glassfish-fastinfosetol 80:1.2.13-9.module+el8.10.0+91095+797d7a50
glassfish-jaxb-apiol 80:2.2.12-8.module+el8.10.0+91095+797d7a50
glassfish-jaxb-coreol 80:2.2.11-12.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-runtimeol 80:2.2.11-12.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-txw2ol 80:2.2.11-12.module+el8.10.0+90642+1ede0e5a
jackson-annotationsol 80:2.21-1.module+el8.10.0+91095+797d7a50
jackson-coreol 80:2.21.4-1.module+el8.10.0+91095+797d7a50.3
jackson-databindol 80:2.21.4-1.module+el8.10.0+91095+797d7a50.1
jackson-jaxrs-json-providerol 80:2.21.4-1.module+el8.10.0+91095+797d7a50
jackson-jaxrs-providersol 80:2.21.4-1.module+el8.10.0+91095+797d7a50
jackson-module-jaxb-annotationsol 80:2.21.4-2.module+el8.10.0+91095+797d7a50
jakarta-commons-httpclientol 81:3.1-28.module+el8.10.0+91095+797d7a50
javassistol 80:3.18.1-8.module+el8.10.0+91095+797d7a50
javassist-javadocol 80:3.18.1-8.module+el8.10.0+91095+797d7a50
pki-servlet-engineol 81:9.0.62-1.module+el8.10.0+90642+1ede0e5a
relaxngDatatypeol 80:2011.1-7.module+el8.10.0+91095+797d7a50
slf4jol 80:1.7.25-4.module+el8.10.0+91095+797d7a50
slf4j-jdk14ol 80:1.7.25-4.module+el8.10.0+91095+797d7a50
stax-exol 80:1.7.7-8.module+el8.10.0+91095+797d7a50
velocityol 80:1.7-24.module+el8.10.0+90642+1ede0e5a
xalan-j2ol 80:2.7.1-38.module+el8.10.0+91095+797d7a50
xerces-j2ol 80:2.11.0-34.module+el8.10.0+90642+1ede0e5a
xml-commons-apisol 80:1.4.01-25.module+el8.10.0+91095+797d7a50
xml-commons-resolverol 80:1.2-26.module+el8.10.0+90642+1ede0e5a
xmlstreambufferol 80:1.5.4-8.module+el8.10.0+91095+797d7a50
xsomol 80:0-19.20110809svn.module+el8.10.0+91095+797d7a50

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2026-68498 jackson-core: StreamReadConstraints.maxNameLength (default 50,000 characters) is intended to bound how much memory a single JSON Ob... 7.5 0.0065 None reported
High CVE-2026-89425 pki-jackson-core: Core part of Jackson that defines Streaming API as well as basic shared abstractions 7.5 0.0053 None reported
High CVE-2026-91777 pki-jackson-databind: The general-purpose data-binding functionality and tree-model for Jackson Data Processor 7.5 0.0049 None reported
Showing 1 to 3 of 3 1