Linux · Rocky Linux · Security advisory · July 13, 2026

RLSA-2026:38500: Security update for 23 packages

RLSA-2026:38500, released July 13, 2026, fixes 1 CVE across 23 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
1
None rated Critical
Exploited
0
None reported
Highest CVSS
8.8
Base score, 0 to 10
Highest EPSS
0.0069
52nd percentile

Fixed package versions

ProductReleaseFixed in
aopalliancerocky 90:1.0-51.module+el9.7.0+40002+8e3c44a9
apache-commons-clirocky 90:1.9.0-4.module+el9.7.0+40002+8e3c44a9
apache-commons-codecrocky 90:1.17.1-8.module+el9.7.0+40002+8e3c44a9
apache-commons-iorocky 91:2.16.1-9.module+el9.7.0+40002+8e3c44a9
atinjectrocky 90:1.0.5-14.module+el9.7.0+40002+8e3c44a9
google-guicerocky 90:5.1.0-23.module+el9.7.0+40002+8e3c44a9
guavarocky 90:33.3.0-5.module+el9.7.0+40002+8e3c44a9
httpcomponents-clientrocky 90:4.5.14-21.module+el9.7.0+40002+8e3c44a9
httpcomponents-corerocky 90:4.4.16-21.module+el9.7.0+40002+8e3c44a9
jakarta-annotationsrocky 90:1.3.5-38.module+el9.7.0+40002+8e3c44a9
jansirocky 90:2.4.1-12.module+el9.7.0+40002+8e3c44a9
jsr-305rocky 90:3.0.2-36.module+el9.7.0+40002+8e3c44a9
mavenrocky 91:3.9.9-13.module+el9.8.0+40095+a2161487
maven-resolverrocky 91:1.9.22-6.module+el9.7.0+40002+8e3c44a9
maven-shared-utilsrocky 90:3.4.2-19.module+el9.7.0+40002+8e3c44a9
maven-wagonrocky 90:3.5.3-17.module+el9.7.0+40002+8e3c44a9
plexus-cipherrocky 90:2.0-25.module+el9.7.0+40002+8e3c44a9
plexus-classworldsrocky 90:2.8.0-9.module+el9.7.0+40002+8e3c44a9
plexus-containersrocky 90:2.2.0-10.module+el9.7.0+40002+8e3c44a9
plexus-interpolationrocky 90:1.27-10.module+el9.7.0+40002+8e3c44a9
plexus-sec-dispatcherrocky 90:2.0-28.module+el9.7.0+40002+8e3c44a9
sisurocky 91:0.9.0~M3-7.module+el9.7.0+40002+8e3c44a9
slf4jrocky 90:1.7.36-9.module+el9.7.0+40002+8e3c44a9

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2025-67030 Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642. This allows an attacker to execute arbitrary code8.8 0.0069 None reported
Showing 1 to 1 of 1 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.