ELSA-2026-85309

ELSA-2026-85309 - bubblewrap security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-19

Description

[0.6.3-1.1]
- Fix CVE-2026-87766 path traversal through symlinked mount targets
- Use O_PATH for parent directory traversal during setup
- Resolves: RHEL-256871

Related CVEs

CVE-2026-87766

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 9 (aarch64)	bubblewrap-0.6.3-1.el9_8.1.src.rpm	fbdaaf9e93bcd9d5794319cf87aa473d1c838b4550ac69c75c68ca003bcb03f3	-	ol9_aarch64_baseos_latest
	bubblewrap-0.6.3-1.el9_8.1.src.rpm	fbdaaf9e93bcd9d5794319cf87aa473d1c838b4550ac69c75c68ca003bcb03f3	-	ol9_aarch64_u8_baseos_patch
	bubblewrap-0.6.3-1.el9_8.1.aarch64.rpm	17a3b8f6441a8596a77b984e7608870b9acd2f4b69e76784f0406678227ab08c	-	ol9_aarch64_baseos_latest
	bubblewrap-0.6.3-1.el9_8.1.aarch64.rpm	17a3b8f6441a8596a77b984e7608870b9acd2f4b69e76784f0406678227ab08c	-	ol9_aarch64_u8_baseos_patch
Oracle Linux 9 (x86_64)	bubblewrap-0.6.3-1.el9_8.1.src.rpm	fbdaaf9e93bcd9d5794319cf87aa473d1c838b4550ac69c75c68ca003bcb03f3	-	ol9_x86_64_baseos_latest
	bubblewrap-0.6.3-1.el9_8.1.src.rpm	fbdaaf9e93bcd9d5794319cf87aa473d1c838b4550ac69c75c68ca003bcb03f3	-	ol9_x86_64_u8_baseos_patch
	bubblewrap-0.6.3-1.el9_8.1.x86_64.rpm	d84ca05abc7fd485b76166238c2ba774bf241197a5ddc00028bbf4551214b7ba	-	ol9_x86_64_baseos_latest
	bubblewrap-0.6.3-1.el9_8.1.x86_64.rpm	d84ca05abc7fd485b76166238c2ba774bf241197a5ddc00028bbf4551214b7ba	-	ol9_x86_64_u8_baseos_patch

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team