ELSA-2026-89849

ELSA-2026-89849 - flatpak security update

Type:	SECURITY
Impact:	IMPORTANT
Release Date:	2026-10-26

Description

[1.16.0-9.6]
- Use fd-relative operations for files/etc during runtime deploy (CVE-2026-97024)
Resolves: RHEL-272185

[1.16.0-9.5]
- Avoid path traversal deletion via deploy export/bin (CVE-2026-97023)
Resolves: RHEL-272031

Related CVEs

CVE-2026-97023

CVE-2026-97024

Updated Packages

Release/Architecture	Filename	sha256	Superseded By Advisory	Channel Label
Oracle Linux 10 (aarch64)	flatpak-1.16.0-9.el10_2.6.src.rpm	2d18b05779e4f2b8cd59186d0022d5ac530327ab86b0cf69564a51356f58aae3	-	ol10_aarch64_appstream
	flatpak-1.16.0-9.el10_2.6.src.rpm	2d18b05779e4f2b8cd59186d0022d5ac530327ab86b0cf69564a51356f58aae3	-	ol10_aarch64_codeready_builder
	flatpak-1.16.0-9.el10_2.6.aarch64.rpm	10286ae6baa30cad8355b1067a67ffc8cd973cb6d3610e6444e1faee170e121c	-	ol10_aarch64_appstream
	flatpak-devel-1.16.0-9.el10_2.6.aarch64.rpm	7e727e50eaf615ec153927787bd769caa96845745c6af4c054b8630c305493bf	-	ol10_aarch64_codeready_builder
	flatpak-libs-1.16.0-9.el10_2.6.aarch64.rpm	c5c4d081f90eddfc816f1aef1c9c3ffbb020d126e74b08c0a73661402bfa96ba	-	ol10_aarch64_appstream
	flatpak-selinux-1.16.0-9.el10_2.6.noarch.rpm	7b5650d6c29a188b31fffbfd4936aadc316f23beab5bf076b0714d16cc449103	-	ol10_aarch64_appstream
	flatpak-session-helper-1.16.0-9.el10_2.6.aarch64.rpm	5db76eb510333b6404e7f3202fb48f063b82eb4603116abb17ef89f49961205d	-	ol10_aarch64_appstream
Oracle Linux 10 (x86_64)	flatpak-1.16.0-9.el10_2.6.src.rpm	2d18b05779e4f2b8cd59186d0022d5ac530327ab86b0cf69564a51356f58aae3	-	ol10_x86_64_appstream
	flatpak-1.16.0-9.el10_2.6.src.rpm	2d18b05779e4f2b8cd59186d0022d5ac530327ab86b0cf69564a51356f58aae3	-	ol10_x86_64_codeready_builder
	flatpak-1.16.0-9.el10_2.6.x86_64.rpm	14e282f92959a4d02f412ebb05f8c2964f45d817ff189ea7da8e7c1af1b37d9a	-	ol10_x86_64_appstream
	flatpak-devel-1.16.0-9.el10_2.6.x86_64.rpm	cf86d4330e5a6441b95963cbd9fed18a93bae288dbaa5e80fb5788ca4357f921	-	ol10_x86_64_codeready_builder
	flatpak-libs-1.16.0-9.el10_2.6.x86_64.rpm	42f0a5061d664833a4f88dc2bf8ec8f77765360de71ab90616a6ec0162dc38cc	-	ol10_x86_64_appstream
	flatpak-selinux-1.16.0-9.el10_2.6.noarch.rpm	7b5650d6c29a188b31fffbfd4936aadc316f23beab5bf076b0714d16cc449103	-	ol10_x86_64_appstream
	flatpak-session-helper-1.16.0-9.el10_2.6.x86_64.rpm	c80bd72e9914db0b03809d3dccf175e9778e15fcadb80c1db4f042b6e4bd82c9	-	ol10_x86_64_appstream

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team