Oracle Errata System Oracle Linux 5.11 2026-07-15T10:57:51 Oracle Linux 10 [9.9p1-23.0.1] - Upstream references found with /usr/bin/ssh [Orabug: 37824421] [9.9p1-23] - CVE-2026-35385: Fix privilege escalation via scp legacy protocol when not in preserving file mode Resolves: RHEL-164739 - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode multiplexing sessions Resolves: RHEL-166238 - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms and HostbasedAcceptedAlgorithms with regard to ECDSA keys Resolves: RHEL-166222 - CVE-2026-35414: Fix mishandling of authorized_keys principals option Resolves: RHEL-166190 - CVE-2026-35386: Add validation rules to usernames and hostnames set for ProxyJump/-J on the commandline Resolves: RHEL-166206 [9.9p1-22] - Version bump [9.9p1-21] - CVE-2026-3497: Fix information disclosure or denial of service due to uninitialized variables in gssapi-keyex Resolves: RHEL-155812 [9.9p1-20] - Provide a way to skip unsupported ML-KEM hybrid algorithms in FIPS mode Resolves: RHEL-151579 [9.9p1-19] - Support of hybrid MLKEM key exchange methods in FIPS mode Resolves: RHEL-125929 [9.9p1-18] - Adding a mechanism to disable GSSAPIDelegateCredentials in sshd_config Resolves: RHEL-5281 [9.9p1-17] - CVE-2025-61984: Reject usernames with control characters Resolves: RHEL-128399 - CVE-2025-61985: Reject URL-strings with NULL characters Resolves: RHEL-128388 [9.9p1-16] - Implement mlkem768nistp256-sha256 and mlkem1024nistp384-sha384 KEX methods Resolves: RHEL-70824 [9.9p1-15] - Fix implicit destination path selection when source path ends with '..' Resolves: RHEL-118406 - Canonicalize username when matching a user Resolves: RHEL-101440 IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-35385 CVE-2026-35386 CVE-2026-35387 CVE-2026-35388 CVE-2026-35414 cpe:/a:oracle:linux:10::appstream cpe:/o:oracle:linux:10::baseos_latest cpe:/o:oracle:linux:10:2:baseos_base