Oracle Errata System Oracle Linux 5.11 2026-09-18T18:48:51 Oracle Linux 8 [2.1.8-11] - Fix CVE-2026-63385: HTTP header injection via CRLF in header values - Resolves: RHEL-253566 [2.1.8-10] - Fix CVE-2026-63387: out-of-bounds write in evdns dnsname_to_labels - Resolves: RHEL-249889 [2.1.8-9] - Fix CVE-2026-63383: out-of-bounds read in decode_tag_internal - Resolves: RHEL-250240 [2.1.8-8] - Fix CVE-2026-63384: integer overflow in evtag_unmarshal_header - Resolves: RHEL-250071 [2.1.8-7] - Fix CVE-2026-63388: heap out-of-bounds write via AF_UNIX+http+NDEBUG - Resolves: RHEL-250045 [2.1.8-6] - Fix CVE-2026-63382: HTTP request smuggling via Transfer-Encoding - Resolves: RHEL-253525 IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-63382 CVE-2026-63383 CVE-2026-63384 CVE-2026-63385 CVE-2026-63387 CVE-2026-63388 cpe:/o:oracle:linux:8::baseos_latest cpe:/o:oracle:linux:8:10:baseos_patch cpe:/a:oracle:linux:8::appstream