Oracle Errata System Oracle Linux 5.11 2026-10-22T04:22:26 Oracle Linux 9 [8.0.30-8.1] - Fix FILTER_SANITIZE_ENCODED does not encode 0xFF - Fix IPv6 ACL bypass in FastCGI listen.allowed_clients due to partial address comparison CVE-2026-91768 - Fix Various packet overreads in mysqlnd wire protocol CVE-2025-1218 - Fix TLS hostname verification falls back to CN after SAN mismatch CVE-2026-91769 - Fix Heap buffer overflow in php_openssl_matches_wildcard_name() on crafted server certificate wildcard CN CVE-2026-91767 - Fix Integer overflow in phar_tar_number() allowing TAR archive entry injection CVE-2026-6103 - Fix Unbounded recursion in server-side cleanup_xml_node() CVE-2026-91765 - Fix Integer overflow to buffer overflow in SOAP HTTP parsing CVE-2025-14181 - Fix Out-of-bounds read in convert.* stream filters when line-break-chars contains NUL CVE-2026-92842 - Fix Cross-origin credential leak in HTTP stream wrapper redirects CVE-2026-91766 - Fix Out-of-bounds read in the HTTP stream wrapper when following a redirect with an empty Location header CVE-2026-93682 - Avoid state corruption via bailout CVE-2026-109618, CVE-2026-109619 IMPORTANT Copyright 2026 Oracle, Inc. CVE-2026-109618 CVE-2026-109619 CVE-2026-91765 cpe:/a:oracle:linux:9::appstream