{
  "cves": [
    "CVE-2026-4437",
    "CVE-2026-4438"
  ],
  "cvss": 0.0,
  "database_specific": {
    "severity": "MODERATE"
  },
  "description": "[2.39-121.0.1]\n- Forward port Oracle changes to 2.39-121.\n- Reviewed-by: David Faust david.faust@oracle.com\n  Oracle history:\n  April-2-2026 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-113.0.1\n  - Reverted to version 2.39-113.\n  - Reviewed-by: David Faust david.faust@oracle.com\n  February-3-2026 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-99.0.1\n  - Forward port Oracle changes to 2.39-99.\n  - Reviewed-by: David Faust david.faust@oracle.com\n  January-27-2026 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-58.0.1.7\n  - Forward port Oracle changes to 2.39-58.7.\n  - Reviewed-by: David Faust david.faust@oracle.com\n  November-26-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-58.0.1.2\n  - Forward port Oracle changes to 2.39-58.2.\n  - Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  September-29-2025 David Faust david.faust@oracle.com - 2.39-58.0.1\n  - Forward port Oracle changes to 2.39-58.\n  - Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  August-29-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-54.0.1\n  - Forward port Oracle changes.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  August-7-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-46.0.1\n  - Forward port Oracle changes.\n    Reviewed-by: David Faust david.faust@oracle.com\n  July-15-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-43.0.1\n  - Forward port Oracle changes.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  March-5-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-37.0.1\n  - Forward port Oracle changes to 2.39-37.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n  Jan-22-2025 Cupertino Miranda cupertino.miranda@oracle.com - 2.39-32.0.1\n  - Integration of relevant Oracle patches.\n    Reviewed-by: Jose E. Marchesi jose.marchesi@oracle.com\n\n[2.39-121]\n- Avoid duplicate DNS queries when search path contains '.' (RHEL-142675)\n\n[2.39-120]\n- Sync with upstream branch release/2.39/master (RHEL-151554)\n- Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa\n- resolv: Check hostname for validity (CVE-2026-4438)\n- resolv: Count records correctly (CVE-2026-4437)\n- iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module\n\n[2.39-119]\n- Fix NULL pointer dereference in __nss_database_get and\n  __nss_configure_lookup (RHEL-150270)\n\n[2.39-118]\n- patch-git: Avoid trailing tabs in changelog (RHEL-140226)\n\n[2.39-117]\n- dlfcn: Add dlinfo request type RTLD_DI_ORIGIN_PATH (RHEL-146428)\n\n[2.39-116]\n- Remove unneeded ld-linux .debug files (RHEL-136312)\n\n[2.39-115]\n- Fix race condition in io/tst-stat (RHEL-151711)\n\n[2.39-114]\n- Remove default value for LD_PROFILE_OUTPUT (RHEL-142193)\n\n[2.39-113]\n- Update locales for Croatia to use EUR as currency symbol (RHEL-140103)",
  "id": "ELSA-2026-19061",
  "ovalId": "oval:com.oracle.elsa:def:202619061",
  "source": "oracle_linux",
  "title": "ELSA-2026-19061:  glibc security update (MODERATE)",
  "url": "https://linux.oracle.com/errata/ELSA-2026-19061.html"
}