CVE coverage
Rocky Linux 9 CVE tracker
Noxen pulls Rocky Linux 9 CVE data from the same upstream sources Red Hat publishes against (RHEL 9 binary-compatible). NVD provides the upstream advisory; OSV's Red Hat ecosystem feed provides the rpm-level fix versions.
Live
Headline numbers
- Total CVE records (all distros)Loading…
- Last buildLoading…
- OSV records (RH ecosystem + others)Loading…
- NVD records (cross-platform)Loading…
How matching works
What Noxen does for a Rocky 9 host
- Reads
/etc/os-releaseto confirm Rocky 9 (RHEL 9 binary-compatible). - Reads
rpm -qafor installed packages, including epoch and release. - Filters the local feed cache to OSV records tagged with ecosystem
Rocky Linux:9 / Red Hat:9, plus NVD records whose CPE matches the installed packages. - Compares installed vs fix versions using rpm version semantics (epoch:version-release).
- Emits findings only where the installed version is strictly older than the fix.
Live listings
Top recent critical CVEs (Red Hat ecosystem (RHEL / Rocky / AlmaLinux))
Most-recently-published critical CVEs in the Red Hat ecosystem (RHEL / Rocky / AlmaLinux). Auto-deduped to one row per CVE ID. Snapshot baked at ; live re-fetch on page load.
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| RLSA-2026:43505 | critical | 9.1 | Important: mariadb-connector-c security update | mariadb-connector-c | 0:3.4.4-2.el10_2 | |
| RLSA-2026:40831 | critical | 9.8 | Important: hplip security update | hplip | 0:3.21.2-6.el9_8.5 | |
| RLSA-2026:40894 | critical | 9.8 | Important: hplip security update | hplip | 0:3.18.4-14.el8_10 | |
| RLSA-2026:39976 | critical | 9.8 | Important: hplip security update | hplip | 0:3.23.12-10.el10_2.5 | |
| RLSA-2026:33093 | critical | 9.9 | Important: mariadb10.11 security, bug fix, and enhancement update | mariadb10.11 | 3:10.11.18-1.el10_2 | |
| RLSA-2026:33412 | critical | 9.9 | Important: galera and mariadb11.8 security, bug fix, and enhancement update | galera | 0:26.4.27-1.el10_2 | |
| RLSA-2026:33481 | critical | 9.9 | Important: mariadb:11.8 security, bug fix, and enhancement update | galera | 0:26.4.27-1.module+el9.8.0+40229+87be66a2 | |
| RLSA-2026:33482 | critical | 9.9 | Important: mariadb:10.11 security, bug fix, and enhancement update | galera | 0:26.4.27-1.module+el9.8.0+40229+87be66a2 |
Top recent high-severity CVEs (Red Hat ecosystem (RHEL / Rocky / AlmaLinux))
| CVE | Sev. | CVSS | Summary | Package | Fix in | Published |
|---|---|---|---|---|---|---|
| RXSA-2026:45192 | high | 7.0 | Important: kernel security, bug fix, and enhancement update | kernel | 0:5.14.0-687.30.1.el9_8.cloud.1.0 | |
| RXSA-2026:45115 | high | 7.0 | Important: kernel security update | kernel | 0:4.18.0-553.147.1.el8_10.cloud.0.1 | |
| RLSA-2026:45192 | high | 7.0 | Important: kernel security, bug fix, and enhancement update | kernel | 0:5.14.0-687.30.1.el9_8 | |
| RLSA-2026:44391 | high | 8.4 | Important: libpq security update | libpq | 0:16.14-1.el10_2 | |
| RLSA-2026:45114 | high | 7.1 | Important: kernel security update | kernel | 0:6.12.0-211.39.1.el10_2 | |
| RLSA-2026:44308 | high | 8.4 | Important: libpq security update | libpq | 0:13.23-3.el9_8 | |
| RLSA-2026:44438 | high | 8.1 | Important: compat-openssl11 security update | compat-openssl11 | 1:1.1.1k-5.el9_8.4 | |
| RLSA-2026:46397 | high | 7.5 | Important: libreswan security update | libreswan | 0:4.15-10.el9_8 |
Notable
Recent CVEs that Rocky 9 homelabs care about.
- CVE-2024-6387 (regreSSHion) — OpenSSH signal-handler race producing pre-auth RCE.. Red Hat advisory · Noxen deep-dive.
- CVE-2024-1086 (nf_tables UAF) — Linux kernel privilege-escalation, observed in the wild.. Red Hat advisory.
- CVE-2024-3094 (xz backdoor) — Supply-chain backdoor in xz-utils 5.6.0 / 5.6.1.. Red Hat advisory · Noxen deep-dive.
FAQ
Frequently asked about Rocky 9 CVEs
How is Rocky Linux 9 different from RHEL 9 for CVE tracking?
Rocky Linux 9 is binary-compatible with RHEL 9. Fixes land in Rocky errata within days of the corresponding RHEL release. Noxen matches against the Red Hat ecosystem feed plus Rocky errata to capture both channels.
How do I check Rocky 9 CVEs on a host?
For a quick check: dnf updateinfo list security. For per-CVE detail with fix versions, Noxen reads rpm package state over SSH and matches against the live ecosystem feed using rpm version semantics.
Will Noxen flag a CVE that Rocky Linux 9 has already backported a fix for?
No. Red Hat-family distros backport security fixes without changing the upstream version number — the fix shows up as a higher release field (the part after the dash in epoch:version-release). Noxen compares the installed epoch:version-release against the fixed package version using rpm version semantics, so a host that has applied the backported errata is correctly shown as patched rather than as a false positive.
Which Rocky Linux 9 CVEs should I patch first?
Severity alone is a poor sort key. Noxen ranks findings by exposure first — a high-severity CVE in a package behind an internet-facing service outranks a critical one in a library nothing reaches — then by CVSS and EPSS. The EPSS prioritisation guide walks through the reasoning.
Scan a Rocky 9 fleet with Noxen
Add your Rocky 9 hosts via your existing
~/.ssh/config; Noxen reads rpm package state and
matches against the live signed feed. No agent, no SaaS round-trip.
$79 one-time.