Red Hat Product Errata RHSA-2026:38500 - Security Advisory Issued: 2026-07-13 Updated: 2026-07-13 RHSA-2026:38500 - Security Advisory Overview Updated Packages Synopsis Important: maven:3.9 security update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update for the maven:3.9 module is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Maven is a software project management and comprehension tool. Based on the concept of a project object model (POM), Maven can manage a project's build, reporting and documentation from a central piece of information. Security Fix(es): org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method (CVE-2025-67030) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Solution For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Affected Products Red Hat Enterprise Linux for x86_64 9 x86_64 Red Hat Enterprise Linux for x86_64 - Extended Update Support 9.8 x86_64 Red Hat Enterprise Linux for IBM z Systems 9 s390x Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 9.8 s390x Red Hat Enterprise Linux for Power, little endian 9 ppc64le Red Hat Enterprise Linux for Power, little endian - Extended Update Support 9.8 ppc64le Red Hat Enterprise Linux for ARM 64 9 aarch64 Red Hat Enterprise Linux for ARM 64 - Extended Update Support 9.8 aarch64 Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 9.8 ppc64le Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - 4 years of updates 9.8 aarch64 Red Hat Enterprise Linux for IBM z Systems - 4 years of updates 9.8 s390x Red Hat Enterprise Linux for x86_64 - Extended Life Cycle 9.8 x86_64 Red Hat Enterprise Linux for ARM 64 - Extended Life Cycle 9.8 aarch64 Red Hat Enterprise Linux for Power, little endian - Extended Life Cycle 9.8 ppc64le Red Hat Enterprise Linux for IBM z Systems - Extended Life Cycle 9.8 s390x Fixes BZ - 2451409 - CVE-2025-67030 org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method CVEs CVE-2025-67030 References https://access.redhat.com/security/updates/classification/#important Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Enterprise Linux for x86_64 9 SRPM aopalliance-1.0-51.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: fe6d302f5b2f6872a14c33ef79b023d2340eed39f7a1c2fbaa46dd837948522e apache-commons-cli-1.9.0-4.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: fd7deae86a33f955534a0ce866bfbdfa07dc5cfeb4992c3d6e36391cfb805106 apache-commons-codec-1.17.1-8.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 668fc8403a6d4a48d280b09f9a73f7f27972aaf7b1b61d77bf50244ff9830f0e apache-commons-io-2.16.1-9.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 3c4d95c629fc85aef7d39d0246b9931b81feb509f358c42285b4a693175cc3fe atinject-1.0.5-14.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: fe514aa91213cb139e088eec64260a59e0f5f64edc41db36b51bc762cc39d02d google-guice-5.1.0-23.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 3caaf30301c6cceccb0071f51e63e7b07aa7f4a339bd39e404ce840915785595 guava-33.3.0-5.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 7ccd0ddb3e9c8ad41c616bcdc3617cb3ee5b45ecb70a3e198da08c5c6306d6fe httpcomponents-client-4.5.14-21.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: e9ca50caecc6dcda86e9aedf7d73645e2b8c21c03b1e4911a0966cc67b471005 httpcomponents-core-4.4.16-21.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: cd8eafaf81d79a93bc608e3445d97bc092e9233c8f6f4ef1dc72a97c2719edd7 jakarta-annotations-1.3.5-38.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 3b87671c3c2adf813177f7714c330ec6015ce183a9ad023ed0698e408198149f jansi-2.4.1-12.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: cfca9d5829bcc0054675d53aa9ef60c1b861d4dbf16a8810e9f152f24707445d jsr-305-3.0.2-36.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: e1675d964ed13b534e106d7feb0a649fafa3560d1b37da748b7a60d6cedac5ef maven-3.9.9-13.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 2733737668d9aaac2d3ea5af98d791b2e8faa344e5327005987bbf612fc2860c maven-resolver-1.9.22-6.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 92ac785c565985edf8f5bedaadd3bf9c4c9e80dc330c6440a36c63efd5dc5ba1 maven-shared-utils-3.4.2-19.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: b6688d7ba5b7dcafa1f01ab3c2c993d74adbfa9b14fef927486204a008350655 maven-wagon-3.5.3-17.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: d7621c60ad03d92671ed8be51fb98a6ae9065e0fee665c99f937a34ad46ecd02 plexus-cipher-2.0-25.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 12edd502c6bbae832280434f40340f62503bf9a8313a0833e1d9d5878c907dce plexus-classworlds-2.8.0-9.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 52f0a0dbe4cac41db884dcae14e436c96ecd230cadd9517768b342bdbd9a27bf plexus-containers-2.2.0-10.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 7024db2a1fb7a48190a0586e69140e65cc4851eae4ce6a8e3a047794381a2e15 plexus-interpolation-1.27-10.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 80b849ae4f6017f3affd7ebeb89f8c25a5b0ed46d0f6c594c2152a607389f22c plexus-sec-dispatcher-2.0-28.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 23d4481a1f0285ade0c501f74c66d8afe104cf03a389874c42e9209c1aac78e6 plexus-utils-3.5.1-17.module+el9.8.0+24375+95248a69.1.src.rpm SHA-256: 1b4a71a7802c280dabf1012d9512f2da8883002999db166496247d1fd4d3b2d3 sisu-0.9.0~M3-7.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: 7d8264a64021835be4783ee48eced075d5d042472c40bcd50310c5fb21e03977 slf4j-1.7.36-9.module+el9.8.0+24092+eb9f67d0.src.rpm SHA-256: b40125e580bbaf6f348a9ab7969200ed51551b199c1bbb2598bf87cc06438eb2 x86_64 aopalliance-1.0-51.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 53f121042894876abea8fc83bfa85f11c5550cc5b55c58b1b290a1d78a4d9927 apache-commons-cli-1.9.0-4.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 42a76007dcc7db3287875e1e84312af88c86ff2fae6f669b53e2776532aa70f6 apache-commons-codec-1.17.1-8.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 615817cc5d6a79df985c4d18adb884e4623a7c4b8ef087a5ac2346533933fe54 apache-commons-io-2.16.1-9.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: b36351ceaf0f904c7373a10a292e2b92af9b4e30e1bc7060914b127a3cfa7703 atinject-1.0.5-14.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 03ba5fdfde2f1ed6ed9d7aa98d3e4e2f6f97bd4d55e7400c86a35a7d82b6d1f8 google-guice-5.1.0-23.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 73ad1ac78a7d87023a1848a5874401ea9c898fbd244b2798e86915c357751ac1 guava-33.3.0-5.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 77b44e24e652057119e1e4b5210e18507bfbc3da676a8d4ced306f2230a9c663 httpcomponents-client-4.5.14-21.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 0bdb1e9c0f7535df1f400b1decb8f5357b35f2beef2509af44324775e36c5a30 httpcomponents-core-4.4.16-21.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: ac8b9c1f6269332dc711c80a50e7d07c5c1f80822ec4b408e8efec336eb83a60 jakarta-annotations-1.3.5-38.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 5c643961a68fc10a948e0fb976a120edd1405bdea1f2556de0929c7c5bed8862 jcl-over-slf4j-1.7.36-9.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 24cc0f2e883ca5ee7c741dbf907b1dd71a0dfc5befd23795db86efe6b3d5a5a3 jsr-305-3.0.2-36.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 4f0b973f698879ba902eb1b57f77fc3265527ea253d9a9656de8b35920d805a0 maven-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: d0c443e9d9068fe2ff5f47ba02c3bcfcac1d50dd326ce88e413622905dea0782 maven-lib-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: fc2d4e32791d437c25e122a5c85bc2e362b3c713c701bbd74127ef51cb8a893d maven-openjdk11-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 15001ccc91764c2c6f171a1cf6282d755b3a990c4946c3b2a65406a3ee228b07 maven-openjdk17-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 020e7e9a50c58a77cfecf476ead504f15a16ae1f9c3493783c55e655fc770e63 maven-openjdk21-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 8d0d541411d1b61f53078f2de4396f29989690867828db735ed30cb0280bbfd6 maven-openjdk25-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: d958fec5e2b3fcb8c835605da7a571ba4229ecede918057ab03be35940db0a62 maven-openjdk8-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 35c605cfb3add98a534f7cb81cd082a8670bb5eb6bde9312bd79379f8b516f63 maven-resolver-1.9.22-6.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: c507e65529afcd96bae497ccea2e9d4e5e6cb4591d4cf2b77e70b5631beb5d22 maven-shared-utils-3.4.2-19.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: d22d3e1fae6993ad2657373500f31f5d4e19beea7c0aef68e4a5e27bacc10195 maven-unbound-3.9.9-13.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 3e5bba37833b33438218515c50ab019044155ce4176b0de194e1e39985c17c16 maven-wagon-3.5.3-17.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 1dc2480450fb87a326b392912c281a1d2b7fba3306f6c08f0754161f6f5cd0f3 plexus-cipher-2.0-25.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 157307dda5d44224819a2be089080ec2a0affbb99764a8da934d167fb550485f plexus-classworlds-2.8.0-9.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 0e479a5f574b0effc1eba012db2e4b1e7238d9fe38a56871d55b3296406354ed plexus-containers-component-annotations-2.2.0-10.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 9f22e190bf9b9bc4aefe788a8388709acd0220b997a02d218c98add4debb1091 plexus-interpolation-1.27-10.module+el9.8.0+24092+eb9f67d0.noarch.rpm SHA-256: 8e1bdb9478a31485791ecef4ae7f9348490475cc5c1934b3f3f0ad3c67b9c164 plexus-sec-dispatcher-2.0-28