Red Hat Linux Red Hat Enterprise Linux Vulnerabilities & Security Advisories
1160 advisories tracked · Red Hat Security Data API · 3 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as Red Hat Enterprise Linux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 31 critical, 773 high, 340 medium, 16 low.
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux Red Hat Enterprise Linux advisories
High [CVE-2026-23479] use-after-free in unblock client flow may allow remote code execution
use-after-free in unblock client flow may allow remote code execution. Red Hat rates this important (CVSS 7.5). Weakness: CWE-416. Affected package(s): redis:7, valkey. Resolved in Red Hat advisory RHSA-2026:26540 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images.
High [CVE-2026-6918] Denial of Service in JITServer via crafted TCP message
Denial of Service in JITServer via crafted TCP message. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1286. Affected package(s): java. Resolved in Red Hat advisory RHSA-2026:22328 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 10.2 Extended Update Support.
High [CVE-2026-6322] URI authority bypass due to improper delimiter handling
URI authority bypass due to improper delimiter handling. Red Hat rates this important (CVSS 7.5). Weakness: CWE-140. Affected package(s): cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9:1782839981, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9:1782840519, openshift4/ose-monitoring-plugin-rhel9:1782313844, quay/quay-rhel8:1781878070, rhacm2/console-rhel9:1780600823. Resolved in Red Hat advisory RHSA-2026:26234 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Enterprise Linux Extensions Channel (v. 10); Red Hat Developer Hub 1.10; Red Hat Developer Hub 1.9; and 31 more.
High [CVE-2026-43869] Security bypass due to improper certificate validation
Security bypass due to improper certificate validation. Red Hat rates this important (CVSS 7.3). Weakness: CWE-295. Affected package(s): multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1779925273, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1779212259, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1780167118, cryostat/cryostat-storage-rhel9:4.2.0, libthrift, rhosdt/tempo-rhel9:1781589494. Resolved in Red Hat advisory RHSA-2026:21769 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 13 more.
High [CVE-2026-6321] Path traversal vulnerability allows bypass of security policies
Path traversal vulnerability allows bypass of security policies. Red Hat rates this important (CVSS 7.5). Weakness: CWE-22. Affected package(s): odf4/odf-multicluster-rhel9-operator:1778577548, network-observability/network-observability-console-plugin-rhel9:1780556069, cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9:1782840519, odf4/odf-cli-rhel9:1781557189, satellite/iop-advisor-frontend-rhel9:1781181673. Resolved in Red Hat advisory RHSA-2026:25089 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9; Red Hat Discovery 2; and 15 more.
High [CVE-2026-42154] Denial of Service via uncontrolled memory allocation in remote read endpoint
Denial of Service via uncontrolled memory allocation in remote read endpoint. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): opentelemetry-collector, jaeger-main, rhacm2/prometheus-rhel9:1782374537, opentelemetry-collector-main, openshift-logging/logging-loki-rhel9:1782405469, opentelemetry-collector-contrib-main. Resolved in Red Hat advisory RHSA-2026:29770 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: RHEM 1.0 for RHEL 9; Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream (v. 9); Logging Subsystem for Red Hat OpenShift 6.4; and 31 more.
High [CVE-2026-42151] Information disclosure of Azure OAuth client secret via config API
Information disclosure of Azure OAuth client secret via config API. Red Hat rates this important (CVSS 7.5). Weakness: CWE-256. Affected package(s): opentelemetry-collector, opentelemetry-collector-contrib-main, jaeger-main, opentelemetry-collector-main. Resolved in Red Hat advisory RHSA-2026:25504 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: RHEM 1.0 for RHEL 9; Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream (v. 9); Red Hat Edge Manager 1.0; and 30 more.
High [CVE-2026-43964] buffer over-read via malformed enhanced status code
buffer over-read via malformed enhanced status code. Red Hat rates this important (CVSS 7.5). Weakness: CWE-193. Affected package(s): postfix. Resolved in Red Hat advisory RHSA-2026:25932 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7.
High [CVE-2026-6266] Account hijacking and unauthorized access via unverified email linking
Account hijacking and unauthorized access via unverified email linking. Red Hat rates this important (CVSS 8.3). Weakness: CWE-305. Affected package(s): automation-gateway, automation-controller, python3.12-django-ansible-base, ansible-automation-platform. Resolved in Red Hat advisory RHSA-2026:13508 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9.
High [CVE-2026-33846] Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly
Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly. Red Hat rates this important (CVSS 7.5). Weakness: CWE-130. Affected package(s): rhui5/installer-rhel9:1781525693, libtasn1, gnutls, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952, discovery/discovery-server-rhel9:1782159791. Resolved in Red Hat advisory RHSA-2026:29197 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 37 more.
High [CVE-2026-39852] io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests
io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests. Red Hat rates this important (CVSS 8.2). Weakness: CWE-551. Affected package(s): cryostat/jfr-datasource-rhel9:4.2.0, quarkus-vertx-http, cryostat/cryostat-reports-rhel9:4.2.0, cryostat/cryostat-rhel9:4.2.0. Resolved in Red Hat advisory RHSA-2026:25089 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Build of Apache Camel 4.14 for Quarkus 3.27; Red Hat build of Quarkus 3.20.6.SP1; OpenShift Serverless; and 7 more.
High [CVE-2026-37459] denial of service via crafted BGP UPDATE message
denial of service via crafted BGP UPDATE message. Red Hat rates this important (CVSS 7.5). Weakness: CWE-191. Affected package(s): frr10, frr. Resolved in Red Hat advisory RHSA-2026:24370 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
High [CVE-2026-54228] TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories
TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories. Red Hat rates this important (CVSS 7.8). Weakness: CWE-367. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 3 more.
High [CVE-2026-54229] ChownProblemDir succeeds during active post-create event processing due to inadequate locking
ChownProblemDir succeeds during active post-create event processing due to inadequate locking. Red Hat rates this important (CVSS 7). Weakness: CWE-362. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 3 more.
High [CVE-2026-54230] event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites
event handler scripts follow symlinks when writing output files, allowing arbitrary file overwrites. Red Hat rates this important (CVSS 7). Weakness: CWE-59. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.
High [CVE-2026-37457] denial of service via crafted FlowSpec component
denial of service via crafted FlowSpec component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Affected package(s): frr, frr10. Resolved in Red Hat advisory RHSA-2026:24340 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-43037] clear skb2->cb[] in ip4ip6_err()
clear skb2->cb[] in ip4ip6_err(). Red Hat rates this critical (CVSS 8.8). Weakness: CWE-843. Affected package(s): kernel, rhcos, kernel-rt, kpatch-patch. Resolved in Red Hat advisory RHSA-2026:28741 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: NVIDIA for RHEL 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION; Red Hat Enterprise Linux 7 Extended Lifecycle Support; and 19 more.
High [CVE-2026-43038] clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
clear skb2->cb[] in ip6_err_gen_icmpv6_unreach(). Red Hat rates this important (CVSS 7.3). Weakness: CWE-843. Affected package(s): kernel, kernel-rt. Resolved in Red Hat advisory RHSA-2026:25120 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux AppStream EUS (v. 10.0); Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream E4S (v.9.2); Red Hat Enterprise Linux AppStream E4S (v.9.4); and 44 more.
High [CVE-2026-31709] validate the whole DACL before rewriting it in cifsacl
validate the whole DACL before rewriting it in cifsacl. Red Hat rates this important (CVSS 7.8). Weakness: CWE-1288. Affected package(s): kernel, kernel-rt. Resolved in Red Hat advisory RHSA-2026:21745 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; and 1 more.
High [CVE-2026-5403] Heap-based Buffer Overflow in Wireshark
Heap-based Buffer Overflow in Wireshark. Red Hat rates this important (CVSS 7.8). Weakness: CWE-122. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux 10.