Red Hat Linux Red Hat Enterprise Linux Vulnerabilities & Security Advisories
1165 advisories tracked · Red Hat Security Data API · 3 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as Red Hat Enterprise Linux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 31 critical, 771 high, 347 medium, 16 low.
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux Red Hat Enterprise Linux advisories
High [CVE-2026-43198] fix potential race in tcp_v6_syn_recv_sock()
fix potential race in tcp_v6_syn_recv_sock(). Red Hat rates this important (CVSS 7). Weakness: CWE-821. Affected package(s): kernel. Resolved in Red Hat advisory RHSA-2026:34094 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 7 more.
High [CVE-2026-43114] don't return non-matching entry on expiry
don't return non-matching entry on expiry. Red Hat rates this important (CVSS 8.1). Weakness: CWE-480. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.
High [CVE-2026-43133] Always use vmcb01 in VMLOAD/VMSAVE emulation
Always use vmcb01 in VMLOAD/VMSAVE emulation. Red Hat rates this important (CVSS 7.9). Weakness: CWE-628. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.
High [CVE-2026-43125] validate length in dlm_search_rsb_tree
validate length in dlm_search_rsb_tree. Red Hat rates this important (CVSS 7). Weakness: CWE-130. Affected package(s): kernel, kernel-rt. Resolved in Red Hat advisory RHSA-2026:25120 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; and 4 more.
High [CVE-2026-28780] Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow
Apache HTTP Server mod_proxy_ajp: Arbitrary code execution via heap-based buffer overflow. Red Hat rates this important (CVSS 8.1). Weakness: CWE-787. Affected package(s): httpd, httpd:2.4, jbcs-httpd24-httpd. Resolved in Red Hat advisory RHSA-2026:27200 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: JBoss Core Services for RHEL 8; JBoss Core Services on RHEL 7; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 8 more.
High [CVE-2026-25243] RESTORE invalid memory access may allow remote code execution
RESTORE invalid memory access may allow remote code execution. Red Hat rates this important (CVSS 8.8). Weakness: CWE-122. Affected package(s): redis, valkey, redis:6, redis:7. Resolved in Red Hat advisory RHSA-2026:26540 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 7 more.
High [CVE-2026-23631] Remote code execution via use-after-free in Lua scripting
Remote code execution via use-after-free in Lua scripting. Red Hat rates this important (CVSS 8.8). Weakness: CWE-416. Affected package(s): redis:7, valkey. Resolved in Red Hat advisory RHSA-2026:26540 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images.
High [CVE-2026-23479] use-after-free in unblock client flow may allow remote code execution
use-after-free in unblock client flow may allow remote code execution. Red Hat rates this important (CVSS 7.5). Weakness: CWE-416. Affected package(s): redis:7, valkey. Resolved in Red Hat advisory RHSA-2026:26540 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images.
High [CVE-2026-6918] Denial of Service in JITServer via crafted TCP message
Denial of Service in JITServer via crafted TCP message. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1286. Affected package(s): java. Resolved in Red Hat advisory RHSA-2026:22328 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 10.2 Extended Update Support.
High [CVE-2026-6322] URI authority bypass due to improper delimiter handling
URI authority bypass due to improper delimiter handling. Red Hat rates this important (CVSS 7.5). Weakness: CWE-140. Affected package(s): cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9:1782839981, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9:1782840519, openshift4/ose-monitoring-plugin-rhel9:1782313844, quay/quay-rhel8:1781878070, rhacm2/console-rhel9:1780600823. Resolved in Red Hat advisory RHSA-2026:26234 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Enterprise Linux Extensions Channel (v. 10); Red Hat Developer Hub 1.10; Red Hat Developer Hub 1.9; and 31 more.
High [CVE-2026-43869] Security bypass due to improper certificate validation
Security bypass due to improper certificate validation. Red Hat rates this important (CVSS 7.3). Weakness: CWE-295. Affected package(s): multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1779925273, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1779212259, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1780167118, cryostat/cryostat-storage-rhel9:4.2.0, libthrift, rhosdt/tempo-rhel9:1781589494. Resolved in Red Hat advisory RHSA-2026:21769 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; and 13 more.
High [CVE-2026-6321] Path traversal vulnerability allows bypass of security policies
Path traversal vulnerability allows bypass of security policies. Red Hat rates this important (CVSS 7.5). Weakness: CWE-22. Affected package(s): odf4/odf-multicluster-rhel9-operator:1778577548, network-observability/network-observability-console-plugin-rhel9:1780556069, cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9:1782840519, odf4/odf-cli-rhel9:1781557189, satellite/iop-advisor-frontend-rhel9:1781181673. Resolved in Red Hat advisory RHSA-2026:25089 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9; Red Hat Discovery 2; and 15 more.
High [CVE-2026-42154] Denial of Service via uncontrolled memory allocation in remote read endpoint
Denial of Service via uncontrolled memory allocation in remote read endpoint. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): opentelemetry-collector, jaeger-main, rhacm2/prometheus-rhel9:1782374537, opentelemetry-collector-main, openshift-logging/logging-loki-rhel9:1782405469, opentelemetry-collector-contrib-main. Resolved in Red Hat advisory RHSA-2026:29770 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: RHEM 1.0 for RHEL 9; Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream (v. 9); Logging Subsystem for Red Hat OpenShift 6.4; and 31 more.
High [CVE-2026-42151] Information disclosure of Azure OAuth client secret via config API
Information disclosure of Azure OAuth client secret via config API. Red Hat rates this important (CVSS 7.5). Weakness: CWE-256. Affected package(s): opentelemetry-collector, opentelemetry-collector-contrib-main, jaeger-main, opentelemetry-collector-main. Resolved in Red Hat advisory RHSA-2026:25504 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: RHEM 1.0 for RHEL 9; Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream (v. 9); Red Hat Edge Manager 1.0; and 30 more.
High [CVE-2026-43964] buffer over-read via malformed enhanced status code
buffer over-read via malformed enhanced status code. Red Hat rates this important (CVSS 7.5). Weakness: CWE-193. Affected package(s): postfix. Resolved in Red Hat advisory RHSA-2026:25932 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7.
High [CVE-2026-6266] Account hijacking and unauthorized access via unverified email linking
Account hijacking and unauthorized access via unverified email linking. Red Hat rates this important (CVSS 8.3). Weakness: CWE-305. Affected package(s): automation-gateway, automation-controller, python3.12-django-ansible-base, ansible-automation-platform. Resolved in Red Hat advisory RHSA-2026:13508 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9.
High [CVE-2026-33846] Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly
Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly. Red Hat rates this important (CVSS 7.5). Weakness: CWE-130. Affected package(s): rhui5/installer-rhel9:1781525693, libtasn1, gnutls, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952, discovery/discovery-server-rhel9:1782159791. Resolved in Red Hat advisory RHSA-2026:29197 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 37 more.
High [CVE-2026-39852] io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests
io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests. Red Hat rates this important (CVSS 8.2). Weakness: CWE-551. Affected package(s): cryostat/jfr-datasource-rhel9:4.2.0, quarkus-vertx-http, cryostat/cryostat-reports-rhel9:4.2.0, cryostat/cryostat-rhel9:4.2.0. Resolved in Red Hat advisory RHSA-2026:25089 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Build of Apache Camel 4.14 for Quarkus 3.27; Red Hat build of Quarkus 3.20.6.SP1; OpenShift Serverless; and 7 more.
High [CVE-2026-37459] denial of service via crafted BGP UPDATE message
denial of service via crafted BGP UPDATE message. Red Hat rates this important (CVSS 7.5). Weakness: CWE-191. Affected package(s): frr10, frr. Resolved in Red Hat advisory RHSA-2026:24370 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
High [CVE-2026-54228] TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories
TOCTOU race condition in abrt-dbus SetElement allows arbitrary file writes to dump directories. Red Hat rates this important (CVSS 7.8). Weakness: CWE-367. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 3 more.