Red Hat Linux Red Hat Enterprise Linux Vulnerabilities & Security Advisories
1225 advisories tracked · Red Hat Security Data API · 3 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Red Hat Linux advisory that VulniPulse classified as Red Hat Enterprise Linux, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 31 critical, 785 high, 384 medium, 25 low.
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux Red Hat Enterprise Linux advisories
Medium [CVE-2026-43712] Maliciously crafted web content may cause unexpected process crash
Maliciously crafted web content may cause unexpected process crash. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43713] Visiting a website may leak sensitive data
Visiting a website may leak sensitive data. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-284. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43721] A malicious website may silently hijack clipboard data
A malicious website may silently hijack clipboard data. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-732. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43732] Maliciously crafted web content may disclose sensitive user information
Maliciously crafted web content may disclose sensitive user information. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43740] Maliciously crafted web content may disclose process memory
Maliciously crafted web content may disclose process memory. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-59856] Arbitrary code execution via crafted PHP file in omni-completion
Arbitrary code execution via crafted PHP file in omni-completion. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-94. Red Hat lists fixing advisory RHSA-2026:47982 with package vim-2:8.2.2637-26.el9_8.13, vim-main-9.2.780-1.hum1. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-59858] Arbitrary command execution via crafted tags file in C omni-completion
Arbitrary command execution via crafted tags file in C omni-completion. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-94. Red Hat lists fixing advisory RHSA-2026:47982 with package vim-2:8.2.2637-26.el9_8.13, vim-main-9.2.780-1.hum1. Affected product named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-59921] CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder
A flaw was found in Netty's HttpPostRequestEncoder, a widely used Java networking library component responsible for constructing multipart HTTP request bodies. The issue arises because user-supplied filenames and field names are directly embedded into Content-Disposition MIME headers without any validation or sanitization of CRLF (\r\n) characters. Since MIME headers are delimited by CRLF sequences, an attacker who controls the filename in a multipart upload can inject arbitrary MIME headers into the request body. This may lead to limited Content-Type spoofing or header manipulation against middleware or storage layers processing the request, though the practical impact is constrained by the context in which Netty is deployed. Moderate: A CRLF injection flaw in the Netty Java networking library's multipart message encoder allows remote attackers with low privileges to inject arbitrary MIME headers. This can lead to Content-Type spoofing, stored cross-site scripting, or manipulation of downstream application logic, compromising data confidentiality and integrity without user interaction. Red Hat severity: Moderate — CVSS 5.7 (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-93. Affected products named by the advisory: Red Hat build of Quarkus 3.27.4.SP3; Red Hat build of Quarkus 3.33.2.SP3; Cryostat 4; OpenShift Serverless; and 19 more.
Medium [CVE-2026-59898] Protocol version confusion in netty-codec-http (WebSocket)
A flaw was found in netty-codec-http. The WebSocket handshaker in this component fails to properly validate protocol version information during the WebSocket upgrade process. A remote attacker can exploit this vulnerability by manipulating the WebSocket handshake, leading to a bypass of security checks or the negotiation of unexpected protocol versions. This could potentially enable protocol-level attacks. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-358. Affected Red Hat products: Red Hat build of Quarkus 3.27.4.SP3; Red Hat build of Quarkus 3.33.2.SP3; Cryostat 4; OpenShift Serverless; Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apache Camel - HawtIO 4; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat Build of Keycloak; Red Hat Data Grid 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces; Red Hat Satellite 6; Red Hat Single Sign-On 7; streams for Apache Kafka 2; streams for Apache Kafka 3. Red Hat fixing advisory: RHSA-2026:47189, RHSA-2026:47172.
Medium [CVE-2026-59900] Improper header neutralization in netty-codec-http2
A flaw was found in Netty's netty-codec-http2 component. The HTTP/2 encoder does not properly handle special characters in HTTP headers. This vulnerability allows a remote attacker to craft specific HTTP/2 requests, leading to HTTP response splitting and header injection attacks. Such attacks can enable an attacker to manipulate web content or inject malicious headers. This Moderate impact flaw in Netty's HTTP/2 encoder allows attackers to inject arbitrary header content via specially crafted HTTP/2 requests. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N). Affected Red Hat products: Red Hat build of Quarkus 3.27.4.SP3; Red Hat build of Quarkus 3.33.2.SP3; Cryostat 4; OpenShift Serverless; Red Hat AMQ Broker 7; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apache Camel - HawtIO 4; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat Build of Keycloak; Red Hat Data Grid 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces; Red Hat Single Sign-On 7; streams for Apache Kafka 2; streams for Apache Kafka 3. Red Hat fixing advisory: RHSA-2026:47189, RHSA-2026:47172.
Medium [CVE-2026-56000] GLX contextTags Use-After-Free in CommonMakeCurrent
GLX contextTags Use-After-Free in CommonMakeCurrent(). Red Hat rates this important (CVSS 6.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:38490 with package xorg-x11-server-Xwayland-0:24.1.9-4.el9_8.3, xorg-x11-server-Xwayland-0:24.1.9-4.el10_2.3. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1.
Medium [CVE-2025-12799] Jastow Cross-Site Scripting attack due to unsanitized URI
Jastow Cross-Site Scripting attack due to unsanitized URI. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-79. Red Hat lists fixing advisory RHSA-2026:36343 with package eap8-elytron-web-0:4.1.2-1.Final_redhat_00001.1.el10eap, eap8-jboss-ejb-client-0:5.0.8-1.Final_redhat_00001.1.el10eap, eap8-jandex-0:3.2.7-1.redhat_00001.1.el10eap, eap8-javaee-security-soteria-0:3.0.3-2.redhat_00001.1.el10eap. Affected product named by the advisory: Red Hat Enterprise Linux 1.
Medium [CVE-2026-5138] Information disclosure via improper validation of nested request parameters
Information disclosure via improper validation of nested request parameters. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-639. Red Hat lists fixing advisory RHSA-2026:34366 with package foreman-0:3.14.0.17-1.el9sat, foreman-0:3.18.0.7-1.el9sat, foreman-0:3.12.0.17-1.el9sat, foreman-0:3.12.0.17-1.el8sat. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
Medium [CVE-2026-58015] Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash. To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat lists Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-55956] Improper Authorization Allows Security Constraint Bypass
Improper Authorization Allows Security Constraint Bypass. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-551. Red Hat lists fixing advisory RHSA-2026:39189 with package tomcat11-main-11.0.23-0.1.hum1, tomcat-catalina, jws7-tomcat-0:11.0.21-5.redhat_00004.1.el10jws, jws7-tomcat-0:11.0.21-5.redhat_00004.1.el8jws. Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-13503] antlr ANTLR4: Path traversal via manipulation of getImportedVocabFile function
A vulnerability was detected in antlr ANTLR4 up to 4.13.2. Affected by this issue is the function getImportedVocabFile of the file tool/src/org/antlr/v4/parse/TokenVocabParser.java of the component tokenVocab Grammar Option Handler. The manipulation results in path traversal. The attack can be executed remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. This could allow unauthorized access to sensitive files and directories on the system. Successful exploitation requires a specific scenario where an application using ANTLR4 is configured to accept and parse untrusted, attacker-supplied grammar files containing a manipulated tokenVocab option. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-58058] Denial of Service via crafted IPv6 response
Nmap through 7.99 does not keep the IPv6 extension-header walk within the captured packet in ipv6_get_data_primitive (libnetutil/netutil.cc), so the pointer advances past the buffer and the remaining-length computation underflows to a large value. A scanned target or on-path attacker returning a crafted IPv6 response with a truncated extension header can trigger out-of-bounds reads and a crash during raw IPv6 scans. A flaw was found in Nmap. This can lead to an integer underflow, causing out-of-bounds reads and a denial of service (DoS) due to a crash during raw IPv6 scans. Red Hat rates this flaw as Moderate rather than the AI-assigned Important severity. The Aegis AI-Bot rated UI:N (no user interaction), but nmap is a command-line scanning tool that an operator must manually invoke — initiating a scan is user interaction per the CVSS definition of UI:R. Correcting UI:N to UI:R reduces the CVSS from 7.5 to 6.5, aligning with the upstream CVEORG assessment. Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-58051] Denial of service or information disclosure via malformed SSH publickey response
libssh2 through 1.11.1 grows its publickey list with SSH2_REALLOC but does not zero-initialize new entries before parsing populates them, so a parse failure reaching the cleanup path leaves libssh2_publickey_list_free operating on an uninitialized entry. A malicious SSH server offering the publickey subsystem can use a malformed response to make cleanup free an uninitialized, attacker-influenceable attrs pointer in a connecting libssh2 client. A flaw in libssh2 allows a malicious SSH server to send a malformed public key response, triggering an invalid memory cleanup. This can cause the connecting client application to crash or leak information. Moderate: This flaw in libssh2 can lead to a denial of service or information disclosure in client applications when connecting to a malicious SSH server. The vulnerability arises from improper handling of uninitialized memory during public key list processing, which an attacker can trigger with a specially crafted response. Exploitation requires active interaction with a compromised or malicious server, limiting the attack surface to untrusted connections. Note: Red Hat Enterprise Linux (RHEL) 8 and newer are not affected by this flaw, as they do not ship the libssh2 package. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-824.
Medium [CVE-2026-48758] @sigstore/core: Signature bypass due to incorrect encoding in preAuthEncoding
sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be mutated after signing without invalidating the signature and breaking the type-binding guarantee that DSSE is designed to provide. This issue is fixed in version 3.2.1. This encoding truncates Unicode characters to their low byte, allowing an attacker to substitute characters in the payloadType with Unicode variants that produce identical PAE bytes. As a result, the payloadType can be mutated after a digital signature has been applied without invalidating the signature, thereby bypassing the intended type-binding guarantee of the Digital Signature Standard for Entity Authentication (DSSE). Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-347. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Dev Spaces; Red Hat Satellite 6; Self-service automation portal 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-54753] `nx graph` dev server permissive CORS policy
Nx is a monorepo solution for TypeScript and polyglot codebases. From 17.0.4 until 22.7.2 and 23.0.0-beta.2, the local HTTP server started by nx graph sent Access-Control-Allow-Origin: * on every response, letting any website a developer visited read the server's responses cross-origin — including the full project graph and the output of the /help endpoint, which runs a target's configured help command. The practical impact is typically cross-origin information disclosure, but can be arbitrary command injection in rare cases. A flaw was found in Nx, a monorepo solution for managing multiple projects. This misconfiguration allows a remote attacker to read sensitive project information, such as the full project graph, from a developer's system when they visit a malicious website. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N). Weakness: CWE-346. Affected Red Hat products: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10. Red Hat does not currently list a fixing RHSA for this CVE.