Red Hat Linux Security Advisories & CVEs
5454 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Linux release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux advisories
Medium [CVE-2026-59925] Denial of Service via crafted Markdown input
Denial of Service via crafted Markdown input. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1333.
Medium [CVE-2026-59926] Cross-Site Scripting via unescaped HTML class attribute in Admonition directive
Cross-Site Scripting via unescaped HTML class attribute in Admonition directive. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-79.
Medium [CVE-2026-59923] Arbitrary code execution through crafted Markdown links
Arbitrary code execution through crafted Markdown links. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-79.
Medium [CVE-2026-59930] Same-page navigation redirection due to predictable heading IDs
Same-page navigation redirection due to predictable heading IDs. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-79.
Medium [CVE-2026-59922] Denial of Service via crafted input
Mistune is a Python Markdown parser with renderers and plugins. Prior to 3.3.0, a run of closed tilde, equals-sign, or caret marker pairs around a character causes quadratic work in src/mistune/plugins/formatting.py when the strikethrough, mark, or insert plugin scans for matching markers from each possible start position, allowing denial of service through CPU exhaustion. This issue is fixed in version 3.3.0. A remote attacker could exploit this vulnerability by providing specially crafted input containing specific marker pairs (tilde, equals-sign, or caret). This crafted input causes the parser to perform quadratic work, leading to excessive CPU consumption. This can result in a denial of service (DoS) for the affected system. This Moderate flaw in the Mistune Python Markdown parser can lead to a denial of service. This vulnerability primarily affects Red Hat products where the strikethrough, mark, or insert plugins are explicitly enabled, as these are not part of Mistune's default configuration. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333. Affected Red Hat products: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-29007] Out-of-bounds read leads to denial of service via crafted TCP packets
U-Boot through 2026.04-rc3 contains an out-of-bounds read vulnerability in tcp_rx_state_machine() (net/tcp.c) when CONFIG_PROT_TCP is enabled, allowing remote attackers to read beyond TCP segment boundaries by crafting a malicious packet with a mismatched IP total length and TCP data offset field. Attackers can send a packet with an IP total length of 40 bytes and a TCP data offset claiming 60 bytes of header to cause tcp_parse_options() to read 40 bytes past the end of the TCP segment, potentially corrupting connection state variables such as rmt_win_scale and rmt_timestamp to disrupt TCP window calculations. A flaw was found in U-Boot. A remote attacker can exploit an out-of-bounds read vulnerability in the `tcp_rx_state_machine()` function when the Transmission Control Protocol (TCP) is enabled. Red Hat ships U-Boot tools and related Python utility packages in Fedora and EPEL community repositories. The vulnerable code is in U-Boot's TCP state machine (tcp_rx_state_machine in net/tcp.c) and requires CONFIG_PROT_TCP to be enabled at compile time. This vulnerability does not affect any Red Hat product — only community packages. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-125.
Medium [CVE-2026-59895] Arbitrary markup injection via improper handling of class names in server-side rendering.
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.0.0 before 4.12.27, cx() in hono/css composes class names from plain strings but marks the result as already escaped without HTML-escaping the input, allowing untrusted className values used in a JSX class attribute during server-side rendering to break out of the attribute and inject arbitrary markup. This issue is fixed in version 4.12.27. This could result in Cross-Site Scripting (XSS) attacks, where malicious scripts can be executed in a user's browser. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-79. Affected Red Hat products: Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; Red Hat Developer Hub; Red Hat OpenShift Dev Spaces. Red Hat lists Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-59896] Information disclosure due to improper context isolation in server-side rendering
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.11.8 before 4.12.27, hono/jsx did not isolate context values per request during server-side rendering, allowing createContext, useContext, jsxRenderer, or useRequestContext data from a different in-flight request to be used after an await in an async component. This issue is fixed in version 4.12.27. This could lead to information disclosure. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). Weakness: CWE-653. Affected Red Hat products: Red Hat Ansible Automation Platform 2; Red Hat Developer Hub; Red Hat OpenShift Dev Spaces. Red Hat lists Migration Toolkit for Applications 8; Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-59897] Information disclosure due to incorrect header de-duplication in AWS API Gateway v1 adapter
Hono is a Web application framework that provides support for any JavaScript runtime. From 4.3.3 before 4.12.27, the AWS API Gateway v1 adapter can drop a distinct repeated request header value because it de-duplicates values using a substring comparison instead of an exact match, so middleware or application logic that depends on the complete X-Forwarded-For chain, rate limiting, audit logging, or proxy-chain validation can receive incomplete data. This issue is fixed in version 4.12.27. Consequently, this could result in information disclosure or the bypass of security controls. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-1289. Affected Red Hat products: Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; Red Hat Developer Hub; Red Hat OpenShift Dev Spaces. Red Hat lists Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-59890] MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)
MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD). Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-1025. Red Hat lists fixing advisory RHSA-2026:37530 with package python-setuptools-main-83.0.0-4.hum1.
Medium [CVE-2026-59883] Cross-host cookie disclosure and injection due to improper domain matching in CookieJar.
Guzzle is an extensible PHP HTTP client. Prior to 7.12.3, CookieJar did not restrict cookies scoped to IP-address or bare-numeric Domain values to the exact host that set them, because SetCookie::matchesDomain() applied ordinary suffix matching to domains such as 192.168.0.1, [::1], or 1, allowing cross-host cookie disclosure, cookie injection, or session fixation. This issue is fixed in version 7.12.3. This vulnerability could allow a remote attacker to disclose cookies across different hosts, inject malicious cookies, or fixate user sessions, potentially leading to unauthorized access or session hijacking. Red Hat's products are not affected by this flaw because the guzzlehttp/guzzle PHP library is not shipped in any Red Hat product. Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-472.
Medium [CVE-2026-42505] Go crypto/tls: Information disclosure in Encrypted Client Hello
Go crypto/tls: Information disclosure in Encrypted Client Hello. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:36477 with package golang1-25-main-1.25.12-0.1.hum1, golang1-26-main-1.26.5-0.1.hum1.
Medium [CVE-2026-59262] Information disclosure via histories GraphQL field
Information disclosure via histories GraphQL field. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-639.
Medium [CVE-2026-59876] Prototype pollution vulnerability in Text Format extension
Prototype pollution vulnerability in Text Format extension. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-915.
Medium [CVE-2026-59871] Denial of Service due to incorrect PAX path handling
Denial of Service due to incorrect PAX path handling. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-843.
Medium [CVE-2026-59875] Denial of Service via crafted archive with NUL bytes in metadata
Denial of Service via crafted archive with NUL bytes in metadata. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-170.
Medium [CVE-2026-54423] Arbitrary IPMI command execution via send_raw deployment step
Arbitrary IPMI command execution via send_raw deployment step. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-862.
Medium [CVE-2026-56297] Remote code execution or denial of service via use-after-free race condition
Remote code execution or denial of service via use-after-free race condition. Red Hat rates this moderate (CVSS 5.6). Weakness: CWE-364.
Medium [CVE-2026-60001] Brute-force attacks facilitated due to insufficient authentication delay
Brute-force attacks facilitated due to insufficient authentication delay. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-307. Red Hat lists fixing advisory RHSA-2026:37382 with package openssh-main-10.4p1-1.hum1.
Medium [CVE-2026-60000] Denial of Service via excessive GSSAPI authentication attempts
Denial of Service via excessive GSSAPI authentication attempts. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-307. Red Hat lists fixing advisory RHSA-2026:37382 with package openssh-main-10.4p1-1.hum1.