Red Hat Linux Security Advisories & CVEs
3200 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-57221] Information disclosure via authorization bypass in AMQP 0-9-1 operations
RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.declare and exchange.declare AMQP 0-9-1 operations, allowing any authenticated user who can connect to a virtual host to enumerate queue and exchange names and read queue message and consumer counts. This issue is fixed in versions 3.13.15, 4.0.20, 4.1.11, and 4.2.6. A flaw was found in RabbitMQ. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N). Weakness: CWE-425. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0 as not affected. Red Hat fixing advisory: RHSA-2026:35939, RHSA-2026:35940.
Medium [CVE-2026-57218] Information disclosure due to improper consumer reauthorization
RabbitMQ is a messaging and streaming broker. Prior to 4.2.6, RabbitMQ AMQP 0-9-1 allows an existing consumer to keep receiving messages after OAuth token expiry or connection.update_secret refresh to reduced scopes because existing consumers are not canceled or reauthorized at delivery time after the channel user state changes. This issue is fixed in version 4.2.6. A flaw was found in RabbitMQ. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-1220. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0 as not affected. Red Hat fixing advisory: RHSA-2026:35939, RHSA-2026:35940.
Medium [CVE-2026-57214] Cross-site Scripting in management UI allows arbitrary JavaScript execution
RabbitMQ is a messaging and streaming broker. Prior to 4.2.5, the RabbitMQ management UI renders the x-internal-purpose queue or exchange argument into an HTML title attribute without proper escaping on the Queues and Exchanges pages, allowing a user with permission to declare a queue or exchange to execute JavaScript in another user's browser. This issue is fixed in version 4.2.5. This vulnerability allows a user with permissions to declare a queue or exchange to inject and execute arbitrary JavaScript code in another user's browser, leading to a Cross-site Scripting (XSS) attack. Red Hat severity: Important — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-79. Affected Red Hat products: Red Hat Hardened Images. Under investigation: Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0. Red Hat fixing advisory: RHSA-2026:35939, RHSA-2026:35940.
Medium [CVE-2026-57213] Information Disclosure via Cross-Site Scripting in Federation Management
RabbitMQ is a messaging and streaming broker. Prior to 3.13.14, 4.0.19, 4.1.10, and 4.2.5, the rabbitmq_federation_management plugin renders the consumer_tag field on the Federation Status page without HTML escaping, allowing a user who can configure a federation upstream or policy to execute JavaScript in the browser of a user viewing that page. This issue is fixed in versions 3.13.14, 4.0.19, 4.1.10, and 4.2.5. This cross-site scripting (XSS) vulnerability occurs because the `consumer_tag` field on the Federation Status page does not properly escape HTML. When another user views the Federation Status page, the injected script executes in their browser, potentially leading to information disclosure or unauthorized actions. Red Hat severity: Moderate — CVSS 5.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:L/A:N). Weakness: CWE-79. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0 as not affected. Red Hat fixing advisory: RHSA-2026:35939, RHSA-2026:35940.
Medium [CVE-2026-57157] Out-of-bounds read leads to information disclosure and denial of service
Out-of-bounds read leads to information disclosure and denial of service. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125.
Medium [CVE-2026-57158] Information disclosure via truncated RDPGFX planar payload
Information disclosure via truncated RDPGFX planar payload. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-125.
Medium [CVE-2026-15146] Server-Side Request Forgery via FTP PASV response IP address validation bypass
Server-Side Request Forgery via FTP PASV response IP address validation bypass. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-918.
Medium [CVE-2026-53449] Arbitrary file overwrite via CLI command
Arbitrary file overwrite via CLI command. Red Hat rates this moderate (CVSS 6). Weakness: CWE-22.
Medium [CVE-2026-8595] Stored Cross-Site Scripting via malicious dashboard field name
Stored Cross-Site Scripting via malicious dashboard field name. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-79.
Medium [CVE-2026-8609] Denial of Service via unbounded memory growth in OAuth login route
Denial of Service via unbounded memory growth in OAuth login route. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770.
Medium [CVE-2026-33382] Denial of Service via excessive memory allocation from large API request payloads
Denial of Service via excessive memory allocation from large API request payloads. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770.
Medium [CVE-2026-56373] Use-after-free vulnerability in PDB decoder allows denial of service or limited data corruption.
Use-after-free vulnerability in PDB decoder allows denial of service or limited data corruption. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-825.
Medium [CVE-2026-14461] Denial of Service via crafted DNS responses
Denial of Service via crafted DNS responses. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-823.
Medium [CVE-2026-42771] Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email
Possible Out of Bounds Read in X509_VERIFY_PARAM_set1_email(). Red Hat rates this low (CVSS 6.5). Weakness: CWE-805.
Medium [CVE-2026-39244] Denial of Service via crafted ZIP file leading to excessive memory allocation
Denial of Service via crafted ZIP file leading to excessive memory allocation. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-409.
Medium [CVE-2026-39872] Maliciously crafted web content may cause unexpected process crash
Maliciously crafted web content may cause unexpected process crash. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43676] Maliciously crafted web content may cause unexpected process crash
Maliciously crafted web content may cause unexpected process crash. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43707] Maliciously crafted web content may cause unexpected process crash
Maliciously crafted web content may cause unexpected process crash. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-119. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43712] Maliciously crafted web content may cause unexpected process crash
Maliciously crafted web content may cause unexpected process crash. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-43713] Visiting a website may leak sensitive data
Visiting a website may leak sensitive data. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-284. Red Hat lists fixing advisory RHSA-2026:42088 with package webkit2gtk3-0:2.52.5-1.el8_10, webkit2gtk3-0:2.52.5-1.el9_8. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.