Red Hat Linux Security Advisories & CVEs
3200 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-8924] Cookie injection via malicious HTTP server using super cookies
Cookie injection via malicious HTTP server using super cookies. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-565. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
Medium [CVE-2026-11856] Information disclosure via incorrect Digest authentication header reuse
Information disclosure via incorrect Digest authentication header reuse. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
Medium [CVE-2026-11564] Certificate validation bypass due to incorrect connection reuse
Certificate validation bypass due to incorrect connection reuse. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
Medium [CVE-2026-10536] Use-after-free vulnerability leading to Denial of Service
Use-after-free vulnerability leading to Denial of Service. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-825.
Medium [CVE-2026-50149] JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration
JWT verification bypass allows unauthorized access via HTTPProxy misconfiguration. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-295.
Medium [CVE-2026-54886] Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel
Erlang OTP ssh: Denial of Service via infinite loop in SFTP channel. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-835.
Medium [CVE-2026-53422] Erlang OTP ssh: Information disclosure via SFTP REALPATH handler
Erlang OTP ssh: Information disclosure via SFTP REALPATH handler. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-204. Red Hat lists fixing advisory RHSA-2026:35998 with package erlang27-main-27.3.4.14-1.hum1.
Medium [CVE-2026-54431] DPoP verifier accepts malformed proof with private key material
DPoP verifier accepts malformed proof with private key material. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-358.
Medium [CVE-2026-54430] Server-Side Request Forgery allows unauthorized internal network access
Server-Side Request Forgery allows unauthorized internal network access. Red Hat rates this moderate (CVSS 5.8). Weakness: CWE-918.
Medium [CVE-2026-38969] Request smuggling via re-parsing of Content-Length header
Request smuggling via re-parsing of Content-Length header. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:34975 with package rust-main-1.96.1-1.hum1.
Medium [CVE-2026-53358] use chan timer to close channels in cleanup_listen
use chan timer to close channels in cleanup_listen(). Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-413.
Medium [CVE-2026-50162] File store write outside working directory via symlink traversal
File store write outside working directory via symlink traversal. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22.
Medium [CVE-2026-50151] Credential forwarding via unvalidated Location header during blob upload
Credential forwarding via unvalidated Location header during blob upload. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-522.
Medium [CVE-2026-50163] Information disclosure and arbitrary file access via crafted tarball hardlinks
Information disclosure and arbitrary file access via crafted tarball hardlinks. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-22.
Medium [CVE-2026-48815] Unauthorized certificates accepted due to ignored `certificateOIDs` verification option
Unauthorized certificates accepted due to ignored `certificateOIDs` verification option. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-345.
Medium [CVE-2026-48816] Insufficient verification of data authenticity allows timestamp manipulation
Insufficient verification of data authenticity allows timestamp manipulation. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-345.
Medium [CVE-2026-55688] Cookie injection allows planting cookies for unrelated domains
Cookie injection allows planting cookies for unrelated domains. Red Hat rates this moderate (CVSS 4). Weakness: CWE-346.
Medium [CVE-2026-55597] Heap buffer overwrite via incorrect argument handling in JP2 encoder
Heap buffer overwrite via incorrect argument handling in JP2 encoder. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-787.
Medium [CVE-2026-55595] Denial of Service via invalid arguments to connected-components option
Denial of Service via invalid arguments to connected-components option. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-835.
Medium [CVE-2026-55594] Denial of Service via crafted image in MVG decoder
Denial of Service via crafted image in MVG decoder. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-787.