Red Hat Linux Security Advisories & CVEs
4712 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-18427] @fastify/static: @fastify/static: Information disclosure via route guard bypass
@fastify/static: @fastify/static: Information disclosure via route guard bypass. Red Hat rates this important (CVSS 7.5). Weakness: CWE-41. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-34191] SQL Injection via apr_dbd_oracle
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This vulnerability, known as SQL Injection, occurs in the `apr_dbd_oracle` provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the database. Red Hat products are not affected by this flaw. The vulnerability is specific to the apr_dbd_oracle database driver module in the Apache Portable Runtime Utility (apr-util), which provides Oracle database connectivity. Red Hat does not build apr-util with Oracle database support enabled, so the vulnerable code is not present in any shipped Red Hat package. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-89. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images as not affected.
High [CVE-2026-34501] Heap buffer overflow in redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. Users are recommended to upgrade to version 1.6.4, which fixes the issue. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service. The impact of this vulnerability is rated as Moderate. Although the flaw involves a heap buffer overflow and the CVSS base score reflects an unauthenticated network vector, exploitation requires the attacker to control or compromise the Redis server that the application queries. An attacker cannot trigger this condition by sending data directly to the affected application — they must first be in a position to influence Redis responses, either by compromising the Redis backend or performing a man-in-the-middle attack on the connection. Additionally, the overflow does not result in arbitrary code execution; the observed impact is limited to a denial of service. This prerequisite significantly limits real-world exploitability. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.
High [CVE-2026-34502] Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of service. The impact of this vulnerability is rated as Moderate. While the flaw is network-reachable and requires no authentication against the application itself, exploitation depends on the attacker controlling or compromising the memcached server that the application queries. An attacker cannot trigger the denial of service by sending data directly to the affected application — they must first be in a position to influence memcached responses, either by compromising the memcached backend or performing a man-in-the-middle attack on the connection between the application and memcached. This prerequisite significantly limits the real-world exploitability compared to a direct network denial-of-service attack. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.
High [CVE-2026-46581] com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include. Red Hat rates this important (CVSS 8.1). Weakness: CWE-94. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-68480] Safe RET Interrupt Vulnerability
Safe RET Interrupt Vulnerability. Red Hat rates this important (CVSS 8.8). Weakness: CWE-201. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-63687] Security bypass due to improper handling of authorization parameters
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like code_challenge and nonce, the attacker can undermine the integrity of Proof Key for Code Exchange (PKCE) and OpenID Connect replay protection, potentially leading to unauthorized access or session hijacking. This could lead to unauthorized access or session hijacking in applications utilizing affected Red Hat middleware products that rely on these security mechanisms. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). Weakness: CWE-807.
High [CVE-2026-66909] Remote Code Execution via unsafe deserialization of JMS ObjectMessage
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. The Java Message Service (JMS) transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. This vulnerability could lead to a denial of service or, in certain configurations, enable remote code execution on the affected system. This vulnerability in Apache CXF's JMS transport is rated as Important because it allows for remote code execution or denial of service if an attacker can send a specially crafted JMS ObjectMessage to a service. This is particularly relevant in Red Hat environments where Apache CXF is used in applications that process JMS messages, as the default deserialization behavior without type restrictions increases the attack surface. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-502.
High [CVE-2026-18649] unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders
unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:53451 with package gstreamer1-plugins-good-0:1.26.7-2.el10_2.3, gstreamer1-plugins-good-0:1.22.12-7.el9_8.2, gstreamer1-plugins-good-0:1.16.1-7.el8_10.3. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8. Affected products named by the advisory: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; and 7 more.
High [CVE-2026-64597] fix double-free in SMB2_close replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of arbitrary code. A double-free vulnerability exists in the SMB2_close() replay mechanism where a response buffer's bookkeeping state can become stale across retry attempts, leading to the same buffer being freed twice. This could result in memory corruption, potentially causing a denial of service (kernel panic) or other undefined behavior. Exploitation requires the victim system to connect to a malicious or compromised SMB server. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-415. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux for NVIDIA 26. Under investigation: Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:64775, RHSA-2026:66180. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-71312] Server-Side Command Execution via Malicious SFTP Filenames
Server-Side Command Execution via Malicious SFTP Filenames. Red Hat rates this important (CVSS 8). Weakness: CWE-78.
High [CVE-2026-34966] Information disclosure via Server-Side Request Forgery (SSRF) bypass
Information disclosure via Server-Side Request Forgery (SSRF) bypass. Red Hat rates this important (CVSS 7.6). Weakness: CWE-918.
High [CVE-2026-71309] Backend Root Escape via Incomplete Path Validation
Backend Root Escape via Incomplete Path Validation. Red Hat rates this important (CVSS 8.1). Weakness: CWE-22.
High [CVE-2026-70428] Arbitrary file write via path traversal
Arbitrary file write via path traversal. Red Hat rates this important (CVSS 8.8). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:60250 with package ocp-tools-4/jenkins-rhel8:1786533565, ocp-tools-4/jenkins-rhel9:1787124635, ocp-tools-4/jenkins-rhel9:1787124925, ocp-tools-4/jenkins-rhel9:1787125069. Affected product named by the advisory: OpenShift Developer Tools and Services.
High [CVE-2026-70426] Arbitrary code execution via deserialization filter bypass
In Remoting 3384.v60d89463d9e0 and earlier, except 3355.3357.v931d3c992987, included in Jenkins 2.575 and earlier, LTS 2.568.1 and earlier, the JEP-200 class filter is not applied to classes resolved via a fallback path in the Remoting deserialization implementation, allowing agent processes, code running on agents, and attackers with Agent/Connect permission to bypass the JEP-200 deserialization filter for classes on the Jenkins core classpath. Successful exploitation could lead to arbitrary code execution on the Jenkins controller. This Important flaw in Jenkins Remoting allows authenticated attackers or compromised agent processes to execute arbitrary code on the Jenkins controller. The vulnerability stems from an incomplete deserialization filter bypass, enabling full compromise of the Jenkins environment. This impacts Red Hat OpenShift Developer Tools & Services deployments that utilize Jenkins agents, as it could lead to unauthorized control over the build and deployment infrastructure. Agent traffic in Red Hat OpenShift Developer Tools is restricted to a cluster's internal pod network which reduces the attack vector from Network to Adjacent. Red Hat severity: Important — CVSS 8.3 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-502.
High [CVE-2026-70427] Arbitrary file write via crafted archives and symbolic links
Jenkins 2.575 and earlier, LTS 2.568.1 and earlier does not safely handle symbolic links with effectively empty names during the extraction of `.tar` and `.tar.gz` archives, allowing attackers able to control agent processes to provide crafted archives to the controller to write files to arbitrary locations on the file system, restricted only by file system access permissions of the user running Jenkins. A flaw was found in Jenkins. Successful exploitation allows an attacker to write files to arbitrary locations on the file system, potentially leading to unauthorized data modification or system compromise. This could result in arbitrary code execution and compromise of the Jenkins instance, for example by writing malicious scripts or plugins into the Jenkins home directory, but requires the attacker to already be able to run an agent process against the controller, limiting the attack surface to build infrastructure that is already at least partially trusted. This is an incomplete fix of a previously disclosed issue (CVE-2026-33001). Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-59. Affected products named by the advisory: OpenShift Developer Tools and Services 4.12; OpenShift Developer Tools and Services 4.13; OpenShift Developer Tools and Services 4.14; OpenShift Developer Tools and Services 4.15; and 7 more.
High [CVE-2026-15572] DCR protocol mapper type-swap policy bypass allows privilege escalation
DCR protocol mapper type-swap policy bypass allows privilege escalation. Red Hat rates this important (CVSS 8.8). Weakness: CWE-843. Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9-operator:26.6-11. Affected products named by the advisory: Red Hat build of Keycloak 26.4.14; Red Hat build of Keycloak 26.6.5.
High [CVE-2026-16442] SAML IdP-initiated broker login bypasses link-only restriction
SAML IdP-initiated broker login bypasses link-only restriction. Red Hat rates this important (CVSS 7.4). Weakness: CWE-346. Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.6.
High [CVE-2026-16102] Default DCR policy allows role forgery via User Property mappers
Default DCR policy allows role forgery via User Property mappers. Red Hat rates this important (CVSS 8.1). Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk-keycloak-rhel9/rhbk-keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.6; Red Hat Single Sign-On 7.
High [CVE-2026-15573] Authorization bypass via unnormalized URI matching in PathMatcher
Authorization bypass via unnormalized URI matching in PathMatcher. Red Hat rates this important (CVSS 8.1). Red Hat lists fixing advisory RHSA-2026:50848 with package rhbk/keycloak-rhel9:26.6-11, rhbk/keycloak-operator-bundle:26.4.14-1, rhbk/keycloak-rhel9, keycloak-services. Affected products named by the advisory: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.6; Red Hat Data Grid 8; Red Hat Single Sign-On 7.