Red Hat Linux Security Advisories & CVEs
11617 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-90996] Denial of Service in NSS responder via crafted zero-length requests
Denial of Service in NSS responder via crafted zero-length requests. Red Hat rates this moderate (CVSS 4). Weakness: CWE-191. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-90995] Local denial of service due to NULL pointer dereference in PAM responder
Local denial of service due to NULL pointer dereference in PAM responder. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: sssd.
Medium [CVE-2026-90994] Denial of Service via malformed PAM v1 requests
Denial of Service via malformed PAM v1 requests. Red Hat rates this moderate (CVSS 4). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2025-24890] Privilege escalation via incorrect repository trust on Windows
Privilege escalation via incorrect repository trust on Windows. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-648.
Medium [CVE-2026-90463] Local OOB Read in NSS Service Request Parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)
Local OOB Read in NSS Service Request Parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`). Red Hat rates this low (CVSS 4). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-88932] Denial of Service via orphaned disk writes on aborted uploads
Denial of Service via orphaned disk writes on aborted uploads. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-459. Red Hat lists fixing advisory RHSA-2026:72722 with package ansible-automation-platform/automation-portal:1790254963, ansible-automation-platform/automation-portal:1790256405. Affected products named by the advisory: Red Hat 3scale API Management Platform 2; Red Hat Developer Hub; Self-service automation portal 2.
Medium [CVE-2026-90698] Denial of Service due to out-of-bounds read
Denial of Service due to out-of-bounds read. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:63224 with package memcached-main-1.6.45-1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2025-64031] Denial of Service via heap-based buffer overflow in gzip writer
Denial of Service via heap-based buffer overflow in gzip writer. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:43818 with package libarchive-main-3.8.8-3.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift Container Platform 4.
Low [CVE-2026-90713] vLLM and tiktoken: Local Denial of Service vulnerability
vLLM and tiktoken: Local Denial of Service vulnerability. Red Hat rates this low (CVSS 3.3). Weakness: CWE-770. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; and 4 more. Affected products named by the advisory: Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-90776] Denial of Service via crafted email headers
Denial of Service via crafted email headers. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. Affected product named by the advisory: Self-service automation portal 2.
High [CVE-2026-90678] HTTP Request Smuggling via HTTP/3 Multiplexer Desynchronization
HTTP Request Smuggling via HTTP/3 Multiplexer Desynchronization. Red Hat rates this important (CVSS 8.9). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:60634 with package haproxy-main-3.0.27-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-90781] Denial of Service via off-by-one stack buffer overflow
Denial of Service via off-by-one stack buffer overflow. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:40573 with package alsa-lib-main-1.2.16.1-2.hum1, alsa-lib-main-1.2.16.1-2.1.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat package: alsa-lib.
Medium [CVE-2026-90771] Prototype Pollution via custom messages
Prototype Pollution via custom messages. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-915. Red Hat lists fixing advisory RHSA-2026:67610 with package grafana13-1-main-13.1.3-0.9.hum1, grafana13-2-main-13.2.1-0.4.hum1, grafana12-4-main-12.4.10-0.3.hum1. Affected products named by the advisory: Red Hat Hardened Images; Gatekeeper 3; Migration Toolkit for Containers; Red Hat Build of Podman Desktop; and 8 more. Affected products named by the advisory: Red Hat Data Grid 8; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 4 more.
Medium [CVE-2022-42917] Privilege escalation via TOCTOU race condition
Privilege escalation via TOCTOU race condition. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-367. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat package: frr.
Medium [CVE-2024-53922] Denial of Service in buffer queue driver
Denial of Service in buffer queue driver. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-120. Affected product named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-52296] out-of-bounds read due to missing required padding in WMA extradata allocation paths
out-of-bounds read due to missing required padding in WMA extradata allocation paths. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-52297] out-of-bounds read due to insufficiently padded extradata in the MOV parsing path
out-of-bounds read due to insufficiently padded extradata in the MOV parsing path. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
Critical [CVE-2026-90558] sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers
sngrep through 1.8.4 Stack Buffer Overflow via SIP Headers. Red Hat rates this critical. Weakness: CWE-120.
High [CVE-2026-90616] Arbitrary code execution via missing symlink protection
Arbitrary code execution via missing symlink protection. Red Hat rates this important (CVSS 7.8). Weakness: CWE-59. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: flatpak.
High [CVE-2026-90560] Denial of Service via out-of-bounds read in ZstdDictDecompress
Denial of Service via out-of-bounds read in ZstdDictDecompress. Red Hat rates this important (CVSS 8.2). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:71675 with package zstd-jni. Affected products named by the advisory: Exploit Intelligence; OpenShift Developer Tools and Services; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 10 more. Affected products named by the advisory: Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat build of Quarkus; Red Hat Ceph Storage 9; and 6 more.