Red Hat Linux Security Advisories & CVEs
11687 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-68489] Plesk Extensions Ruby and Node.js Toolkit: Arbitrary Code Execution via Static Code Injection
Plesk Extensions Ruby and Node.js Toolkit: Arbitrary Code Execution via Static Code Injection. Red Hat rates this important (CVSS 8.8). Weakness: CWE-94. Affected products named by the advisory: Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces.
High [CVE-2026-53714] Information Disclosure via Unauthenticated xDS gRPC Server
Information Disclosure via Unauthenticated xDS gRPC Server. Red Hat rates this important (CVSS 7.4). Weakness: CWE-306.
High [CVE-2026-82049] Python tarfile module: File modification and content disclosure via crafted archives
Python tarfile module: File modification and content disclosure via crafted archives. Red Hat rates this important (CVSS 7.1). Weakness: CWE-59. Red Hat lists fixing advisory RHSA-2026:68135 with package python3-11-main-3.11.16-1.4.hum1, python3-12-main-3.12.14-1.3.hum1, python3-10-main-3.10.21-1.3.hum1, python3-13-main-3.13.15-1.3.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-82035] Arbitrary file write via path traversal vulnerability
Arbitrary file write via path traversal vulnerability. Red Hat rates this important (CVSS 7.1). Weakness: CWE-22. Affected product named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3.
High [CVE-2026-53659] Denial of Service via unbounded gzip decompression
Denial of Service via unbounded gzip decompression. Red Hat rates this important (CVSS 7.5). Weakness: CWE-409.
High [CVE-2026-55451] Denial of Service via Prototype Pollution
Denial of Service via Prototype Pollution. Red Hat rates this important (CVSS 8.2). Weakness: CWE-915. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat Openshift Data Foundation 4.
High [CVE-2026-84445] Denial of Service via malformed RPC requests
Denial of Service via malformed RPC requests. Red Hat rates this important (CVSS 7.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:72884 with package rhoai/odh-kserve-agent-rhel9:1789570413, rhacm2/multicluster-role-assignment-rhel9:1790198006, cluster-observability-operator/prometheus-rhel9:1790857922, multicluster-engine/hypershift-addon-rhel9-operator:1790117675. Affected product named by the advisory: Red Hat Enterprise Linux 7.
High [CVE-2026-90947] out-of-bounds write in lighting effects plugin via crafted preset file
out-of-bounds write in lighting effects plugin via crafted preset file. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:75575 with package gimp-2:3.0.4-4.el9_8.14. Affected product named by the advisory: Red Hat Enterprise Linux 9.
High [CVE-2026-90949] heap-based buffer overflow in PSP loader due to selection-channel geometry mismatch
heap-based buffer overflow in PSP loader due to selection-channel geometry mismatch. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8.
High [CVE-2026-90948] heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions
heap-based buffer overflow in ICO loader via integer overflow in embedded PNG dimensions. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:75575 with package gimp-2:3.0.4-4.el9_8.14. Affected product named by the advisory: Red Hat Enterprise Linux 9.
High [CVE-2023-32803] Failure to remove TrustCor root certificates
Failure to remove TrustCor root certificates. Red Hat rates this important (CVSS 8.1). Weakness: CWE-459. Red Hat lists fixing advisory RHSA-2026:40570 with package ca-certificates-main-2025.2.80_v9.0.304-9.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift Container Platform 4.
High [CVE-2026-84635] Processing maliciously crafted web content may lead to an unexpected process termination
Processing maliciously crafted web content may lead to an unexpected process termination. Red Hat rates this important (CVSS 8.8). Weakness: CWE-664. Red Hat lists fixing advisory RHSA-2026:69098 with package webkit2gtk3-0:2.54.0-1.el9_8, webkit2gtk3-0:2.54.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
Medium [CVE-2026-90831] Memory corruption via local manipulation of ELF String Table
Memory corruption via local manipulation of ELF String Table. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-90830] Local denial of service via null pointer dereference in Section Merge
Local denial of service via null pointer dereference in Section Merge. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-90829] Null pointer dereference via SHT_GROUP Section manipulation
Null pointer dereference via SHT_GROUP Section manipulation. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-90828] Null pointer dereference via elf_orphan_compatible function
Null pointer dereference via elf_orphan_compatible function. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-94282] OOB read in XI2 enter/leave/focus cookie conversion (`wireToEnterLeave`)
OOB read in XI2 enter/leave/focus cookie conversion (`wireToEnterLeave`). Red Hat rates this moderate (CVSS 6.1).
Medium [CVE-2026-64753] Processing maliciously crafted web content may disclose sensitive user information
Processing maliciously crafted web content may disclose sensitive user information. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-359. Red Hat lists fixing advisory RHSA-2026:69098 with package webkit2gtk3-0:2.54.0-1.el9_8, webkit2gtk3-0:2.54.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
Medium [CVE-2026-53716] Denial of Service via uncontrolled gzip decompression of Wasm HTTP fetch
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip. Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1. A remote attacker, by providing a specially crafted compressed WebAssembly (Wasm) payload through a tenant-controlled URL, can exploit a vulnerability where the system decompresses the gzip file without limiting the output size. This can lead to an uncontrolled memory allocation, causing the controller to terminate due to out-of-memory conditions. The resulting restarts can cause a persistent denial of service across multiple tenants. RH Connectivity Link includes an affected Envoy Gateway version.
Medium [CVE-2026-53715] Denial of Service via Wasm cache improper synchronization
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer. ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer. Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1. Improper synchronization in the Wasm cache handling allows an attacker with pod-network access and tenant permissions to trigger a race condition. By flooding GET requests, an attacker can cause a read-write overlap, leading to the termination of the controller process. Red Hat Connectivity Link includes an affected Envoy Gateway version below 1.7.4. Affected product named by the advisory: Red Hat Connectivity Link 1.