Red Hat Linux Security Advisories & CVEs
3200 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-34956] Openvswitch: open vswitch: denial of service via malformed ftp epasv command
A flaw was found in Open vSwitch. This heap access error can lead to a crash, resulting in a Denial of Service (DoS) for the affected system. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Fast Datapath for RHEL 7; Fast Datapath for RHEL 8; Fast Datapath for RHEL 9; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4; Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: openvswitch.
Medium [CVE-2026-34002] X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling
X.Org X server: Information disclosure or Denial of Service via out-of-bounds read in XKB modifier map handling. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-805. Affected package(s): tigervnc, xorg-x11-server-Xwayland, xorg-x11-server. Resolved in Red Hat advisory RHSA-2026:24341 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 1; and 1 more.
Medium [CVE-2026-34000] X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing.
X.Org X server: Information disclosure and denial of service via out-of-bounds read in XKB geometry processing.. Red Hat rates this moderate (CVSS 6.1). Weakness: CWE-125. Affected package(s): tigervnc, xorg-x11-server-Xwayland, xorg-x11-server. Resolved in Red Hat advisory RHSA-2026:24341 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 6; and 1 more.
Medium [CVE-2026-7915] Insufficient data validation in DevTools
Insufficient data validation in DevTools. Red Hat rates this important (CVSS 4.3). Weakness: CWE-346. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-7909] Inappropriate implementation in ServiceWorker
Inappropriate implementation in ServiceWorker. Red Hat rates this important (CVSS 6.8). Weakness: CWE-807. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-7904] Out of bounds read in Fonts
Out of bounds read in Fonts. Red Hat rates this important (CVSS 6.5). Weakness: CWE-125. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-33006] timing attack allows a bypass of digest authentication
timing attack allows a bypass of digest authentication. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-208. Affected package(s): httpd-main. Resolved in Red Hat advisory RHSA-2026:17080 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-33007] NULL pointer dereference can cause a child process crash
NULL pointer dereference can cause a child process crash. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-476. Affected package(s): httpd, mod_authn_socache.so, httpd:2.4, jbcs-httpd24-httpd, httpd-main. Resolved in Red Hat advisory RHSA-2026:27200 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 7.
Medium [CVE-2026-33523] HTTP response splitting forwarding malicious status line
HTTP response splitting forwarding malicious status line. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-93. Affected package(s): httpd-main. Resolved in Red Hat advisory RHSA-2026:17080 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-24072] Privilege Escalation via .htaccess file manipulation
Privilege Escalation via.htaccess file manipulation. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-73. Affected package(s): httpd-main. Resolved in Red Hat advisory RHSA-2026:13938 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-42404] Information disclosure and network access bypass via PolicyReference API
Information disclosure and network access bypass via PolicyReference API. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-918. Affected package(s): neethi. Resolved in Red Hat advisory RHSA-2026:19835 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-42402] Denial of Service via algorithmic complexity in policy normalization
Denial of Service via algorithmic complexity in policy normalization. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-770. Affected package(s): neethi. Resolved in Red Hat advisory RHSA-2026:19835 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-42403] Denial of Service via circular policy references
Denial of Service via circular policy references. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-606. Affected package(s): neethi. Resolved in Red Hat advisory RHSA-2026:19835 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-3833] Policy bypass due to case-sensitive nameConstraints comparison
Policy bypass due to case-sensitive nameConstraints comparison. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-178. Affected package(s): rhui5/installer-rhel9:1781525693, libtasn1, gnutls, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952, discovery/discovery-server-rhel9:1782159791. Resolved in Red Hat advisory RHSA-2026:20613 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 12 more.
Medium [CVE-2026-5142] Cross-tenant private SSH key disclosure via taxonomy scoping bypass
Cross-tenant private SSH key disclosure via taxonomy scoping bypass. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-639. Affected package(s): foreman. Resolved in Red Hat advisory RHSA-2026:34366 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
Medium [CVE-2026-7163] Authenticated users can gain administrative access to OpenShift clusters via credential disclosure
Authenticated users can gain administrative access to OpenShift clusters via credential disclosure. Red Hat rates this important (CVSS 6.1). Weakness: CWE-312. Affected package(s): multicluster-engine/assisted-service. Resolved in Red Hat advisory RHSA-2026:12116 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-7500] Improper Access Control on Keycloak Server when the account Account API feature is disabled
Improper Access Control on Keycloak Server when the account Account API feature is disabled. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-425. Affected package(s): rhbk/keycloak-operator-bundle:26.4.13, rhbk/keycloak-rhel9-operator:26.4, rhbk/keycloak-rhel9, rhbk/keycloak-rhel9:26.4, rhbk/keycloak-operator-bundle:26.6.3, rhbk/keycloak-rhel9:26.6. Resolved in Red Hat advisory RHSA-2026:30049 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-4873] Information disclosure due to incorrect TLS connection reuse
Information disclosure due to incorrect TLS connection reuse. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-319. Affected package(s): curl-main. Resolved in Red Hat advisory RHSA-2026:12916 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-5773] Wrong file transfer due to incorrect SMB connection reuse
Wrong file transfer due to incorrect SMB connection reuse. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1025. Affected package(s): curl-main. Resolved in Red Hat advisory RHSA-2026:12916 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-6253] Proxy credential disclosure via redirects to unauthenticated proxies
Proxy credential disclosure via redirects to unauthenticated proxies. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-201. Affected package(s): curl-main. Resolved in Red Hat advisory RHSA-2026:12916 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.