Red Hat Linux Security Advisories & CVEs
4724 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-47428] Arbitrary code execution via crafted browser-runner URL
Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted browser-runner URL to execute arbitrary JavaScript in the Vitest server origin and recover VITEST_API_TOKEN for authenticated API calls. In Vitest Browser Mode, a remote attacker could craft a specific browser-runner URL that, when visited, would allow the execution of arbitrary JavaScript code within the Vitest server. This vulnerability could also lead to the recovery of the VITEST_API_TOKEN, potentially enabling unauthorized authenticated API calls and further compromise of the system. Red Hat has assessed this flaw against its shipping products. The vulnerability requires @vitest/browser (Vitest's opt-in Browser Mode) to be installed and actively enabled; it does not affect the core `vitest` test runner used without Browser Mode. None of Red Hat's shipping products install or execute @vitest/browser, and none configure or enable Browser Mode. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-50650] .NET Framework: Privilege escalation via code injection
Improper control of generation of code ('code injection') in.NET Framework allows an unauthorized attacker to elevate privileges locally. Successful exploitation can lead to local privilege escalation, enabling the attacker to gain higher access rights on the affected system. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-94. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat Hardened Images; Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50649] .NET: Local code execution via deserialization of untrusted data
Deserialization of untrusted data in.NET allows an unauthorized attacker to execute code locally. A flaw was found in.NET. This means that if an attacker can provide specially crafted data, the.NET application may process it in a way that leads to the execution of malicious code on the system where the application is running. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-502. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat Hardened Images; Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50648] .NET Framework: Remote Denial of Service due to uncontrolled resource allocation
Allocation of resources without limits or throttling in.NET Framework allows an unauthorized attacker to deny service over a network. An unauthorized attacker can exploit this vulnerability remotely by causing the system to allocate resources without proper limits or throttling. This uncontrolled resource allocation can lead to a Denial of Service (DoS), making the affected system unresponsive or unavailable to legitimate users. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50528] .NET: Security feature bypass due to incorrect authorization
Incorrect authorization in.NET allows an unauthorized attacker to bypass a security feature over a network. This vulnerability enables an attacker to circumvent intended security controls, potentially leading to unauthorized access or actions within the affected system. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Weakness: CWE-551. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50646] .NET Framework: Local Code Execution via Protection Mechanism Failure
Protection mechanism failure in.NET Framework allows an unauthorized attacker to execute code locally. Successful exploitation of this vulnerability can lead to a complete compromise of the affected system. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-807. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat Hardened Images; Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50527] .NET Framework: Denial of Service via network-based buffer overflow
Stack-based buffer overflow in.NET Framework allows an unauthorized attacker to deny service over a network. Successful exploitation can lead to a denial of service (DoS), making the affected system unavailable to legitimate users. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50526] .NET: Local tampering via improper link resolution
Improper link resolution before file access ('link following') in.NET allows an authorized attacker to perform tampering locally. A flaw was found in.NET. This could lead to unauthorized modification of data or system files. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50525] .NET: Denial of Service due to uncontrolled resource allocation
Allocation of resources without limits or throttling in.NET allows an unauthorized attacker to deny service over a network. A flaw was found in.NET where uncontrolled allocation of resources can lead to a Denial of Service (DoS). An unauthorized remote attacker could exploit this vulnerability by continuously requesting resources without limits or throttling, causing the affected system to become unresponsive or crash. This can disrupt the availability of services running on the.NET framework. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145.
High [CVE-2026-50524] .NET Framework: Denial of Service via improper input validation
Improper validation of specified type of input in.NET Framework allows an unauthorized attacker to deny service over a network. This vulnerability can lead to a Denial of Service (DoS) condition, making the affected system unavailable to legitimate users. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1287. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-47429] Arbitrary code execution and information disclosure via path traversal
Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the project; exposed API write and rerun features such as saveTestFile and rerun could also allow arbitrary script execution. This issue is fixed in versions 3.2.5 and 4.1.0. Additionally, exposed API features could be exploited to execute arbitrary scripts, leading to potential system compromise. Vitest ships a UI and API server (enabled via the --ui or --api flags, or automatically as part of Browser Mode) that exposes file read, file write, and test-rerun functionality over HTTP. Due to an incorrect path-traversal check in the /__vitest_attachment__ handler and related code paths, a remote attacker who can reach this server can read arbitrary files, and via the write/rerun features can achieve arbitrary code execution. Exploitation requires either exposing the server to a network host (--api.host / api.host config) or running the UI/Browser Mode on Windows. Red Hat's shipped products use vitest exclusively as a development-time unit test runner (invoked as `vitest run`, `test:unit`, or `--project` in CI/build pipelines). Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-47303] Privilege Elevation via Authentication Bypass
Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. This can allow the attacker to elevate their privileges within the system. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-472. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:39952, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-47304] .NET Security Feature Bypass Vulnerability
Improper verification of cryptographic signature in.NET allows an unauthorized attacker to bypass a security feature over a network. A flaw was found in.NET. This allows the attacker to bypass a critical security feature, potentially leading to significant compromise of confidentiality, integrity, and availability. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-347. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat Hardened Images; Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:39952, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-47302] .NET: Denial of Service vulnerability due to uncontrolled resource allocation
Allocation of resources without limits or throttling in.NET allows an unauthorized attacker to deny service over a network. A flaw was found in.NET where uncontrolled resource allocation can be exploited by an unauthorized attacker over a network. This vulnerability allows the attacker to exhaust available resources, leading to a Denial of Service (DoS) condition. The lack of limits or throttling mechanisms enables an attacker to disrupt the availability of the affected system. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145.
High [CVE-2026-47300] Privilege Escalation via Incorrect Authentication Algorithm
Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. This vulnerability allows the attacker to elevate their privileges, potentially gaining unauthorized access to sensitive resources or performing actions beyond their intended permissions. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-303. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:39952, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-57108] .NET Core: Denial of Service via type confusion
Access of resource using incompatible type ('type confusion') in.NET Core allows an unauthorized attacker to deny service over a network. By exploiting this flaw, an attacker can make the affected system unavailable to legitimate users. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-843. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:27171, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-45646] Denial of Service via uncontrolled resource allocation
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. This can lead to the affected system becoming unresponsive or unavailable to legitimate users. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Red Hat lists Red Hat Hardened Images as not affected.
High [CVE-2026-56170] Denial of Service via uncontrolled resource allocation
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. This vulnerability allows an unauthorized remote attacker to cause a Denial of Service (DoS) by allocating resources without proper limits or throttling. This can lead to the affected system becoming unresponsive or unavailable to legitimate users. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Hardened Images. Red Hat lists Red Hat OpenShift Dev Spaces as not affected. Red Hat fixing advisory: RHSA-2026:41893, RHSA-2026:41895, RHSA-2026:41897, RHSA-2026:58566, RHSA-2026:58567, RHSA-2026:41899, RHSA-2026:41900, RHSA-2026:41901, RHSA-2026:41894, RHSA-2026:41896, RHSA-2026:41898, RHSA-2026:58568, RHSA-2026:58569, RHSA-2026:58570, RHSA-2026:26638, RHSA-2026:39952, RHSA-2026:42145. Affected products named by the advisory: Red Hat package: dotnet8.0; Red Hat package: dotnet9.0; Red Hat package: dotnet10.0.
High [CVE-2026-50506] Denial of Service due to uncontrolled resource allocation
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. A flaw was found in ASP.NET Core where an unauthorized remote attacker can cause a Denial of Service (DoS) over a network. This vulnerability occurs due to the allocation of resources without proper limits or throttling mechanisms, allowing an attacker to exhaust available resources and disrupt service availability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Red Hat lists Red Hat Hardened Images as not affected.
High [CVE-2026-59885] Denial of Service via crafted ASN.1 OBJECT IDENTIFIER
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call and can deny service to applications that decode untrusted ASN.1 data. The corresponding encoders have the same quadratic behavior when an application re-encodes previously decoded attacker-supplied values. This issue is fixed in version 0.6.4. A flaw was found in pyasn1. The arc-size limit introduced for CVE-2026-23490 does not mitigate this issue. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1050. Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat AI Inference Server 3.3; and 37 more. Affected products named by the advisory: Red Hat Enterprise Linux AI 3.3; Red Hat Hardened Images; Red Hat Migration Toolkit for Applications 8.2; Red Hat OpenShift AI 2.25; and 33 more.