Red Hat Linux Security Advisories & CVEs
5315 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Linux release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Linux advisories
Medium [CVE-2026-54278] Denial of Service due to excessive memory consumption from compressed request body
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, during cleanup it is possible for a compressed request body to be decompressed into memory in one chunk. An attacker may be able to send a compressed payload in specific situations that could be decompressed into memory, potentially leading to DoS (a zip bomb edge case). This vulnerability is fixed in 3.14.1. This could potentially lead to a Denial of Service (DoS) condition, where the affected system becomes unresponsive or unavailable. Exploitation requires aiohttp deployed as a network-facing HTTP server that accepts compressed request bodies. Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose this server path to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-409. Affected products named by the advisory: Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; and 6 more.
Medium [CVE-2026-54277] Denial of Service via oversized HTTP request lines bypassing max_line_size check
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, it is possible to bypass the max_line_size check in parts of an HTTP request in the C parser. If using the optimised C parser (the default in pre-built wheels), then an attacker may be able to send oversized lines through the HTTP parser and use an excessive amount of memory, potentially leading to DoS. This vulnerability is fixed in 3.14.1. A remote attacker can exploit this vulnerability by sending oversized lines within an HTTP request. This bypasses the max_line_size check in the C parser, causing the system to use an excessive amount of memory. This can lead to a Denial of Service (DoS) condition, making the affected system unavailable. Exploitation requires aiohttp to be deployed as a network-facing HTTP server using the optimised C parser (the default in pre-built wheels). Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose this server/parser path to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-131.
Medium [CVE-2026-54275] TLS SNI check bypass via connection reuse
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, the server_hostname TLS SNI check can be bypassed when an existing connection is reused. This vulnerability is fixed in 3.14.1. This vulnerability allows a remote attacker to bypass the Transport Layer Security (TLS) Server Name Indication (SNI) check. This occurs when an application reuses an existing connection for multiple requests to the same domain but with different server_hostname parameters. Consequently, later requests may succeed by reusing the existing connection, even if they should have been rejected due to the TLS SNI check, potentially leading to unintended information disclosure or integrity issues. Exploitation requires an application using aiohttp as an HTTPS client with connection pooling enabled, issuing multiple requests to the same host with differing server_hostname overrides. Many Red Hat products ship aiohttp as a bundled dependency without this usage pattern. Affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-367. Affected products named by the advisory: Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; and 6 more.
Medium [CVE-2026-54274] Denial of Service via incomplete websocket frame payloads
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, if an attacker sends large incomplete websocket frame payloads, it may be possible to bypass the usual size limits on memory use. This vulnerability is fixed in 3.14.1. This can bypass normal memory usage limits, potentially leading to a Denial of Service (DoS) where the affected system becomes unavailable. Exploitation requires aiohttp deployed as a network-facing HTTP server that exposes WebSocket endpoints to untrusted clients. Many Red Hat products ship aiohttp as a bundled dependency for client libraries, internal automation, or services that do not expose WebSocket listeners to untrusted users. In those configurations, practical risk may be lower, but affected packages should still be updated to aiohttp 3.14.1 or later when fixes are released. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Ansible Automation Platform Ansible Core 2; Red Hat Discovery 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Satellite 6.
Medium [CVE-2026-54279] Host-Only Cookies Become Domain Cookies After CookieJar Persistence
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.1, host-only cookies that are saved with CookieJar.save() and then restored later with CookieJar.load() lose their host-only status. This vulnerability is fixed in 3.14.1. A flaw was found in aiohttp (before 3.14.1). aiohttp is vulnerable to improper cookie scope handling when persisting and reloading CookieJar data. After save/load, host-only cookies are treated as domain cookies, so session data meant for one host may be sent to subdomains on subsequent requests. Red Hat exposure is in Python asyncio services that bundle aiohttp and persist cookie jars to disk, including AI inference, AAP, and other hybrid platform Python containers. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Weakness: CWE-565. Red Hat lists Exploit Intelligence; Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Ansible Automation Platform Ansible Core 2; Red Hat Discovery 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images; Red Hat OpenShift AI (RHOAI); Red Hat Satellite 6; Red Hat Update Infrastructure 4 for Cloud Providers as not affected.
Medium [CVE-2026-50269] CRLF injection in multipart headers
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.0, attacker-controlled input included into multipart/payload headers can be used to modify a request to inject additional headers or similar. In the unlikely situation that an application is passing user-controlled strings into MultipartWriter.append(headers=...) or Payload.headers, then an attacker may be able to modify the request to inject headers or change the contents of the request. This vulnerability is fixed in 3.14.0. This vulnerability, known as CRLF (Carriage Return Line Feed) injection, allows an attacker to modify HTTP requests by injecting malicious input into multipart or payload headers. If an application processes user-controlled data in these headers, an attacker could potentially alter the request's content or inject new headers, leading to unintended application behavior. This Low impact flaw in aiohttp arises from CRLF injection when applications pass untrusted, attacker-controlled input directly into `MultipartWriter.append(headers=...)` or `Payload.headers`. Exploitation is unlikely in typical Red Hat deployments unless custom applications are specifically configured to include unvalidated user input in these HTTP multipart or payload headers, potentially allowing an attacker to inject arbitrary HTTP headers.
Medium [CVE-2026-54269] Denial of Service due to name collision with runtime helpers
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 8.6.0 and 7.6.3, protobufjs accepted certain schema-derived names that could collide with properties used by protobufjs runtime helpers. The known affected names are fields named hasOwnProperty, field or oneof names such as $type when loaded through protobufjs JSON/reflection descriptors, and service methods whose generated helper name is rpcCall. When affected message or service types were used, protobufjs could read schema-controlled data where it expected an own-property helper, reflected type metadata, or the base RPC helper. This could cause deterministic exceptions or recursive calls in affected decode post-checks, verification, object conversion, reflected JSON serialization, or protobufjs RPC helper invocation. This vulnerability is fixed in 8.6.0 and 7.6.3. A remote attacker could exploit this vulnerability by providing specially crafted protobuf definitions or message types that contain names colliding with internal protobufjs runtime helpers. This could lead to deterministic exceptions or recursive calls during various operations, ultimately causing a Denial of Service (DoS) in applications using the library. Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images.
Medium [CVE-2026-54270] Denial of Service due to excessive memory consumption
protobufjs compiles protobuf definitions into JavaScript (JS) functions. From 8.2.0 to 8.4.2, protobufjs preserved unknown wire elements in message.$unknowns and did not provide a decode-time option to discard unknown fields before retaining them. A crafted protobuf payload containing many unknown fields could therefore cause a decoded message to retain substantially more memory than the input size would suggest, even when unknown-field round-tripping is not needed. protobufjs 8.5.0 added the relevant decode-time options, allowing applications that decode untrusted protobuf data to disable unknown-field retention during decode. protobufjs 8.6.2 flips the default so unknown fields are discarded unless explicitly opted into. A flaw was found in protobufjs. A remote attacker could send a specially crafted protobuf payload containing numerous unknown fields. This could cause the decoded message to retain substantially more memory than expected, leading to excessive memory consumption and potentially a Denial of Service (DoS) for applications processing untrusted protobuf data. Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images. Although protobufjs is present as a transitive dependency, the vulnerable parsing path is not exercised in normal product operation. Red Hat severity: Low — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Medium [CVE-2026-55602] Unintended backend routing due to crafted Host header
http-proxy-middleware is node.js http-proxy middleware. As a result, a crafted Host header that is only a superstring match for a configured host+path key can still route a request to an unintended backend. This vulnerability is fixed in 2.0.10, 3.0.6, and 4.1.0. Unanchored substring matching on the attacker-controlled Host header can match a configured host+path key without an exact host match, sending the request to the wrong backend. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-346.
Medium [CVE-2026-53632] Credential compromise via NTLMv2 password hash leak through UNC path access
launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.1, the launch-editor NPM package accesses arbitrary paths including Windows UNC paths. When a UNC path is opened, Windows automatically attempts NTLM authentication to the remote host, causing the user’s NTLMv2 password hash to be leaked to an attacker-controlled SMB server. This can result in credential compromise through offline hash cracking. This vulnerability is fixed in 2.14.1. This component, used in Node.js to open files, can be tricked into accessing arbitrary paths, including Windows Universal Naming Convention (UNC) paths. Red Hat rates this issue as having Moderate impact for Red Hat OpenShift AI MLflow images on Windows client scenarios. Linux-based Red Hat Enterprise Linux AI bootc images are not affected because launch-editor UNC-path behavior is Windows-specific. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-73. Affected Red Hat products: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-50171] @angular/common: Angular @angular/common: Denial of Service via malformed digitsInfo parameter
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a Denial of Service (DoS) vulnerability exists in the @angular/common package of Angular. The formatNumber function, which is also utilized by DecimalPipe, PercentPipe, and CurrencyPipe, does not properly validate the upper bounds of the digitsInfo parameter. Specifically, the minimum and maximum fraction digits parsed from the digitsInfo string (e.g., 1.2-4) are converted to integers and used without limits. When parsing a maliciously crafted digitsInfo string with excessively large fraction digit values (e.g., 1.200000000-200000000), the internal roundNumber function attempts to pad the digits array to match the requested fraction size. This results in an unbounded loop that repeatedly pushes elements into an array. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23. This leads to an unbounded loop, causing a Denial of Service (DoS) in the affected application. Exploitation requires the application to pass user-controlled input to the digitsInfo parameter, which is not the default Angular usage pattern. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-835. Affected Red Hat products: Red Hat Fuse 7.
Medium [CVE-2026-50184] @angular/service-worker: @angular/service-worker: Security flaw leads to session leaks and cached private data
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/service-worker package compromises the integrity of request-policy enforcement during request reconstruction. When the Angular Service Worker intercepts network requests for matched assets, it reconstructs a new Request object using an internal helper function. During this reconstruction process, the helper function strips explicit client-defined safety parameters: the credentials configuration (such as credentials: 'omit') and the HTTP cache mode configuration (such as cache: 'no-store'). These are reverted back to standard browser-default parameters (credentials: 'same-origin' and default HTTP cache properties). This causes the browser to include active credentials (such as cookies or Authorization headers) on outbound requests where the client-side developer explicitly instructed they should be omitted, leading to potential session leaks. Additionally, it causes private or non-cacheable resources to be cached by the service worker's engine, making private page states accessible or persistent inside the client's local cache post-logout. This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23.
Medium [CVE-2026-54264] @angular/service-worker: @angular/service-worker: Information Disclosure via unstripped sensitive headers on cross-origin redirects
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an information disclosure vulnerability exists in the @angular/service-worker package of the Angular framework. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request. However, on cross-origin redirects, the Service Worker fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin. This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. This Moderate information disclosure flaw in the Angular Service Worker could allow a remote attacker to obtain sensitive credentials by exploiting improper handling of cross-origin redirects. However, Red Hat JBoss Fuse is not affected by this vulnerability as the vulnerable code is not present in the product. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-212.
Medium [CVE-2026-54268] @angular/common: Angular @angular/common: Denial of Service via crafted date format string
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, a Denial of Service (DoS) vulnerability exists in the @angular/common package of the Angular framework. The formatDate function, which is also utilized by the standard Angular DatePipe, does not properly limit or validate the length of the format parameter. When parsing a maliciously crafted, excessively long date format string (e.g., a repeating pattern or very large string), the internal parser splits the string iteratively using a regular expression loop. This results in uncontrolled resource consumption (high CPU utilization and excessive memory allocations), leading to a Denial of Service (DoS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. A remote attacker could exploit a Denial of Service (DoS) vulnerability in the `formatDate` function, which is also used by the Angular DatePipe, by providing an excessively long and maliciously crafted date format string. A flaw was found in Angular's @angular/common DatePipe. A crafted date format string can cause excessive CPU consumption, resulting in a denial of service. Red Hat Integration Service Registry includes @angular/common in its UI components and is affected by this vulnerability.
Medium [CVE-2026-54267] @angular/core: Angular Client Hydration DOM Clobbering & Response-Cache Poisoning
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, to optimize client-side bootstrap in Server-Side Rendered (SSR) environments, Angular supports Hydration via provideClientHydration(). During SSR, Angular serializes the application's runtime state (such as cached HttpClient responses) and outputs it into the HTML stream as a
Medium [CVE-2026-54265] @angular/compiler: Angular: Two-Way Property Binding Sanitization Bypass (XSS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.1, 21.2.17, and 20.3.25, an issue in the @angular/compiler package allows bypassing DOM property sanitization through the use of two-way property bindings. Specifically, when a native DOM property that requires sanitization (such as innerHTML, srcdoc, src, href, data, or sandbox) is bound using the two-way binding syntax (e.g., [(innerHTML)]="value" or bindon-innerHTML="value"), the Angular template compiler failed to apply the appropriate schema-derived sanitizer resolution to the TwoWayProperty operation. As a result, native two-way DOM bindings were emitted without the required sanitizer function, whereas equivalent one-way bindings would be properly sanitized. This flaw enables an attacker who can control the value of a two-way bound sensitive property to bypass Angular's built-in sanitization logic, potentially leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.1, 21.2.17, and 20.3.25. This vulnerability only affects Angular 2+ (versions 19.x through 22.x); AngularJS 1.x is a different codebase and is not affected. Red Hat products shipping AngularJS 1.x (such as firefox, grafana, and thunderbird) are not impacted by this flaw.
Medium [CVE-2026-12479] Path Traversal in keras-team/keras
A path traversal vulnerability exists in keras-team/keras version 3.14.0, specifically in the `DiskIOStore.make` method within the Keras 3 model saving and loading library. This vulnerability arises from the improper handling of user-provided layer names, which are used to construct directory paths without sanitizing for parent directory components (`..`). While forward slashes (`/`) are restricted in layer names, directory traversal sequences are not. This allows an attacker to craft a malicious Keras model that, when saved or loaded, can escape the intended temporary working directory and perform unauthorized file system operations, such as creating directories or writing files in arbitrary locations. This path traversal vulnerability occurs due to improper handling of user-provided layer names, which allows an attacker to craft a malicious Keras model. This vulnerability requires user interaction to process a specially crafted Keras model. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Weakness: CWE-22. Affected Red Hat products: Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-52725] @angular/core: @angular/core: Cross-Site Scripting (XSS) via dynamic component creation bypass
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, an issue in the @angular/core package allows bypassing script-execution restrictions during dynamic component creation. Specifically, the dynamic component instantiation mechanism (createComponent) failed to reject mounting components directly onto a Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat Fuse 7.
Medium [CVE-2026-50557] @angular/compiler: @angular/core: Angular: Template and Attribute Namespace Sanitization Bypass (XSS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22, an issue in the @angular/compiler and @angular/core packages allows bypassing element and attribute sanitization/validation through specific namespace workarounds. Specifically, namespaced script elements (e.g., or ) were not properly identified as script elements by the Angular template preparser, allowing them to pass through template compilation without being stripped. Furthermore, security context schema mappings for element attributes did not consistently handle attributes within namespaced elements (like SVG and MathML), opening up gaps where malicious namespaced attributes could bypass runtime and compile-time sanitizers. Combined, these flaws enable an attacker who can inject or supply a template/tag structure with custom namespaces to bypass Angular's script-stripping logic and attribute sanitizers, leading to client-side Cross-Site Scripting (XSS). This vulnerability is fixed in 22.0.0-rc.2, 21.2.15, 20.3.22 and 19.2.22. This vulnerability only affects Angular 2+ (versions 19.x through 22.x); AngularJS 1.x is a different codebase and is not affected. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat build of Apicurio Registry 3.
Medium [CVE-2026-53550] Denial of Service via crafted YAML merge keys
Denial of Service via crafted YAML merge keys. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1333. Red Hat lists fixing advisory RHSA-2026:33866 with package nodejs20-main-20.20.2-1.hum1, nodejs22-main-22.23.1-2.1.hum1, nodejs24-main-24.18.0-0.3.hum1, dotnet8-0-main-8.0.128-1.1.hum1.