Red Hat Linux Security Advisories & CVEs
3066 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-23066] Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg
Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg. Red Hat rates this moderate (CVSS 7.4). Weakness: CWE-416. Affected package(s): kernel, kernel-rt. Resolved in Red Hat advisory RHSA-2026:9112 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1.
High [CVE-2026-23040] fix typo in frequency notification
fix typo in frequency notification. Red Hat rates this moderate (CVSS 7.6). Weakness: CWE-476. Affected package(s): kernel. Resolved in Red Hat advisory RHSA-2026:18134 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
High [CVE-2026-23097] Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration
Linux kernel: Denial of Service due to a deadlock in hugetlb folio migration. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-833. Affected package(s): kernel, kernel-rt. Resolved in Red Hat advisory RHSA-2026:13936 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
High [CVE-2026-25223] Validation bypass due to malformed Content-Type header leading to integrity impact
Validation bypass due to malformed Content-Type header leading to integrity impact. Red Hat rates this important (CVSS 7.5). Weakness: CWE-179. Affected package(s): rhoai/odh-dashboard-rhel8:1774282136, rhoai/odh-mod-arch-model-registry-rhel9:1776742141, rhoai/odh-dashboard-rhel9:1776742021, devspaces/dashboard-rhel9:1774476526. Resolved in Red Hat advisory RHSA-2026:10184 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat OpenShift AI 2.16; Red Hat OpenShift AI 2.25; Red Hat OpenShift Dev Spaces 3.27; Red Hat Enterprise Linux AI (RHEL AI) 3; and 1 more.
High [CVE-2025-14550] Denial of Service via crafted request with duplicate headers
Denial of Service via crafted request with duplicate headers. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-167. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, discovery/discovery-server-rhel9:1770913597, satellite/iop-advisor-backend-rhel9:1773451075, python-pulp-container. Resolved in Red Hat advisory RHSA-2026:3958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
High [CVE-2026-1312] SQL injection via crafted column aliases in QuerySet.order_by()
SQL injection via crafted column aliases in QuerySet.order_by(). Red Hat rates this important (CVSS 8.5). Weakness: CWE-89. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, discovery/discovery-server-rhel9:1770913597, satellite/iop-advisor-backend-rhel9:1773451075, ansible-automation-platform. Resolved in Red Hat advisory RHSA-2026:3958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Satellite 6.16 for RHEL 8; and 5 more.
High [CVE-2026-1287] SQL Injection via crafted column aliases
SQL Injection via crafted column aliases. Red Hat rates this important (CVSS 8.3). Weakness: CWE-89. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, discovery/discovery-server-rhel9:1770913597, satellite/iop-advisor-backend-rhel9:1773451075, ansible-automation-platform. Resolved in Red Hat advisory RHSA-2026:3958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Satellite 6.16 for RHEL 8; and 5 more.
High [CVE-2026-1285] Denial of Service via crafted HTML inputs
Denial of Service via crafted HTML inputs. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, discovery/discovery-server-rhel9:1770913597, satellite/iop-advisor-backend-rhel9:1773451075, python-pulp-container. Resolved in Red Hat advisory RHSA-2026:3958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
High [CVE-2026-1207] SQL Injection via RasterField band index parameter
SQL Injection via RasterField band index parameter. Red Hat rates this important (CVSS 8.3). Weakness: CWE-89. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, discovery/discovery-server-rhel9:1770913597, satellite/iop-advisor-backend-rhel9:1773451075, ansible-automation-platform. Resolved in Red Hat advisory RHSA-2026:3958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Satellite 6.16 for RHEL 8; and 5 more.
High [CVE-2025-6594] Cross-site Scripting vulnerability via improper input neutralization
Cross-site Scripting vulnerability via improper input neutralization. Red Hat rates this important (CVSS 8.1). Weakness: CWE-79. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-24040] Cross-User Data Leakage via race condition in addJS method
Cross-User Data Leakage via race condition in addJS method. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-820. Affected package(s): advanced-cluster-security/rhacs-main-rhel8:1773235860, advanced-cluster-security/rhacs-main-rhel8:1773235880. Resolved in Red Hat advisory RHSA-2026:4466 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-24737] Arbitrary code execution via unsanitized input in Acroform module
Arbitrary code execution via unsanitized input in Acroform module. Red Hat rates this important (CVSS 8.3). Weakness: CWE-917. Affected package(s): advanced-cluster-security/rhacs-main-rhel8:1773235860, advanced-cluster-security/rhacs-main-rhel8:1773235880. Resolved in Red Hat advisory RHSA-2026:4466 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Advanced Cluster Security for Kubernetes 4.8; Red Hat Advanced Cluster Security for Kubernetes 4.9; Red Hat Advanced Cluster Security 4.8; Red Hat Advanced Cluster Security 4.9.
High [CVE-2026-1761] Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response
Stack-Based Buffer Overflow in libsoup Multipart Response Parsingmultipart HTTP response. Red Hat rates this important (CVSS 8.6). Weakness: CWE-121. Affected package(s): libsoup3, libsoup, spice-client-win, devspaces/pluginregistry-rhel9:1770918006, devspaces/openvsx-rhel9:1770851052, devspaces/udi-rhel9:1770913862. Resolved in Red Hat advisory RHSA-2026:2513 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 11 more.
High [CVE-2026-25153] @backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
@backstage/plugin-techdocs-node: @backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks. Red Hat rates this important (CVSS 7.7). Weakness: CWE-94. Affected package(s): rhdh/rhdh-hub-rhel9:1774545605, rhdh/rhdh-hub-rhel9:1775140647. Resolved in Red Hat advisory RHSA-2026:6174 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9.
High [CVE-2025-24293] Code injection in Active Storage when used in conjunction with the image_processing gem
Code injection in Active Storage when used in conjunction with the image_processing gem. Red Hat rates this important (CVSS 8.1). Weakness: CWE-88. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2024-4027] OutOfMemoryError in HttpServletRequestImpl.getParameterNames() can cause remote DoS attacks
OutOfMemoryError in HttpServletRequestImpl.getParameterNames() can cause remote DoS attacks. Red Hat rates this important (CVSS 7.5). Weakness: CWE-20. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat build of Apicurio Registry 2; Red Hat Fuse 7; Red Hat Integration Camel K 1; Red Hat Process Automation 7.
High [CVE-2025-61728] Excessive CPU consumption when building archive index in archive/zip
Excessive CPU consumption when building archive index in archive/zip. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Affected package(s): openshift4/ose-csi-livenessprobe-rhel8:1776999947, openshift4/ose-csi-external-snapshotter-rhel8:1776999951, openshift4/ose-multus-route-override-cni-rhel8:1777001628, openshift4/ose-tests:1777002345, openshift4/ose-hypershift-rhel8:1777001784, openshift4/ose-cluster-kube-storage-version-migrator-rhel9-operator:1774582496. Resolved in Red Hat advisory RHSA-2026:3469 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
High [CVE-2025-61726] Memory exhaustion in query parameter parsing in net/url
Memory exhaustion in query parameter parsing in net/url. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): openshift4/ose-csi-livenessprobe-rhel8:1776999947, openshift4/ose-csi-external-snapshotter-rhel8:1776999951, openshift4/ose-multus-route-override-cni-rhel8:1777001628, openshift4/ose-tests:1777002345, skopeo, openshift4/ose-hypershift-rhel8:1777001784. Resolved in Red Hat advisory RHSA-2026:11749 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.6 for RHEL 10; Red Hat Enterprise Linux Server (v. 7 ELS); Red Hat Ansible Automation Platform 2.4 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 8; and 149 more.
High [CVE-2025-61731] Arbitrary file write via malicious pkg-config directive
Arbitrary file write via malicious pkg-config directive. Red Hat rates this important (CVSS 8.6). Weakness: CWE-88. Affected package(s): openshift4/ose-csi-livenessprobe-rhel8:1776999947, openshift4/ose-csi-external-snapshotter-rhel8:1776999951, openshift4/ose-prometheus-node-exporter-rhel9:1774294099, openshift4/oc-mirror-plugin-rhel9:1776961082, openshift4/ose-azure-file-csi-driver-operator-rhel9:1773363768, openshift4/ose-multus-route-override-cni-rhel8:1777001628. Resolved in Red Hat advisory RHSA-2026:5948 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 24 more.
High [CVE-2026-1530] Man-in-the-Middle vulnerability due to disabled certificate validation
Man-in-the-Middle vulnerability due to disabled certificate validation. Red Hat rates this important (CVSS 8.1). Weakness: CWE-295. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, python-pulp-container, python-pulp-rpm, python-django. Resolved in Red Hat advisory RHSA-2026:5971 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9.