Red Hat Linux Security Advisories & CVEs
4724 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-9547] Man-in-the-middle attack via SSH host key bypass
When a libcurl-based application performs transfers via `SCP://` or `SFTP://` and utilizes the `CURLOPT_SSH_KEYFUNCTION` callback, it may silently accept an untrusted server. This vulnerability occurs when a server presents a host key type that does not match the specific key type already recorded for that host in the `known_hosts` file. Instead of rejecting the mismatch, the callback mechanism fails to properly enforce the restriction, allowing the connection to succeed without warning and risking a potential man-in-the-middle attack. A flaw was found in curl. The vulnerability requires specific application callback usage, not a general curl client default. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-347. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.22; Cert Manager support for Red Hat OpenShift release 1.19; Red Hat Discovery 2; Red Hat Hardened Images; Red Hat OpenShift Dev Spaces 3.30; Red Hat Update Infrastructure 5. Red Hat lists Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4; Red Hat Trusted Profile Analyzer as not affected. Affected products named by the advisory: Red Hat package: curl.
High [CVE-2026-9546] Information disclosure due to persistent Referer header
A vulnerability in libcurl caused the HTTP `Referer:` header to persist even when explicitly cleared. While the documentation states that passing NULL to `CURLOPT_REFERER` suppresses the header, the option failed to clear the internal state. As a result the previous referrer string was erroneously reused and sent in subsequent requests, potentially leaking sensitive information to unintended servers. A flaw was found in libcurl. Important: A flaw in libcurl allows for sensitive information disclosure. Despite attempts to explicitly clear the HTTP Referer header, its internal state persists, leading to the unintended reuse and transmission of previous referrer strings in subsequent requests. This could expose sensitive data to unintended third-party servers in Red Hat products and services that rely on libcurl for HTTP communications. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-201. Affected Red Hat products: Red Hat Hardened Images. Under investigation: Confidential Compute Attestation; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat Trusted Profile Analyzer.
High [CVE-2026-9545] Information disclosure via cached SSL session and early data
In this scenario, libcurl first uses a proper HTTP/3 server for the initial transfers, and when it makes a second transfer to the same site it has been replaced by the attacker's impostor machine - without a valid certificate. When libcurl returns to the hostname the second time with a cached SSL session (`CURLOPT_SSL_SESSIONID_CACHE` is not disabled) and early data enabled (the `CURLSSLOPT_EARLYDATA` bit is set in `CURLOPT_SSL_OPTIONS`), libcurl might send off the second request's bytes on that new connection *before* enforcing the certificate verification failure. Potentially leaking sensitive information. A flaw was found in libcurl. An attacker can exploit this by replacing a legitimate HTTP/3 server with an impostor machine. This could lead to the disclosure of sensitive information to the attacker. The version of curl as shipped with Red Hat Enterprise Linux 10 is not built with the support for the ngtcp2 + nghttp3 backend and is therefore unaffected by this issue. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat Hardened Images. Under investigation: Confidential Compute Attestation; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat Trusted Profile Analyzer. Red Hat fixing advisory: RHSA-2026:41240.
High [CVE-2026-9080] Use-after-free via curl_easy_pause in CURLMOPT_SOCKETFUNCTION callback
Calling `curl_easy_pause()` within the event-based `CURLMOPT_SOCKETFUNCTION` callback triggers a use-after-free vulnerability, where libcurl attempts to store a flag using a dangling struct pointer immediately after that pointer's memory has been freed. A flaw was found in libcurl. An attacker could potentially exploit this to cause a denial of service or execute arbitrary code. This could allow an attacker to achieve denial of service or arbitrary code execution without requiring user interaction or elevated privileges. While dependent on a specific application implementation, the broad adoption of libcurl means Red Hat products leveraging this callback pattern could be affected. Red Hat severity: Moderate — CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-825. Affected Red Hat products: Red Hat Hardened Images. Under investigation: Confidential Compute Attestation; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat Trusted Profile Analyzer. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat JBoss Core Services as not affected. Red Hat fixing advisory: RHSA-2026:29017, RHSA-2026:34975.
High [CVE-2026-9079] Information disclosure due to failure to clear proxy authentication credentials
libcurl had a flaw that when instructed to clear proxy authentication credentials which made it not do so, leaving the old credentials around to get used for subsequent transfers that should not know nor use them. A flaw was found in curl. This could lead to the unintended reuse of sensitive proxy authentication credentials for subsequent network transfers, potentially resulting in unauthorized access or information disclosure. Important: A flaw in libcurl's proxy authentication credential management can lead to information disclosure. There are no integrity or availability risks posed by this flaw. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-212. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Hardened Images; Confidential Compute Attestation; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Dev Spaces; Red Hat Trusted Profile Analyzer as not affected. Red Hat fixing advisory: RHSA-2026:69125, RHSA-2026:29017, RHSA-2026:34975. Affected products named by the advisory: Red Hat package: curl.
High [CVE-2026-8932] Security feature bypass due to improper mTLS connection reuse
libcurl would reuse a previously created connection even when some mTLS config related option had been changed that should have prohibited reuse. libcurl keeps previously used connections in a connection pool for subsequent transfers to reuse if one of them matches the setup. However, some TLS settings related to client certificates were left out from the configuration match checks, making them match too easily. In particular options related to the private key. A flaw was found in curl. The libcurl library, used for transferring data with URLs, could improperly reuse existing network connections. This occurred even when changes to mutual Transport Layer Security (mTLS) settings, particularly those for client certificates, should have prevented such reuse. This issue could lead to a security feature bypass, where a client might use a connection with an unintended or weaker security configuration, potentially compromising the integrity or confidentiality of data. This is an Important security feature bypass in libcurl where mTLS connection reuse may occur despite changes to client certificate settings. This could lead to applications using libcurl with mTLS to inadvertently use a less secure connection than intended, potentially compromising data confidentiality or integrity.
High [CVE-2026-8927] Information disclosure due to uncleared proxy authentication state
When reusing a libcurl handle for sequential transfers driven by environment-variable proxy configuration, libcurl fails to clear the proxy authentication state between requests. Specifically, if the initial transfer authenticates against `proxyA` using Digest auth, a subsequent transfer routed through `proxyB` erroneously leaks the `Proxy-Authorization:` header intended solely for `proxyA`. A flaw was found in libcurl. This oversight can lead to the unintended disclosure of `Proxy-Authorization` headers to an incorrect proxy, potentially exposing sensitive authentication information to an unauthorized entity. This flaw leads only to a confidentiality impact. There has been no observed integrity impact. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-201. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Confidential Compute Attestation; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Trusted Profile Analyzer as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6.
High [CVE-2026-8925] Double-free vulnerability in SASL authentication
The curl logic that works with SASL authentication could end up cleaning up the GSASL context *twice* without clearing the pointer in between, making it `free()` the same pointer twice. A flaw was found in curl. The logic handling SASL (Simple Authentication and Security Layer) authentication could lead to a double-free vulnerability. This occurs because the GSASL context may be deallocated twice without clearing the pointer, potentially leading to memory corruption. An attacker could exploit this to cause a denial of service or potentially execute arbitrary code. This Important flaw in curl's SASL authentication logic could lead to a double-free vulnerability, potentially resulting in memory corruption, denial of service, or arbitrary code execution. The impact is significant as curl is a widely used utility in Red Hat environments, and SASL authentication is a common enterprise configuration. Exploitation requires an attacker to interact with a service utilizing the vulnerable SASL authentication within curl. Exploitation of this flaw requires controlling which memory is addressed in the second free call and this is unlikely to be possible. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-1341. Affected Red Hat products: Red Hat Hardened Images.
High [CVE-2026-8286] Insecure connection establishment due to TLS configuration mismatch
A vulnerability exists where a new transfer that uses STARTTLS to upgrade the connection might reuse an existing live connection even though the TLS configuration mismatches so it should not. A flaw was found in curl. This reuse can occur even if the Transport Layer Security (TLS) configuration of the new transfer does not match the existing connection, potentially leading to an insecure connection being established. This is an Important flaw as `curl` may establish an insecure connection when attempting to upgrade a transfer with STARTTLS, potentially reusing an existing connection with mismatched TLS configurations. This could lead to unexpected data exposure or compromise, particularly in environments where `curl` is used for sensitive data transfers and relies on STARTTLS for security. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.22; Cert Manager support for Red Hat OpenShift release 1.19; Red Hat Discovery 2; Red Hat Hardened Images; Red Hat OpenShift Dev Spaces 3.30; Red Hat Update Infrastructure 5; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Trusted Profile Analyzer as not affected.
High [CVE-2026-12064] SSH host verification bypass when using schemeless URLs with SFTP/SCP
When a user invokes curl using a schemeless URL combined with `--proto-default` sftp (or scp), a disconnect occurs between the tool layer and libcurl. The tool layer incorrectly infers the URL scheme, which erroneously bypasses the initialization of critical SSH security options like CURLOPT_SSH_HOST_PUBLIC_KEY_SHA256 and CURLOPT_SSH_KNOWNHOSTS. Conversely, the libcurl runtime successfully honors CURLOPT_DEFAULT_PROTOCOL and establishes the connection via SFTP/SCP as specified. Because the tool layer skipped the security configuration, these SSH host verification options are silently omitted, causing curl to connect to an unverified SSH remote host without throwing an error. A flaw was found in curl. This could enable an attacker to intercept or manipulate data through a man-in-the-middle attack. This Important flaw in curl allows an attacker to bypass SSH host verification when a user invokes curl with a schemeless URL and specifies SFTP or SCP as the default protocol. This can lead to man-in-the-middle attacks, enabling data interception or manipulation without user awareness in Red Hat environments. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-358. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Hardened Images. Affected products named by the advisory: Red Hat package: curl.
High [CVE-2026-11586] Denial of Service via WebSocket PING flood
By default, curl automatically responds to WebSocket PING frames. Because curl lacks an upper bound on memory allocation for unacknowledged frames, a malicious server can exhaust all available memory by flooding curl with rapid, sequential PING messages. A flaw was found in curl. This Important denial of service vulnerability in curl allows a remote malicious server to exhaust system memory. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat Trusted Profile Analyzer as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2026:29017, RHSA-2026:34975. Affected products named by the advisory: Red Hat package: curl.
High [CVE-2026-11352] Remote denial of service via QUIC UDP receive function vulnerability
An issue in curl’s QUIC UDP receive function allows a malicious HTTP/3 server to trigger a remote denial of service against a curl or libcurl client. Because the helper function discards zero-length UDP datagrams before counting them toward the per-call packet budget, a connected QUIC peer can continuously stream empty datagrams to indefinitely stall the client. A flaw was found in curl and libcurl. By continuously sending zero-length UDP datagrams, an attacker can indefinitely stall the client, impacting service availability without requiring authentication or user interaction. This poses a significant risk to applications relying on curl for HTTP/3 communication. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-835. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat JBoss Core Services; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Dev Spaces; Red Hat Trusted Profile Analyzer as not affected. Red Hat fixing advisory: RHSA-2026:29017, RHSA-2026:34975.
High [CVE-2026-58467] Arbitrary file read and code execution via path traversal
Cockpit CMS through 2.14.0 contains a path traversal and local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files or execute PHP files by including unvalidated PATH_INFO derived from REQUEST_URI in filesystem path construction without containment checks. Attackers can inject dot-dot sequences into the URL to traverse outside the designated spaces directory, and when the resolved path ends with a.php extension, the application passes it to include(), enabling local file inclusion on deployments using the PHP built-in server or certain non-default Nginx configurations. By manipulating the URL, an attacker can bypass security checks and access restricted directories. This could lead to unauthorized information disclosure or the execution of malicious code on affected systems. This is due to improper validation of `PATH_INFO` in the `REQUEST_URI`, which can be exploited on systems utilizing the PHP built-in server or certain non-default Nginx configurations. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-55952] Denial of Service in TLS 1.3 session ticket handling
The Erlang/OTP ssl application does not validate that the PSK identity list and binder list carried in a TLS 1.3 ClientHello pre-shared key extension have equal length before passing them to the session ticket handler. In tls_handshake_1_3:handle_pre_shared_key/3, an OfferedPreSharedKeys record with a mismatched number of identities and binders is forwarded directly to tls_server_session_ticket:use/4, which crashes the session ticket handler process. An unauthenticated remote attacker can send a single crafted ClientHello to a TLS 1.3 server with session tickets enabled (stateful or stateless mode) and permanently disrupt session ticket handling on that listener. New TLS 1.3 handshakes complete but subsequently crash when the server attempts to issue a session ticket, effectively making TLS 1.3 unusable on the affected listener until the ssl application is restarted. TLS 1.2 connections are not affected. A flaw was found in Erlang/OTP's SSL (Secure Sockets Layer) application. This can permanently disrupt the server's ability to handle session tickets, leading to a Denial of Service (DoS) for new TLS 1.3 connections until the SSL application is restarted. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-130.
High [CVE-2026-11946] Denial of Service via unvalidated endpoint URL length
An unauthenticated remote attacker can exhaust server memory via the GetEndpoints Discovery Service in open62541. The endpointUrl field of GetEndpointsRequest is not validated for length. An attacker can declare an arbitrarily large string (up to ~4.09 GB via the UInt32 length field) delivered across intermediate chunks without ever sending the final chunk. The server buffers all chunks in RAM indefinitely until the SecureChannel times out. The attack is pre-session and bypasses all encryption configurations. The issue affects open62541: from 1.4.0 through 1.4.16, from 1.5.0 through 1.5.4, master. A flaw was found in open62541. This can lead to the server buffering large amounts of data indefinitely, causing server memory exhaustion and a Denial of Service (DoS) condition. Affected versions: 1.4.0 through 1.4.16, 1.5.0 through 1.5.4. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1284.
High [CVE-2026-9563] Denial of Service via uncontrolled resource consumption in JSON parsing
In Eclipse Parsson published Maven Central artifacts before version 1.1.8, the JSON parser did not enforce a default maximum on the number of characters consumed while parsing a single JSON document. Applications that parse attacker- controlled JSON can be forced to consume excessive CPU and memory by processing very large documents, including large arrays, objects, strings, numbers, whitespace, or nested structures, resulting in a denial of service. A remote attacker could exploit this by providing a very large, specially crafted JSON document. This is an Important denial of service vulnerability in Eclipse Parsson, a JSON processing library. Applications within Red Hat products that parse untrusted or attacker-controlled JSON documents are susceptible to excessive CPU and memory consumption. This can lead to resource exhaustion and service unavailability due to the parser not enforcing limits on the size or complexity of JSON input. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat OpenShift AI 2.25; Red Hat OpenShift Dev Spaces 3.30; OpenShift Serverless; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; streams for Apache Kafka 2; streams for Apache Kafka 3.
High [CVE-2026-8147] Unauthorized access to trace data due to missing authorization validation
In MLflow versions prior to 3.14.0, when running with authentication enabled, the trace API endpoints lack proper authorization validators. This allows any authenticated user to bypass experiment-level authorization controls on all trace operations, including reading, deleting, and modifying traces on experiments they do not have permission to access. The issue arises from the `_before_request` handler, which does not register authorization validators for trace endpoints, resulting in requests proceeding without validation. This vulnerability can expose sensitive data, destroy audit logs, and allow unauthorized modifications. A flaw was found in MLflow. This is due to missing authorization validators, allowing unauthorized reading, deleting, and modifying of traces. This Important flaw in MLflow, as deployed in Red Hat OpenShift AI, allows an authenticated user to bypass experiment-level authorization controls on trace API endpoints. This enables unauthorized access, modification, and deletion of sensitive trace data, impacting the confidentiality and integrity of machine learning experiment results within the platform. The vulnerability specifically affects the `rhoai/odh-mlflow-rhel9` component. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-425. Red Hat lists Red Hat OpenShift AI (RHOAI) as not affected.
High [CVE-2026-53357] fix UAF in l2cap_sock_cleanup_listen vs l2cap_conn_del
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() bt_accept_dequeue() unlinks a not-yet-accepted child from the parent accept queue and release_sock()s it before returning, so the returned sk has no caller reference and is unlocked. l2cap_sock_cleanup_listen() walks these children on listening-socket close. A concurrent HCI disconnect drives hci_rx_work -> l2cap_conn_del() which runs l2cap_chan_del() + l2cap_sock_kill() and frees the child sk and its l2cap_chan; cleanup_listen() then uses both: BUG: KASAN: slab-use-after-free in l2cap_sock_kill l2cap_sock_kill / l2cap_sock_cleanup_listen / __x64_sys_close Freed by: l2cap_conn_del -> l2cap_sock_close_cb -> l2cap_sock_kill This is distinct from the two fixes already in this area: commit e83f5e24da741 ("Bluetooth: serialize accept_q access") serialises the accept_q list/poll and takes temporary refs inside bt_accept_dequeue(), and CVE-2025-39860 serialises the userspace close()/accept() race by calling cleanup_listen() under lock_sock() in l2cap_sock_release(). Neither covers l2cap_conn_del() running from hci_rx_work, so this UAF still reproduces on current bluetooth/master. Take the reference at the
High [CVE-2026-55153] Remote code execution via JNDI injection
mchange-commons-java is a Java library of shared utility classes used by mchange projects like the c3p0 connection pool. Prior to version 0.6.0, its JNDI ObjectFactory implementation (com.mchange.v2.naming. JavaBeanObjectFactory) will construct objects of arbitrary classes and initialize "JavaBean"-style properties, which for certain classes enables JNDI injection and "deserialization gadgets." Such initialization is unsafe for some classes: for example, setting the contentType property of a Swing JEditorPane to text/html and its text property to HTML containing a stylesheet will provoke an HTTP GET on an arbitrary URL, potentially from within a trusted security domain. The problem is aggravated by the library's ReferenceIndirector, through which malicious JNDI Reference objects can be smuggled in for dereferencing wherever an application reads a Java-serialized object. This has been resolved in version 0.6.0. This vulnerability allows a remote attacker to achieve arbitrary code execution through Java Naming and Directory Interface (JNDI) injection. This could lead to an attacker executing unauthorized code within the application's security domain. Affected products named by the advisory: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16; Red Hat build of Apache Camel - HawtIO 4; streams for Apache Kafka 2.
High [CVE-2026-14363] SQL Injection vulnerability
Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo Extension allows SQL Injection. This vulnerability, identified as SQL Injection, allows an attacker to execute malicious SQL commands. By exploiting improper handling of special characters in SQL commands, an attacker can potentially access, modify, or delete sensitive data within the database, leading to unauthorized information disclosure or data manipulation. An Important SQL injection flaw affects the Mediawiki Cargo Extension, enabling unauthenticated attackers to execute arbitrary SQL commands. The impact is significant in deployments where Mediawiki instances are exposed to untrusted networks and the Cargo Extension is actively utilized. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-89. Red Hat lists Red Hat Hardened Images as not affected.