Red Hat Linux Security Advisories & CVEs
11901 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-76763] Unauthenticated Denial of Service via large exponent float literals
A flaw was found in SmallRye GraphQL. The number scalar coercion for BigInteger does not properly validate the magnitude of float or string inputs. An unauthenticated remote attacker can exploit this by sending a GraphQL query containing a large exponent float literal. This can lead to the allocation of extremely large BigInteger objects, causing CPU exhaustion or an OutOfMemoryError, resulting in a denial of service. This flaw is rated as Important. This can lead to CPU exhaustion or an OutOfMemoryError, as the parsing occurs before authorization and affects commonly used data types like Long or BigInteger. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1284.
High [CVE-2026-75762] Manager trusts self-asserted evt.Source for leaf-hub identity in all status handlers
Manager trusts self-asserted evt. Source() for leaf-hub identity in all status handlers. Red Hat rates this important (CVSS 8.5). Weakness: CWE-290. Red Hat lists fixing advisory RHSA-2026:68515 with package multicluster-globalhub/multicluster-globalhub-manager-rhel9:1788355599, multicluster-globalhub/multicluster-globalhub-rhel9-operator:1788359461, multicluster-globalhub/multicluster-globalhub-agent-rhel9:1788377473, multicluster-globalhub/multicluster-globalhub-agent-rhel9:1788355439. Affected product named by the advisory: Multicluster Global Hub.
High [CVE-2026-12894] io.quarkus:quarkus-qute: quarkus-qute:Server-Side Template Injection (SSTI) vulnerability in ReflectionValueResolver of the Quarkus Qute template engine
A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values (ReflectionValueResolver), which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence the template text can exploit this bypass to take control of the server by executing unauthorized commands. An attacker with the ability to supply or modify template content can bypass security filters designed to restrict access to sensitive Java methods. This bypass allows for arbitrary remote code execution within the context of the Java process, leading to a complete compromise of the affected application. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-1336. Affected Red Hat products: Red Hat build of Apache Camel 4 for Quarkus 3. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-19625] Cross-tenant authentication bypass via shared token-introspection cache
When a Quarkus application has multiple endpoints secured by individual OIDC provider tenants, such as "/oidc-provider1" that is secured by the OIDC Provider 1 and "/oidc-provider2" that is secured by the OIDC Provider 2, and an optional token introspection cache is also enabled, then a valid token issued by the OIDC Provider 1 that can be used to access "/oidc-provider1" can also be used to access "/oidc-provider2" that is secured by another OIDC Provider 2. A shared token-introspection cache can be exploited by a remote attacker to bypass authentication across different tenants. This allows unauthorized access to resources or data, leading to a cross-tenant authentication bypass. Important: This flaw in Quarkus OIDC allows for cross-tenant authentication bypass due to a shared token-introspection cache. In multi-tenant deployments of Red Hat products utilizing Quarkus OIDC, an attacker could potentially gain unauthorized access to other tenants' resources by exploiting this shared cache mechanism. Red Hat severity: Important — CVSS 8.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Weakness: CWE-524. Affected Red Hat products: Exploit Intelligence; Red Hat build of Apicurio Registry 3. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-19651] Authorization bypass via URL query string manipulation
IBM Enterprise Build of Quarkus 3.27.1 through 3.27.5, and 3.33.1 through 3.33.3 could allow an attacker to bypass authorization by manipulating URL query parameters due to incorrect mapping of values to untrusted query string input. A flaw was found in quarkus-spring-web. The system incorrectly reads the URL query string as a request header, which can lead to an authorization bypass, allowing unauthorized access to resources. This could enable unauthorized access to resources or functionality within applications utilizing the affected component, elevating the risk to Important due to the potential for privilege escalation or data exposure. Red Hat severity: Important. Weakness: CWE-551.
High [CVE-2026-81624] WebSocketContainer defaults for buffers and timeouts are infinite
Undertow is a flexible performant web server used in JBoss EAP and WildFly. A flaw was found in how Undertow handles WebSocket connections. Specifically, certain configuration limits like message buffer sizes and session timeouts cannot be adjusted and default to being unlimited. This allows a remote attacker to send large amounts of data or maintain connections indefinitely, potentially crashing the server by exhausting its memory or other resources. The Red Hat Product Security team has assessed the severity of this vulnerability as Important, given that the default configuration allows for unlimited resource consumption. Successful exploitation allows an attacker to cause a denial of service via resource exhaustion. The vulnerability's root cause is the lack of configuration options for WebSocket buffer sizes and timeouts in the container boot process. Weakness: CWE-770. Affected Red Hat products: Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat Single Sign-On 7. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat JBoss Enterprise Application Platform Expansion Pack as not affected. Will not fix / out of support: Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7.
High [CVE-2026-82659] Arbitrary file read and Server-Side Request Forgery via raw option bypass
nodemailer before 9.0.1 fails to apply disableFileAccess and disableUrlAccess flags to message-level raw option, allowing authenticated attackers to read arbitrary files or perform server-side request forgery by supplying path or href properties. Attackers can exploit this by crafting raw messages with file paths or URLs that bypass the intended sandbox, with fetched content delivered in the outgoing message to attacker-controlled recipients. A flaw was found in nodemailer. This allows them to read arbitrary files from the system or perform Server-Side Request Forgery (SSRF), potentially leading to information disclosure or unauthorized access to internal network resources. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Weakness: CWE-918. Affected Red Hat products: Red Hat Developer Hub; Self-service automation portal 2. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Hardened Images as not affected. Will not fix / out of support: Red Hat Developer Hub. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-82623] Denial of service via use-after-free vulnerability
A vulnerability was detected in open62541 up to 1.5.5. Affected by this vulnerability is the function UA_DataValue_backend_copyRange of the file plugins/historydata/ua_history_data_backend_memory.c of the component History Backend. The manipulation results in use after free. The attack can be launched remotely. The exploit is now public and may be used. The project closed the issue report, stating that this is not the official way to report a security vulnerability. This flaw could lead to a denial of service, making the affected system unavailable. The open62541 library is not shipped in any Red Hat product. It is available in the Fedora community distribution, which already ships version 1.5.6, beyond the affected range (up to 1.5.5). Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-82398] Denial of Service via inefficient handling of non-whitespace inputs
pypdf is a free and open-source pure-python PDF library. Prior to 6.15.0, an attacker can craft a PDF that causes long runtimes when the pypdf/_utils.py function read_until_whitespace reads a stream containing a long run of bytes without whitespace. The function repeatedly performs immutable bytes concatenation in a one-byte loop, causing quadratic processing cost for the long non-whitespace input. This issue is fixed in version 6.15.0. A flaw was found in pypdf. This leads to quadratic processing cost and a potential Denial of Service (DoS). Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-1046. Affected Red Hat products: Ansible Automation Orchestrator 2026; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3. Will not fix / out of support: Exploit Intelligence; Red Hat Ansible Automation Platform 2; Red Hat Quay 3. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-83589] Open Redirect via /\ and /\t Bypass in Post-Login Redirect
A flaw was found in oauth-proxy. The application fails to properly validate the destination redirect parameter (`rd`) during post-login redirection. A remote attacker can exploit this vulnerability by enticing a user to follow a specially crafted link, resulting in the user being redirected to an arbitrary external website after authenticating. This open redirect can be leveraged to conduct phishing attacks or credential theft. Although successful exploitation requires user interaction to navigate a specially constructed link, the proxy's role as a trusted authentication gateway significantly heightens the blast radius. Under standard OpenShift Container Platform deployments, the component is exposed to route traffic and handles post-authentication redirection routines by default. Red Hat severity: Important — CVSS 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-601. Affected Red Hat products: Red Hat OpenShift Container Platform 4.20; Red Hat OpenShift Container Platform 4.21; Red Hat OpenShift Container Platform 4.22; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:74380, RHSA-2026:74383, RHSA-2026:74429.
Medium [CVE-2026-80221] Direct database connection string with embedded credentials passed as environment variable
Direct database connection string with embedded credentials passed as environment variable. Red Hat rates this important (CVSS 4.4). Weakness: CWE-312. Red Hat lists fixing advisory RHSA-2026:68515 with package multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1788376193, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1788441983, multicluster-globalhub/multicluster-globalhub-grafana-rhel9:1788375682. Affected product named by the advisory: Multicluster Global Hub.
Medium [CVE-2026-80220] pprof profiling endpoints exposed on unauthenticated metrics listener
pprof profiling endpoints exposed on unauthenticated metrics listener. Red Hat rates this important (CVSS 5.4). Weakness: CWE-200. Red Hat lists fixing advisory RHSA-2026:68515 with package multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9:1788200952, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9:1788200121, multicluster-globalhub/multicluster-globalhub-postgres-exporter-rhel9:1788200958. Affected product named by the advisory: Multicluster Global Hub.
Medium [CVE-2026-82797] Denial of Service via uncontrolled recursion with serialized data
Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Serialized Data with Nested Payloads. This issue affects rlottie: before 8de0d9e6ca80ffef654965505981727b9fa06a51. A flaw was found in rlottie. Successful exploitation requires user interaction to process the malicious data. The rlottie library is shipped in Fedora and EPEL community distributions. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-1265.
Medium [CVE-2026-82677] Denial of Service via double free in Module Timer subsystem
A vulnerability was determined in valkey-io valkey 9.1.0. Impacted is the function moduleTimerHandler of the file src/module.c of the component Module Timer Subsystem. This manipulation causes double free. The attack can be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: b349fe2821e3998534b1454c1b64a478daf8c6b7. To fix this issue, it is recommended to deploy a patch. This flaw could lead to a denial of service. Execution remains confined within the process runtime environment, mitigated by default SELinux policies and container isolation preventing host-level escalation. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1341. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:61884. Affected products named by the advisory: Red Hat package: valkey.
Medium [CVE-2026-82853] SMTP Command Injection allows email spoofing and phishing attacks
Nodemailer versions before 8.0.5 contain an SMTP command injection vulnerability in the transport name option used in EHLO/HELO commands. The name parameter is concatenated directly into SMTP commands without sanitizing carriage return and line feed characters, allowing attackers to inject arbitrary SMTP commands for email spoofing and phishing attacks. A flaw was found in Nodemailer. This vulnerability allows a remote attacker to inject arbitrary Simple Mail Transfer Protocol (SMTP) commands due to improper sanitization of carriage return and line feed characters in the transport name option. Moderate: This SMTP command injection vulnerability in Nodemailer allows an attacker with high privileges to inject arbitrary SMTP commands. This could lead to email spoofing and phishing attacks within affected Red Hat products that utilize Nodemailer for email transport, such as Red Hat Developer Hub and Red Hat Ansible Automation Platform, where applications allow user or external input to configure the SMTP transport name option. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-93. Affected Red Hat products: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2. Red Hat lists Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-82661] Header injection via unsanitized list comment fields
Nodemailer before 8.0.9 fails to sanitize carriage return and line feed characters in list comment fields, allowing attackers to inject arbitrary message headers. An attacker with control over list.*.comment parameters can inject CRLF sequences to create additional headers in generated RFC822 messages, altering mail client behavior and message semantics. A flaw was found in Nodemailer, an email sending library. By failing to sanitize carriage return and line feed (CRLF) characters, an attacker can alter mail client behavior and message semantics, potentially leading to email spoofing or other integrity issues. This is a Moderate impact vulnerability where an attacker with control over specific input fields can inject arbitrary email headers. This could alter mail client behavior or message semantics, but it does not enable remote code execution or direct SMTP command injection. Exploitation requires an application to pass unsanitized user-controlled input to the vulnerable `list.*.comment` parameters within the Nodemailer library. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-93. Affected Red Hat products: Red Hat Developer Hub; Self-service automation portal 2. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-82662] Information disclosure due to disabled TLS certificate verification
Nodemailer before 8.0.8 disables TLS certificate verification in lib/fetch/index.js through rejectUnauthorized: false, allowing attackers to intercept OAuth2 token requests. Attackers in a machine-in-the-middle position can capture OAuth client secrets, refresh tokens, and access tokens transmitted over compromised HTTPS connections. A flaw was found in Nodemailer where it disables Transport Layer Security (TLS) certificate verification. A remote attacker, positioned between the user and the server (a machine-in-the-middle attack), could exploit this by intercepting OAuth2 token requests. This flaw allows a machine-in-the-middle attacker to intercept OAuth2 token requests, leading to the disclosure of sensitive OAuth client secrets, refresh tokens, and access tokens. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2. Red Hat lists Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: grafana.
Medium [CVE-2026-82660] Information Disclosure via jsonTransport Access Control Bypass
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls. A flaw was found in Nodemailer, a module for sending emails. The jsonTransport component, responsible for handling message data, does not correctly enforce security options designed to prevent unauthorized file and URL access. A remote attacker could exploit this by sending specially crafted messages containing malicious file paths or URLs. This bypasses the intended security controls, potentially allowing the attacker to read sensitive local files or access external web resources, leading to unauthorized information disclosure. This Moderate impact flaw in Nodemailer's `jsonTransport` allows an attacker to bypass intended access controls. This affects Red Hat products that integrate vulnerable versions of Nodemailer. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-472. Affected Red Hat products: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Self-service automation portal 2. Red Hat lists Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2024-58379] Denial of Service via specially crafted emails with data URLs or embedded attachments
nodemailer before 6.9.9 contains a regular expression denial of service vulnerability in email parsing when attachDataUrls parameter is set or processing embedded file attachments. Attackers can send specially crafted emails with malicious data URLs or embedded attachments to cause the event loop to hang and deny service. A flaw was found in Nodemailer. A remote attacker can exploit a regular expression denial of service (ReDoS) vulnerability by sending specially crafted emails containing malicious data URLs or embedded attachments. This can cause the email parsing process to hang, leading to a denial of service for the affected system. This Moderate flaw in Nodemailer, a dependency in several Red Hat products, allows a remote attacker to trigger a Regular Expression Denial of Service (ReDoS). This impact is considered Moderate as it requires specific input and results in service disruption rather than data compromise or arbitrary code execution. Red Hat products ship with newer, unaffected versions of Nodemailer and are not impacted. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-1333. Red Hat lists Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Hardened Images; Self-service automation portal 2 as not affected.
Low [CVE-2026-82631] Use-after-free vulnerability in Blocked-on-keys subsystem
A security flaw has been discovered in valkey-io valkey 9.1.0. The affected element is the function handleClientsBlockedOnKey of the file src/blocked.c of the component Blocked-on-keys Subsystem. The manipulation results in use after free. The attack may be performed from remote. A high complexity level is associated with this attack. The exploitability is described as difficult. The exploit has been released to the public and may be used for attacks. The patch is identified as b2fb0e13f5b4c8c2fb63dcfc2c37a067a0d6d20b. Applying a patch is advised to resolve this issue. A flaw was found in Valkey. A remote attacker could exploit this flaw, leading to a denial of service. The complexity of exploiting this vulnerability is high. Red Hat severity: Low. Weakness: CWE-825. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:61884. Affected products named by the advisory: Red Hat package: valkey.