Red Hat Linux Security Advisories & CVEs
5874 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-71498] Information disclosure via out-of-bounds read with malformed UTF-8 input
Information disclosure via out-of-bounds read with malformed UTF-8 input. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-125.
Medium [CVE-2026-70631] Information disclosure via uninitialized heap memory read in TIFF decoder
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services. A flaw was found in FFmpeg. An attacker can exploit an uninitialized heap memory disclosure vulnerability in the native TIFF decoder by providing a specially crafted TIFF file. When decoding a crafted TIFF file containing an undersized Deflate-compressed strip, tiff_unpack_zlib() fails to verify actual decompressed output length before executing frame-buffer memcpy() operations. This incorporates uninitialized stale heap memory from prior allocations into the rendered image stream. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-70630] Information disclosure via uninitialized heap memory read in Screenpresso decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services. A flaw was found in FFmpeg. This occurs when a crafted SPV1 packet with a valid zlib stream is supplied, causing the screenpresso_decode_frame() function to fail in validating the produced byte count. When decoding a crafted SPV1 packet containing a truncated zlib stream, screenpresso_decode_frame() fails to validate the decompressed byte length before invoking av_image_copy_plane(). When FFmpeg operates in persistent or shared-process services, processing untrusted media can expose sensitive memory contents, posing a Moderate impact to confidentiality.
Medium [CVE-2026-70629] Information disclosure via uninitialized heap memory read in RSCC decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services. A flaw was found in FFmpeg. When decoding a crafted video file containing a truncated compressed tile, rscc_decode_frame() fails to validate the decompressed byte count before invoking av_image_copy_plane(). When FFmpeg runs in persistent or shared-process services, processing untrusted media can expose sensitive heap memory contents, posing a High impact to confidentiality. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-908. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-71497] Cross-site scripting via malformed HTML tag names
Cross-site scripting via malformed HTML tag names. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-1289. Affected products named by the advisory: Cryostat 4; Migration Toolkit for Applications 8; OpenShift Developer Tools and Services; Red Hat AMQ Broker 7; and 12 more. Affected products named by the advisory: Red Hat build of Apache Camel - HawtIO 4; Red Hat build of Apicurio Registry 3; Red Hat build of Quarkus Native builder; Red Hat Enterprise Linux 10; and 8 more.
Medium [CVE-2026-61632] Information disclosure via path traversal in b64 extension
Information disclosure via path traversal in b64 extension. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Red Hat Developer Hub; Red Hat OpenShift Container Platform 4; Self-service automation portal 2.
Medium [CVE-2026-19167] Cross-origin data leakage via integer overflow in GPU
Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) This exploitation is possible by enticing a user to visit a specially crafted HTML page. This risk is primarily relevant to users who process untrusted web content. Red Hat severity: Moderate — CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N). Weakness: CWE-190.
Medium [CVE-2026-19146] Google Chrome (Android): Information disclosure via uninitialized GPU memory use
Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) A flaw was found in Google Chrome on Android, specifically within its Graphics Processing Unit (GPU) component. This Moderate impact information disclosure flaw affects the Chromium component in Red Hat community projects such as Fedora and EPEL. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-824.
Medium [CVE-2026-19139] OS-level privilege escalation due to a race condition via a malicious file
Race in CredentialProvider in Google Chrome on Windows prior to 151.0.7922.109 allowed a local attacker to perform OS-level privilege escalation via a malicious file. (Chromium security severity: High) This race condition vulnerability allows a local attacker to execute code with elevated operating system (OS) privileges. The attacker can achieve this by exploiting the flaw with a specially crafted malicious file, leading to OS-level privilege escalation. While Red Hat distributes the `chromium` component in community projects like Fedora and EPEL, this specific vulnerability is not applicable to Linux-based environments. Red Hat severity: Moderate — CVSS 6.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-367.
Medium [CVE-2026-71439] Denial of Service via Radar Diagrams 'ticks' parameter
Denial of Service via Radar Diagrams 'ticks' parameter. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-1050.
Medium [CVE-2026-71438] Prototype pollution vulnerability via configuration APIs
Prototype pollution vulnerability via configuration APIs. Red Hat rates this moderate (CVSS 4). Weakness: CWE-915. Affected products named by the advisory: Red Hat Build of Podman Desktop; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Dev Spaces.
Medium [CVE-2026-50159] CSS injection allows altering page elements via diagram input
CSS injection allows altering page elements via diagram input. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-79.
Medium [CVE-2026-71437] Prototype pollution vulnerability allows potential arbitrary code execution
Prototype pollution vulnerability allows potential arbitrary code execution. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-915.
Medium [CVE-2026-64654] Terminal escape sequence injection allows command execution
Terminal escape sequence injection allows command execution. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-78.
Medium [CVE-2026-64653] Path traversal via unescaped URL variables
Path traversal via unescaped URL variables. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-22.
Medium [CVE-2026-43630] Information disclosure via out-of-bounds read
llama.cpp builds b5702 through b7653 contain an out-of-bounds read vulnerability in the recurrent memory state restore path that allows attackers with write access to the slot save directory to read memory past the end of the allocated cells array. Attackers can craft a malicious slot file with an oversized seq_id value to trigger an out-of-bounds read that leaks heap data including pointer values into server logs, defeating ASLR protections and facilitating further exploitation. This information disclosure can defeat Address Space Layout Randomization (ASLR) protections and facilitate further exploitation. Exploitation requires local write access to the slot storage directory to introduce crafted state files prior to a restoration operation. The impact is strictly bounded to low confidentiality loss from heap memory leakage into application logs and low availability impact from potential process crashes (C:L, I:N, A:L), with zero impact on data or system integrity. Deployments enforcing write-restricted filesystem permissions on session state directories or running purely stateless inference workloads are completely unaffected. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-125.
Medium [CVE-2026-70639] Denial of Service in Android JNI wrapper via malicious model file
llama.cpp builds b1886 through b7445 contain a null pointer dereference vulnerability in the LLaMA-Android JNI wrapper where the bench_1model() function fails to validate the model context pointer before dereferencing it. Attackers can supply a malicious, corrupt, or truncated model file to trigger a null context condition, causing a SIGSEGV crash that terminates the Android application process and results in denial of service. This flaw allows an attacker to provide a malicious or corrupt model file, which causes the `bench_1model()` function to attempt to use an invalid memory address. This leads to a crash of the Android application, resulting in a denial of service (DoS) where the application becomes unavailable. llama.cpp is packaged for Fedora (python-llama-cpp-python, ollama, llama-cpp) as Linux command-line/library builds. This flaw is specific to the LLaMA-Android JNI wrapper's bench_1model() function, which is Android-only code that is not compiled or reachable in the standard Linux RPM builds. No Red Hat/community product is affected. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476.
Medium [CVE-2025-49506] Information disclosure via timing attack in password validation
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue. A flaw was found in Apache Portable Runtime Utility (apr-util). By observing the time differences in comparisons, an attacker could potentially deduce the content of sensitive information like password hashes. This vulnerability is assessed as Low Impact due to significant practical exploitation barriers. While the theoretical outcome of a successful timing attack is hash disclosure (Confidentiality: High), isolating microsecond-level comparison differences over a network is rendered practically infeasible by unpredictable network latency, packet jitter, and server scheduling noise (Attack Complexity: High). Additionally, RHEL environments natively rely on the system crypt() implementation for standard password checks, bypassing the vulnerable non-constant-time fallback code path in standard deployment scenarios. Red Hat severity: Low — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-208.
Medium [CVE-2026-32327] Denial of Service via XML stack recursion attack
Denial of Service via XML stack recursion attack. Red Hat rates this moderate (CVSS 6.2). Weakness: CWE-776. Red Hat lists fixing advisory RHSA-2026:58474 with package apr-util-main-1.6.5-1.hum1.
Medium [CVE-2026-57818] Authorization Code Replay via Race Condition
A race condition in JCacheCodeDataProvider allows an attacker to redeem a single authorization code multiple times via concurrent requests, resulting in the issuance of multiple distinct, valid access tokens. Users are recommended to upgrade to versions 4.2.3, 4.1.8 or 3.6.12, which fix this issue. A flaw was found in Apache CXF. This can result in the issuance of multiple distinct, valid access tokens, potentially leading to unauthorized access or session hijacking. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16; Red Hat JBoss Web Server 5. Will not fix / out of support: Red Hat JBoss Web Server 5. Red Hat fixing advisory: RHSA-2026:71675.