Red Hat Linux Security Advisories & CVEs
11983 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Low [CVE-2026-40203] Information disclosure via IMAP compression side-channel
When IMAP compression is enabled, the same compression state is reused across responses in a session, so response sizes depend on both attacker-supplied mail and other mail in the same mailbox. An attacker that can send mail to a user and can also observe the sizes of that user's IMAP traffic can confirm whether the body of a small message matches a guessed text. Recovery of arbitrary unknown content was not demonstrated, but the attack can disclose whether a secret-like message body matches a candidate. Update to non-vulnerable version. No publicly available exploits are known. By observing response sizes, an attacker could confirm if a secret message body matches a guessed text, leading to information disclosure. Red Hat severity: Low — CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-205. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: dovecot.
Critical [CVE-2026-47884] Remote Code Execution via improper path limitation in XsltView
Remote Code Execution via improper path limitation in XsltView. Red Hat rates this critical (CVSS 9.8). Weakness: CWE-22. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apache Camel - HawtIO 4; Red Hat Fuse 7; Red Hat OpenShift Dev Spaces; and 1 more. Affected products named by the advisory: Red Hat Single Sign-On 7.
High [CVE-2026-82072] Out of bounds read in V8
Out of bounds read in V8 in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Moderate — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-125.
High [CVE-2026-81934] Arbitrary code execution via TLS pending-data list use-after-free
Redis contains a use-after-free vulnerability in the 'tlsProcessPendingData()' function, which handles the TLS pending-data list if Redis is configured with TLS support. A remote, unauthenticated attacker may be able to execute arbitrary commands with the privileges of the Redis server. A flaw was found in Redis. This is an Important flaw in Redis, enabling remote, unauthenticated attackers to achieve arbitrary code execution. The vulnerability specifically impacts Redis instances configured with TLS support, which is not enabled by default in Red Hat Enterprise Linux, thereby limiting exposure in standard deployments. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-416. Affected products named by the advisory: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; and 6 more.
High [CVE-2026-81521] Write redirection via unvalidated database name in Client.BulkWrite
The MongoDB Go Driver's client-level bulk write operation may accept a caller-supplied database name containing a reserved separator character without escaping it before the name is used to build the target namespace for the operation. An application that passes untrusted input as a database name could therefore have the write directed at a database and collection other than the ones it intended. Only the Client. BulkWrite API is affected. BulkWrite` operation does not properly validate database names, allowing a specially crafted name with reserved characters to redirect write operations. This vulnerability could enable an attacker to modify or corrupt data in unintended databases and collections. Products that ship the 1.x driver series do not contain the affected API and are not affected. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-791. Affected Red Hat products: RHEM 1.1 for RHEL 10; RHEM 1.1 for RHEL 9; Red Hat Edge Manager 1.1; Red Hat Edge Manager 1.2; OpenShift Pipelines; Red Hat OpenShift Dev Spaces; Red Hat OpenShift GitOps; Red Hat Trusted Artifact Signer. Will not fix / out of support: OpenShift Pipelines; Red Hat OpenShift GitOps; Red Hat Trusted Artifact Signer. Red Hat fixing advisory: RHSA-2026:68334, RHSA-2026:68044, RHSA-2026:68253, RHSA-2026:68006, RHSA-2026:68254.
High [CVE-2026-59324] org.springframework.integration/spring-integration-core: Spring Integration: Information disclosure via cross-message header leakage
org.springframework.integration/spring-integration-core: Spring Integration: Information disclosure via cross-message header leakage. Red Hat rates this important (CVSS 8.2). Weakness: CWE-821. Affected product named by the advisory: Red Hat Fuse 7.
High [CVE-2026-5680] Undertow-core: undertow: denial of service via websocket permessage-deflate processing
A flaw was found in Undertow. A remote attacker could exploit this vulnerability by sending specially crafted WebSocket messages with permessage-deflate negotiated. This could lead to excessive memory consumption due to the PerMessageDeflateFunction.largerBuffer() method using exponential doubling, resulting in a Denial of Service (DoS) for the affected application. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9; Red Hat build of Apache Camel for Spring Boot 4; Red Hat Data Grid 8; Red Hat Enterprise Linux 9; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Process Automation 7; Red Hat Single Sign-On 7. Will not fix / out of support: Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Process Automation 7; Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2026:70230, RHSA-2026:70228, RHSA-2026:70229. Affected products named by the advisory: Red Hat package: resteasy.
High [CVE-2026-78002] Denial of service via heap buffer overflow in RainerScript replace function
A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system. Red Hat Enterprise Linux systems configured to receive remote syslog messages are susceptible to this issue, potentially impacting logging availability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-131. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Update Infrastructure 5; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat lists Red Hat Enterprise Linux 6 as not affected. Red Hat fixing advisory: RHSA-2026:69541, RHSA-2026:69540, RHSA-2026:71603. Affected products named by the advisory: Red Hat package: rsyslog.
High [CVE-2026-81727] Filesystem containment bypass allows local file overwrite
NLTK versions before 3.10.3 contain a filesystem containment bypass vulnerability in the Downloader.download and Downloader.incr_download methods that allows attackers to overwrite files outside the install root through pre-existing hardlinks. Attackers with write access to a shared downloader directory can create hardlinks pointing to outside-root files that are then overwritten during normal package extraction, mutating files outside the intended install tree. A flaw was found in NLTK. This vulnerability, a filesystem containment bypass, allows a local attacker with write access to a shared downloader directory to create special links (hardlinks) that point to files outside the intended installation area. When a package is extracted, these hardlinks can cause files outside the NLTK installation to be overwritten, leading to unauthorized modification or corruption of data. The NLTK library is vulnerable to a local file overwrite due to a filesystem containment bypass. This could result in data integrity and availability impacts. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Weakness: CWE-59. Affected Red Hat products: Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.5; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-81726] Unauthorized file access via path traversal in model-artifact APIs
NLTK through 3.10.3 contains a path traversal vulnerability in model-artifact APIs that bypass pathsec enforcement by using raw file operations on caller-controlled paths. Attackers can read or write files outside allowed sandbox roots through TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter APIs when pathsec is enabled. A flaw was found in NLTK. This vulnerability, known as path traversal, allows an attacker to bypass security restrictions in the model-artifact APIs. By exploiting this, an attacker can perform unauthorized read or write operations on files outside the intended secure directories. This could lead to sensitive information disclosure or system compromise. This vulnerability is rated as Important. NLTK's model-artifact APIs are susceptible to path traversal, allowing an attacker to read or write files outside intended sandbox directories. Exploitation requires no user interaction or privileges, but the attack complexity is high. Red Hat severity: Important — CVSS 8.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N). Weakness: CWE-22. Affected Red Hat products: Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI). Will not fix / out of support: Exploit Intelligence; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2.
High [CVE-2026-81724] Denial of Service via Uncontrolled Recursion
NLTK before 3.10.3 contains an uncontrolled recursion vulnerability in nltk.featstruct. FeatStructReader that allows unauthenticated attackers to cause a denial of service by supplying deeply nested feature-structure input. Attackers can craft trivial payloads with nested brackets that exceed Python's recursion limit and raise an unhandled RecursionError, crashing applications that parse user-supplied feature structures or feature grammars. A flaw was found in NLTK. By providing deeply nested feature-structure input, applications processing untrusted data can experience crashes due to uncontrolled recursion, impacting service availability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606. Affected Red Hat products: Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.5; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI). Red Hat lists OpenShift Lightspeed as not affected. Will not fix / out of support: Exploit Intelligence; Red Hat Ansible Automation Platform 2. Red Hat fixing advisory: RHSA-2026:73987, RHSA-2026:69539.
High [CVE-2026-81722] nltk PorterStemmer: Denial of Service due to inefficient token processing
nltk PorterStemmer in versions <= 3.10.2 (fixed in 3.10.3) contains an inefficient-algorithmic-complexity denial of service in PorterStemmer.stem(). The _is_consonant() helper walks backward over the entire run of trailing 'y' characters on every call, and _measure() invokes it for each stem position, causing O(n^2) behavior. A single ~20-50 KB untrusted token consisting of a long run of the letter 'y' followed by a matching suffix (e.g., 'ness') can pin a CPU core for seconds to minutes, causing availability impact. A flaw was found in the nltk PorterStemmer component. A remote attacker could exploit this vulnerability by providing a specially crafted, untrusted token. The inefficient algorithmic complexity in the stemming process, specifically within the _is_consonant() and _measure() helper functions, causes excessive CPU usage when processing certain inputs. This can lead to a denial of service (DoS) condition, where the system becomes unresponsive for an extended period. Processing a specially crafted, untrusted token can lead to excessive CPU consumption due to inefficient algorithmic complexity, potentially causing a denial of service for applications that rely on the affected stemming functionality. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606.
High [CVE-2026-80212] resolv gem: Denial of Service via uncontrolled memory growth from crafted DNS responses
An issue was discovered in the resolv gem before 0.7.2 for Ruby. Resolv::DNS::Resource.get_class, Resolv::DNS::Resource::Generic.create, and Resolv::DNS::SvcParam::Generic.create generate a new class for each unknown DNS resource record (type, class) pair, or each unknown SvcParamKey, encountered while decoding a response. Each generated class was permanently registered both as a constant on Resource (or SvcParam::Generic) and as an entry in a class-lookup hash (ClassHash), and thus the class remained reachable through that constant after the response was discarded. Type and class are each 16-bit values, and thus an attacker controlling DNS responses (a spoofed response, or a malicious or hijacked upstream DNS server) has roughly 2^32 distinct (type, class) pairs to choose from. A single response of a few hundred kilobytes carrying tens of thousands of distinct unknown types permanently grows process memory by tens of megabytes; repeated responses accumulate without bound and are never reclaimed by garbage collection, because the constant keeps each class alive. Any code path that calls Resolv::DNS::Message.decode on attacker-influenced DNS responses is affected. resolv is a default gem, and thus this is reachable from a plain Ruby installation without any additional dependency.
High [CVE-2026-47891] Denial of Service due to maxInMemorySize bypass
A Spring WebFlux application that relies on the Aalto XML processor to parse XML input does not correctly enforce the maxInMemorySize limit. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring Framework 5.3.0 - 5.3.49 Spring Framework 5.2.25.RELEASE and earlier A remote attacker could exploit this vulnerability by sending specially crafted XML, causing the application to bypass the maxInMemorySize limit. This can lead to excessive memory consumption, potentially resulting in a denial of service (DoS) condition for the application. CVE-2026-47891 affects Spring Framework's WebFlux module only when an application uses the reactive WebFlux stack together with the Aalto XML processor (com.fasterxml:aalto-xml) to parse XML request bodies. Red Hat products ship spring-web/spring-webflux transitively as part of servlet-based (Spring MVC) or non-web integrations; none run the reactive WebFlux XML-decode path, and the Aalto XML processor is not shipped in any Red Hat product (verified across the portfolio). The vulnerable code path is therefore never in execution, and these products are not affected. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
High [CVE-2026-47864] org.springframework.integration/spring-integration-http: Spring Integration: Arbitrary code execution via unsafe Java deserialization
org.springframework.integration/spring-integration-http: Spring Integration: Arbitrary code execution via unsafe Java deserialization. Red Hat rates this important (CVSS 8.1). Weakness: CWE-502. Affected product named by the advisory: Red Hat Fuse 7.
High [CVE-2026-38349] Denial of Service via crafted image file due to integer overflow
An integer overflow in the hScale16To19_c() function (libswscale/output.c) of FFmpeg N-122528-gdd2976b9e1 allows attackers to cause a Denial of Service (DoS) via supplying a crafted image file. A flaw was found in FFmpeg. This can lead to the application becoming unresponsive or crashing, preventing legitimate users from accessing the service. The ffmpeg package is not shipped in base Red Hat Enterprise Linux. It is available through EPEL, Red Hat Enterprise Linux AI, and as a bundled dependency in Red Hat OpenShift AI container images. The vulnerable code resides in libswscale, which is compiled and shipped in all FFmpeg builds across these products. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-80179] Denial of Service via malformed JWE tokens
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values. An attacker could provide a specially crafted malformed JWE token, causing excessive memory allocation and potentially degrading service availability. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift AI (RHOAI); Red Hat OpenStack Platform 16.2. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: python-jwcrypto.
Medium [CVE-2026-18374] Heap buffer overflow via attacker-controlled fopen mode string
Passing an effectively empty string to the `,ccs=` syntax extension of the mode argument in the `fopen` function in the GNU C Library version 2.45 or earlier may result in a heap buffer overflow when the mode string input to the function is attacker controlled. This usage pattern is not seen in applications in common GNU/Linux distributions and applications that process user-supplied values for `ccs` should not pass them through without validation. This vulnerability could allow an attacker with local access to trigger a heap buffer overflow by manipulating how the `fopen` function handles certain input. This could lead to minor disruptions in system operations or limited access to sensitive information. Exploitation is highly complex as this specific usage pattern is not common in applications within typical Red Hat Enterprise Linux environments, significantly limiting its practical applicability. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-134. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat lists Red Hat Hardened Images as not affected. Red Hat fixing advisory: RHSA-2026:65339.
Medium [CVE-2026-81893] invalid write in JPEG ICC profile parser on error recovery
A flaw was found in gdk-pixbuf. When loading a specially crafted JPEG image containing chunked ICC profile markers, an error during ICC profile parsing can leave stale size metadata after the profile buffer is freed. A subsequent allocation in the same decode can cause an out-of-bounds write, potentially crashing the application. Affected version >= 2.26.4 Red Hat Product Security has rated this issue as having Moderate security impact. Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: gdk-pixbuf2.
Medium [CVE-2026-59276] org.springframework.security/spring-security-core: Spring Security: Information disclosure via timing attack in sensitive value comparison
Several components in Spring Security compare security-sensitive values using standard string equality (String.equals()) rather than a constant-time comparison. Because String.equals() returns as soon as it finds a differing character, the time taken to reject an incorrect value is proportional to the number of leading characters that match the expected value. An attacker capable of submitting a very large number of guesses and precisely measuring response latency could, in principle, use these timing differences to recover the expected value one character at a time. Because rejection time can correlate with how many leading characters match, an attacker who can submit a very large number of requests and precisely measure response latency could, in theory, recover protected values incrementally, leading to information disclosure. Practical exploitation is difficult due to network variability and the volume of measurements required. Red Hat products that ship an affected version of Spring Security are affected. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-208. Affected Red Hat products: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat OpenShift Dev Spaces; Red Hat Single Sign-On 7. Will not fix / out of support: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat Single Sign-On 7.