Red Hat Linux Security Advisories & CVEs
11992 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2025-61164] Information Leak via WebSocket Endpoint
Cohere North AI v1.1.5 was discovered to contain an information leak via the WebSocket Endpoint. A remote attacker could exploit this to gain unauthorized access to sensitive data. An unauthenticated remote attacker can establish a connection or interact with the endpoint to intercept sensitive data exchanged through active channels. Under default Red Hat container deployment standards, risk is limited to data handled by the service instance itself, though sensitive API responses or telemetry may still be exposed without requiring elevated privileges. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-319. Affected Red Hat products: Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2025-61162] Arbitrary user information overwrite via incorrect access control
Incorrect access control in Cohere North AI v1.1.5 allows attackers to arbitrarily overwrite user info via a crafted request to the /api/internal/v1/users/{{USER_ID}} endpoint This action enables the attacker to arbitrarily overwrite user information. The primary impact is unauthorized modification of user data. An unauthenticated remote attacker can exploit this flaw by issuing a specially crafted request to overwrite arbitrary user profile information. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-26445] Denial of Service via partial STOMP frames
stomper 5e2741e is vulnerable to Denial of Service. A malicious client can send partial STOMP frames and keep the TCP connections open, which, combined with the broker s use of edge-triggered epoll (EPOLLET) and MSG_PEEK in recv(), causes sockets to enter a permanent half-read state. When enough such connections accumulate, the broker stops receiving any further epoll events for those sockets and eventually hangs in epoll_wait, effectively refusing to process new messages. A flaw was found in stomper. A remote attacker can exploit this by sending partial STOMP (Streaming Text Oriented Messaging Protocol) frames. Consequently, the broker stops processing new messages, leading to a Denial of Service (DoS) for legitimate users. A remote unauthenticated attacker can cause a Denial of Service by sending partial STOMP frames over open TCP connections. Red Hat default security controls (e.g., non-root execution, process isolation) do not prevent this service-level socket starvation, though network boundaries can limit exposure. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-772.
High [CVE-2026-26447] Denial of Service via Use-After-Free vulnerability
Stomper 5e2741e is vulnerable to Use-After-Free. When a single client repeatedly issues SUBSCRIBE commands for the same destination over one connection and then closes that connection, the broker performs incorrect cleanup of its internal subscription structures. This results in a heap use-after-free during StompClient destruction, causing the broker process to crash. An unauthenticated client can exploit this to reliably trigger a denial of service. A flaw was found in Stomper. This leads to incorrect cleanup of internal subscription structures, resulting in a heap use-after-free during StompClient destruction. Successful exploitation causes the broker process to crash, leading to a denial of service. A remote, unauthenticated attacker can exploit this by repeatedly issuing SUBSCRIBE commands for the same destination over a single connection and subsequently closing the connection. RHEL default security controls like address space layout randomization (ASLR) and process isolation limit this impact to a Denial of Service against the broker process, without granting arbitrary code execution. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825.
High [CVE-2026-26449] Denial of Service via missing destination header in SEND frame
In Stomper 5e2741e when a client sends a SEND frame missing the destination header field, the server triggers a null pointer dereference (or access to invalid memory) while processing the frame, causing the process to crash. A flaw was found in Stomper. A remote attacker can send a specially crafted message, specifically a SEND frame missing the destination header field, to the server. This vulnerability leads to a Denial of Service (DoS), making the server unavailable to legitimate users. Red Hat default security controls, such as process isolation and non-root execution environments, mitigate the issue by preventing privilege escalation or arbitrary code execution beyond a Denial of Service against the message broker. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476.
High [CVE-2026-26448] Denial of Service via Use-After-Free
Stomper 5e2741e is vulnerable to Use-After-Free. When a client sends multiple CONNECT frames on the same TCP connection, and subsequently another client (or a later connection) sends SEND frames to a destination previously subscribed on that connection, the broker may dereference a pointer to a StompStreamSocket object that has already been freed. This results in a heap use-after-free and process crash. Because the protocol does not authenticate or restrict such sequences by default. A flaw was found in Stomper. A remote attacker can trigger a use-after-free vulnerability by sending multiple CONNECT frames on the same TCP connection, followed by SEND frames to a previously subscribed destination. This sequence causes the broker to dereference a freed StompStreamSocket object, triggering a heap corruption and crashing the broker process. Red Hat default security controls (such as process isolation and non-root execution boundaries) constrain the issue to a Denial of Service against the messaging daemon, preventing arbitrary code execution. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825.
High [CVE-2026-26446] Denial of Service due to improper handling of closed TCP connections
Stomper 5e2741e is vulnerable to Denial of Service. When a broker sends data to a client whose TCP connection was already closed by the peer, the server process receives SIGPIPE and immediately terminates, resulting in a denial of service. Any unauthenticated client can trigger the crash by closing the socket at specific points. A flaw was found in Stomper. This action causes the server process to receive a SIGPIPE signal, leading to its immediate termination and a denial of service for legitimate users. Because the process fails to ignore or handle SIGPIPE during active write operations, the daemon terminates abruptly. Red Hat default security controls (such as process isolation and systemd service auto-restart directives) restrict the failure strictly to an availability impact on the message broker service, without allowing privilege escalation or memory corruption. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-248.
Medium [CVE-2026-47863] Denial of Service in bufferTimeout operator
In Reactor Core, applications that use the Flux.bufferTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.7.19 and earlier This occurs when upstream components deliver items during an active flush, causing the processing pipeline to permanently hang and making the application unresponsive. This impact is considered Moderate because exploitation requires a specific, non-default application configuration or usage pattern. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat build of Quarkus 3.27.5.SP2; Red Hat build of Quarkus 3.33.3.SP2; Exploit Intelligence; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Debezium 3; Red Hat Data Grid 8; Red Hat Fuse 7. Will not fix / out of support: Exploit Intelligence; Red Hat Fuse 7. Red Hat fixing advisory: RHSA-2026:69470, RHSA-2026:69440.
Medium [CVE-2026-47857] Denial of Service via Flux.windowTimeout operator with fairBackpressure
In Reactor Core, applications that use the Flux.windowTimeout operator with fairBackpressure enabled are vulnerable to a Denial of Service (DoS) condition. Reactor Core 3.8.0 - 3.8.6 Reactor Core 3.5.0 - 3.7.19 Reactor Core 3.4.41 and earlier This could cause applications to become unresponsive or crash. The impact is confined to service availability and requires the specific operator and backpressure setting to be actively deployed within the application. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat build of Quarkus 3.27.5.SP2; Red Hat build of Quarkus 3.33.3.SP2; Exploit Intelligence; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Debezium 3; Red Hat Data Grid 8; Red Hat Fuse 7. Will not fix / out of support: Exploit Intelligence; Red Hat Fuse 7. Red Hat fixing advisory: RHSA-2026:69470, RHSA-2026:69440.
Medium [CVE-2026-80183] Information disclosure via improper handling of domain IDs in role assignment listings
In OpenStack Keystone before 29.0.3, any authenticated user holding role:reader on any project can list every project-scoped role assignment under any domain by passing a domain ID as scope.project.id with include_subtree to the GET /v3/role_assignments endpoint. The domain's project record has domain_id=null, causing the policy domain_id check to pass for any caller. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role involved. The literal "default" domain ID works against any deployment created with keystone-manage bootstrap. An attacker can harvest domain IDs from the response and repeat the query to map role assignments across the entire cloud. This is caused by misuse of "None" in list_role_assignments_for_tree. This leads to the disclosure of names and home-domain IDs for users, groups, projects, and roles throughout the cloud infrastructure. This vulnerability was introduced in OpenStack Train 16.0.0 and affects all Red Hat OpenStack Platform versions shipping Keystone versions before the fixes (27.1.0, 28.1.0, 29.1.0). Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat OpenStack Platform 13 (Queens); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
Medium [CVE-2026-80158] ipa_getkeytab does not set no_log on the bind_pw parameter, disclosing the IPA bind password in logs and process listings
A flaw was found in the ipa_getkeytab module of the community.general Ansible collection. The module's bind_pw parameter, used to supply the LDAP simple-bind password when retrieving a Kerberos keytab, is not declared with no_log, unlike the sibling password parameter in the same module. As a consequence, the supplied IPA/LDAP bind password is recorded in cleartext in the managed host's system journal/syslog (the module's "Invoked with" record), is included in the module's return values and verbose (-v) output, and is displayed in Automation Controller / AWX job output. The password is additionally passed on the command line to the ipa-getkeytab helper (as --bindpw ), exposing it in the process list to local users while the command runs. An attacker able to read these logs, job output, or the process table can obtain the directory bind credential, potentially compromising the accounts and objects that credential can access. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-214. Affected Red Hat products: Red Hat Ceph Storage 5; Red Hat Ceph Storage 9; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-47842] org.springframework.security/spring-security-core: Spring Security: Information disclosure via deterministic AES/CBC encryption
Applications using AesBytesEncryptor with the two-argument constructor or when passing a null IV generator and CBC as the encryption mode encrypt data with AES/CBC using a null (all-zero) initialization vector. Spring Security 7.1.0 Spring Security 7.0.0 - 7.0.6 Spring Security 6.5.0 - 6.5.11 Spring Security 6.4.0 - 6.4.18 Spring Security 5.8.0 - 5.8.27 Spring Security 5.7.0 - 5.7.25 This deterministic encryption allows an attacker to analyze encrypted data and potentially deduce patterns, leading to the disclosure of sensitive information. Because the IV is deterministic, identical plaintexts always produce identical ciphertext for a given password and salt. An attacker with read access to the encrypted data store can exploit this to determine when two records share the same plaintext value, correlate encrypted values across rows or users, and mount dictionary attacks by pre-encrypting candidate values and comparing results. This is a continuation of CVE-2020-5408. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-1204. Affected Red Hat products: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat OpenShift Dev Spaces; Red Hat Single Sign-On 7. Will not fix / out of support: OpenShift Developer Tools and Services; Red Hat Fuse 7; Red Hat Single Sign-On 7.
Medium [CVE-2026-73549] scoped IPv6 handling crash for HTTP/3 clients in original DST clusters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's Utility::copyInternetAddressAndPort and QUIC client-address paths reconstruct scoped IPv6 addresses through addressAsString and Ipv6Instance. The string includes a percent scope identifier that inet_pton cannot parse, causing an exception or abort. Kernel-provided scoped IPv6 destinations in ORIGINAL_DST transparent-proxy deployments, and affected QUIC connection paths, can therefore terminate the process. The relevant scope boundary is that the HTTP use_http_header override rejects scoped addresses earlier; the advisory's crash path requires a kernel-provided original destination or the affected QUIC path. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. An attacker could cause a Denial of Service (DoS) by sending network requests using scoped Internet Protocol version 6 (IPv6) client addresses. Due to improper parsing when copying network addresses in original destination routing configurations and HTTP/3 connections, the application terminates unexpectedly, interrupting service availability. This vulnerability is rated as Moderate severity because it results in denial of service through an Envoy proxy crash without compromising system confidentiality or integrity.
Medium [CVE-2026-50572] ext_authz use-after-free after rejecting an HTTP request
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's HTTP external-authorization client can retain a stale request callback after a request is rejected. When RawHttpClientImpl::onSuccess later processes the authorization response, it can invoke callbacks_ after the callback owner has been destroyed, causing a use-after-free and process crash under production traffic. The relevant scope boundary is that the vulnerable path uses the HTTP ext_authz client; the advisory does not establish the same trigger for unrelated filters. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. In the external authorization (ext_authz) HTTP client, completing an authorization request can send a rejection response and destroy the client while its completion handler is still executing. A remote attacker could exploit this timing condition to trigger a use-after-free flaw, crashing the proxy and causing a Denial of Service (DoS). This vulnerability is evaluated as having a Moderate impact for Red Hat products because triggering the crash requires non-default configurations and specific timing conditions, limiting the impact to denial of service without compromising system confidentiality or integrity.
Medium [CVE-2026-48521] HTTP/3 null transport socket options dereference during connection-pool selection
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's ProdClusterManagerFactory::allocateConnPool dereferences transport_socket_options while selecting an HTTP/3 connection pool without first checking whether the pointer is null. LoadBalancerContext implementations used by synthetic, mirror, health-check, and async-client calls can return no transport-socket options. With auto_config and HTTP/3 enabled, routine traffic reaching one of those contexts can crash an Envoy worker. The relevant scope boundary is that the affected branch requires HTTP/3 in the protocol set and a context that supplies no transport-socket options. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. A remote attacker can cause a Denial of Service (DoS) when HTTP/3 and automatic protocol selection are enabled. The proxy attempts to access transport socket options during connection pool selection without verifying that they exist, causing an unexpected process crash when processing certain request flows. This flaw is rated as having a Moderate severity because exploitation requires an uncommon upstream configuration where HTTP/3 is enabled alongside ALPN connection pooling.
Medium [CVE-2026-73551] path normalization bypass via dot/dot-dot segments with parameters
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy's URL normalization does not recognize dot and dotdot path segments when they carry semicolon parameters. A request such as /user/..;foo=bar/admin is therefore not canonicalized to /admin even when path normalization is enabled. If an upstream interprets the segment according to RFC 3986 while Envoy applies routing or RBAC to the uncollapsed path, a remote client can cause path confusion and bypass path-based security policy. The relevant scope boundary is that the security consequence depends on a downstream/upstream path interpretation mismatch or a path-based Envoy decision. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. This vulnerability allows a remote attacker to bypass path-based access controls by sending requests with parameters inside dot and dot-dot URL path segments. Because Envoy fails to properly normalize these path segments, backend applications and access-control filters may interpret the requested path differently, potentially granting unauthorized access to protected resources.
Medium [CVE-2026-73511] path matching bypass via per-segment parameters not stripped by router
Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy normally matches the raw request path, while servlet backends such as Apache Tomcat strip semicolon matrix parameters from each path segment before resolving the resource. Envoy's ignore_path_parameters_in_path_matching option instead truncates at the first semicolon and still does not match per-segment backend behavior. A remote client can use a parameterized protected segment, or a parameter on an earlier segment, to make Envoy select an unprotected fallback while the backend resolves the protected resource. The relevant scope boundary is that the bypass requires both a path-based Envoy decision and a backend that strips semicolon parameters per segment. This issue is fixed in versions 1.36.10, 1.37.6, 1.38.4, and 1.39.1. A flaw was found in Envoy. A remote attacker can exploit this vulnerability by submitting an HTTP request containing per-segment path parameters separated by semicolons. Due to differences in how Envoy and backend servers process these parameters, path matching rules can become misaligned, potentially allowing an attacker to bypass path-based access controls or authentication mechanisms.
Medium [CVE-2026-80206] Denial of Service vulnerability in tgrep module
NLTK before 3.10.3 contains a regular expression denial of service (ReDoS) vulnerability in the tgrep module. The _tgrep_node_action function compiles user-supplied regular expressions embedded in /regex/ pattern nodes and executes them via re.search against tree node labels without any validation or timeout. An attacker who controls the tgrep pattern (e.g., via tgrep_positions() or tgrep_compile() exposed to external input) can supply a pattern that triggers catastrophic backtracking, causing indefinite CPU saturation that blocks the Python process. A flaw was found in NLTK, specifically within its tgrep module. This vulnerability, known as Regular Expression Denial of Service (ReDoS), allows a remote attacker to provide specially crafted regular expressions. When processed, these expressions can cause indefinite CPU saturation, leading to a complete denial of service for the Python process utilizing the NLTK library. When processing user-supplied regular expressions inside /regex/ pattern nodes via functions such as tgrep_positions() or tgrep_compile(), NLTK executes re.search without input validation or execution timeouts. If an application exposes these interfaces to unauthenticated or low-privileged attackers, supplying a specially crafted regular expression triggers catastrophic backtracking, resulting in CPU saturation and process-level denial of service.
Medium [CVE-2026-79654] Katello Content View History API Cross-Organization Authorization Bypass
A flaw was found in Katello where the Content View History API does not properly enforce authorization when accessing a Content View specified by the user. An authenticated user with permission to view Content Views in one organization may be able to access the lifecycle history of a Content View belonging to another organization by supplying its identifier to the affected API endpoint. This can result in unauthorized disclosure of Content View lifecycle information, including publication and promotion events, associated users, and timestamps. Because the exposure is limited to unauthorized disclosure of Content View lifecycle information, and does not grant access to repository contents, credentials, modification rights, or administrative privileges, Red Hat Product Security has assessed this vulnerability as having a Moderate impact. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; Red Hat Satellite 6. Red Hat lists Red Hat Satellite 6 as not affected. Red Hat fixing advisory: RHSA-2026:74506, RHSA-2026:74504, RHSA-2026:74503.
Medium [CVE-2026-74749] Prevent hard lockup on granted time slice extension
In the Linux kernel, the following vulnerability has been resolved: rseq: Prevent hard lockup on granted time slice extension __exit_to_user_mode_loop() invokes rseq_grant_timeslice_extension() with interrupts enabled. If the extension is granted it invokes hrtimer_rearm_deferred_tif() to ensure that a pending deferred hrtimer rearm is handled before exiting to user space. Though this invokes __hrtimer_rearm_deferred() which expects to be invoked with interrupts disabled as it takes hrtimer_cpu_base::lock with raw_spin_lock(). That's a livelock waiting to happen and caught by lockdep: WARNING:./include/linux/hrtimer_rearm.h:17 at irqentry_exit, CPU#1: slice_test WARNING: inconsistent lock state inconsistent {IN-HARDIRQ-W} -> {HARDIRQ-ON-W} usage. Prevent this by disabling interrupts around the invocation of hrtimer_rearm_deferred_tif() in rseq_grant_timeslice_extension(). [ tglx: Massaged change log ] A flaw was found in the Linux kernel's restartable sequences (rseq) mechanism. An inconsistency in the handling of lock states during time slice extensions can occur when interrupts are enabled. This can lead to a system livelock or hard lockup, effectively causing a Denial of Service (DoS) for the affected system. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-366.