Red Hat Linux Security Advisories & CVEs
10918 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Low [CVE-2026-102822] Denial of Service via improper MAC negotiation with block ciphers
Denial of Service via improper MAC negotiation with block ciphers. Red Hat rates this low (CVSS 3.7). Weakness: CWE-125. Affected product named by the advisory: Red Hat Hardened Images.
Low [CVE-2026-95316] Unchecked return value in Performance
Unchecked return value in Performance. Red Hat rates this low (CVSS 3.3). Weakness: CWE-252.
Low [CVE-2026-102635] Information disclosure via crafted GIF file
Information disclosure via crafted GIF file. Red Hat rates this low (CVSS 3.7). Weakness: CWE-908. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat package: imagemagick.
Low [CVE-2026-35191] Traffic amplification Denial of Service via QUIC packet over-accounting
Traffic amplification Denial of Service via QUIC packet over-accounting. Red Hat rates this low (CVSS 3.7). Weakness: CWE-358. Red Hat lists fixing advisory RHSA-2026:74162 with package openssl-main-3.5.9-0.1.hum1, openssl3-main-3.5.9-0.1.hum1. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 15 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat JBoss Core Services; and 11 more.
Low [CVE-2026-35189] Denial of Service via excessive memory allocation in CRL distribution point processing
Denial of Service via excessive memory allocation in CRL distribution point processing. Red Hat rates this low (CVSS 3.7). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:74162 with package openssl-main-3.5.9-0.1.hum1, openssl3-main-3.5.9-0.1.hum1. Affected products named by the advisory: Red Hat Developer Hub; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 15 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat JBoss Core Services; and 11 more.
High [CVE-2026-102278] Denial of Service via uncontrolled recursion in nested brace patterns
Denial of Service via uncontrolled recursion in nested brace patterns. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:73916 with package nodejs22-main-10.9.9-1.22.23.3.2.3.2.2.hum1, nodejs26-main-11.19.1-1.26.10.0.0.3.hum1, nodejs24-main-11.19.0-1.24.21.0.1.1.hum1, nodejs26-main-11.19.1-1.26.10.0.0.2.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-102276] Denial of Service via stack exhaustion from crafted brace patterns
Denial of Service via stack exhaustion from crafted brace patterns. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:74168 with package nodejs22-main-10.9.9-1.22.23.3.2.3.2.2.hum1, nodejs26-main-11.19.1-1.26.10.0.0.3.hum1, nodejs24-main-11.19.0-1.24.21.0.1.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; Red Hat 3scale API Management Platform 2; Red Hat build of Apache Camel - HawtIO 4; and 11 more. Affected products named by the advisory: Red Hat build of Apicurio Registry 3; Red Hat Build of Keycloak; Red Hat Ceph Storage 4; Red Hat Connectivity Link 1; and 7 more.
High [CVE-2026-102273] Token forgery via acceptance of public JWK containers as HMAC secrets
Token forgery via acceptance of public JWK containers as HMAC secrets. Red Hat rates this important (CVSS 7.4). Weakness: CWE-347. Affected products named by the advisory: Ansible Automation Orchestrator 2026; Confidential Compute Attestation; Fence Agents Remediation Operator; Lightspeed Core; and 11 more. Affected products named by the advisory: Migration Toolkit for Applications 8; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; and 7 more.
High [CVE-2026-102272] Token forgery via improper Unicode byte-order mark handling
Token forgery via improper Unicode byte-order mark handling. Red Hat rates this important (CVSS 7.4). Weakness: CWE-347.
High [CVE-2026-102271] Authentication bypass via acceptance of DER public keys as HMAC secrets
Authentication bypass via acceptance of DER public keys as HMAC secrets. Red Hat rates this important (CVSS 7.4). Weakness: CWE-347.
High [CVE-2026-102267] Verification key substitution via unvalidated JWKS redirects
Verification key substitution via unvalidated JWKS redirects. Red Hat rates this important (CVSS 7.4). Weakness: CWE-346.
High [CVE-2026-102266] Authentication bypass via empty HMAC key acceptance
Authentication bypass via empty HMAC key acceptance. Red Hat rates this important (CVSS 7.4). Weakness: CWE-347.
High [CVE-2026-101916] Authentication bypass via improper peer certificate validation
Authentication bypass via improper peer certificate validation. Red Hat rates this important (CVSS 7.4). Weakness: CWE-295. Affected products named by the advisory: Red Hat Build of Podman Desktop; Red Hat Developer Hub; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Dev Spaces; and 1 more. Affected products named by the advisory: Self-service automation portal 2.
High [CVE-2026-96760] Signature verification bypass via deserialize_json
Signature verification bypass via deserialize_json. Red Hat rates this important (CVSS 7.5). Weakness: CWE-347. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; and 4 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux command line assistant; Red Hat OpenShift Virtualization 4; Red Hat Satellite 6.
High [CVE-2026-93355] Privilege escalation via unverified email lookup in JWT authentication
Privilege escalation via unverified email lookup in JWT authentication. Red Hat rates this important (CVSS 8.1). Weakness: CWE-290. Affected products named by the advisory: Lightspeed Core; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-102010] Denial of Service via use-after-free in binary heap erase_if
Denial of Service via use-after-free in binary heap erase_if. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:74569 with package gcc-main-16.2.1-3.hum1, gcc13-main-13.5.0-0.2.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 13 more. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: gcc-toolset-15-gcc; and 9 more.
High [CVE-2026-97023] CVE-2026-97023
CVE-2026-97023. Red Hat rates this important (CVSS 7.1). Weakness: CWE-61. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: flatpak.
High [CVE-2026-101909] Denial of Service via prototype pollution gadget in form serialization
Denial of Service via prototype pollution gadget in form serialization. Red Hat rates this important (CVSS 8.2). Weakness: CWE-915. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-101906] Denial of Service via crafted redirect hostname
Denial of Service via crafted redirect hostname. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-101905] Request socket hijacking via inherited createConnection property
Request socket hijacking via inherited createConnection property. Red Hat rates this important (CVSS 7.4). Weakness: CWE-941. Red Hat lists fixing advisory RHSA-2026:74872 with package grafana12-4-main-12.4.12-0.3.hum1, grafana13-1-main-13.1.6-0.6.hum1, grafana13-2-main-13.2.1-0.9.hum1. Affected product named by the advisory: Red Hat Hardened Images.