Red Hat Linux Security Advisories & CVEs
12201 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-55553] Credential leakage via cross-origin redirects
urllib is an HTTP client for Node.js that supports authentication, redirects, timeouts, and other request features. Prior to 4.9.1 and 2.44.1, urllib follows redirects through followRedirect but reuses caller-supplied options across origins. In src/HttpClient.ts, #requestInternal recursively calls this.#requestInternal(nextUrl.href, options, requestContext), causing options.headers and auth or digestAuth values to be reused when the redirect target has a different scheme, host, or port. Authorization, Cookie, Proxy-Authorization, x-api-key, x-auth-token, and x-access-token can therefore be sent to an attacker-controlled redirected origin, exposing credentials intended for the original origin and potentially allowing reuse against the original partner API or related services. No user interaction is required. This issue is fixed in versions 2.44.1 and 4.9.1. A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-201.
High [CVE-2026-63075] QUIC ACK-only packet retention can cause memory exhaustion
Issue summary: When OpenSSL processes QUIC traffic from a peer that repeatedly sends ack-eliciting packets while not acknowledging ACK-only responses, the QUIC stack can retain ACK-only packet metadata for the lifetime of the connection. Impact summary: A remote peer that can complete a QUIC handshake can cause connection-scoped memory growth which may lead to Denial of Service through memory exhaustion, especially with sustained traffic or many concurrent QUIC connections. CWE: CWE-770: Allocation of Resources Without Limits or Throttling Description: When the OpenSSL QUIC stack sends an ACK-only packet, there is no requirement by the QUIC protocol that the peer will acknowledge that ACK-only packet (i.e. it is itself not ack-eliciting). However, the OpenSSL implementation stores the metadata about the ACK frames regardless. In and of itself that's ok, but if a malicious peer establishes a connection, and then drives the connection such that ACK-only packets are forced from the OpenSSL implementation peer (i.e., by sending numerous PING frames), and then withholding any subsequent acks for ack-eliciting data, like legitimate data, said malicious peer can force inappropriate memory growth on the OpenSSL peer, potentially leading to a Denial of Service.
High [CVE-2026-79776] Authentication bypass leads to backend credential disclosure
rclone before 1.75.0 mounts the pprof debug handler as its own router route, bypassing the fail-closed authentication rule in the main handler. Attackers can access the /debug/pprof/cmdline endpoint unauthenticated to retrieve the full process argv including backend credentials. A flaw was found in rclone. A remote attacker can bypass the authentication mechanism by accessing the `/debug/pprof/cmdline` endpoint. Successful exploitation allows an unauthenticated attacker to retrieve sensitive backend credentials, leading to information disclosure. This flaw is rated as Important because unauthenticated attackers can remotely access sensitive backend credentials from rclone instances running with the remote control daemon enabled. This bypasses the intended authentication, allowing for critical information disclosure. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-305. Red Hat lists Cryostat 4; Red Hat Advanced Cluster Management for Kubernetes 2 as not affected.
High [CVE-2026-79770] Denial of Service via crafted CSS selectors
Nokogiri versions before 1.19.3 contain regular expression denial of service vulnerabilities in the CSS selector tokenizer affecting string-literal and identifier tokenization. Attackers can inject adversarial CSS selectors into methods like Node#css, Node#at_css, and Searchable#search to cause exponential regex backtracking and denial of service. A flaw was found in Nokogiri. This injection can lead to regular expression denial of service (ReDoS) due to exponential regex backtracking, causing the application to become unresponsive. When processing untrusted user input passed to methods like Node#css, Node#at_css, or Searchable#search, an attacker can inject adversarial CSS selectors containing malicious string literals or identifiers. This triggers exponential regex backtracking within the parser, causing severe CPU exhaustion and leading to a Denial of Service (DoS) for the application thread. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Satellite 6 as not affected.
High [CVE-2026-79674] Information disclosure via path traversal in corpus-reader constructors
NLTK versions before 3.10.3 contain a path sandbox bypass vulnerability in corpus-reader constructors that allows attackers to read files outside the intended data root. Attackers can supply arbitrary corpus root paths to LinThesaurusCorpusReader and PanLexLiteCorpusReader constructors to access filesystem content and SQLite databases outside the pathsec sandbox boundary. A flaw was found in NLTK. A path traversal vulnerability exists in NLTK's corpus reader constructors LinThesaurusCorpusReader and PanLexLiteCorpusReader. An attacker capable of supplying arbitrary corpus root inputs can read files outside the intended data directory. Data exposure is restricted to files readable by the executing process user, and OS discretionary access controls or container isolation boundaries prevent privilege escalation beyond the application context. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat OpenShift AI 3.3; Red Hat OpenShift AI 3.5; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI). Red Hat lists OpenShift Lightspeed as not affected. Will not fix / out of support: Exploit Intelligence; Red Hat Ansible Automation Platform 2. Red Hat fixing advisory: RHSA-2026:73987, RHSA-2026:69539.
High [CVE-2026-79675] NLTK before 3.10.3 JVM Argument Injection via Per-Call Options
NLTK before 3.10.3 fails to validate JVM options passed through the per-call options parameter in the java() function, allowing attackers to inject dangerous JVM flags. Attackers can supply malicious options like -agentpath, -javaagent, or @argfile to Stanford wrapper classes to achieve arbitrary code execution. A flaw was found in NLTK. A remote attacker could exploit this by injecting dangerous JVM flags, such as -agentpath or -javaagent, to achieve arbitrary code execution. Successful exploitation requires specific conditions, indicating a higher attack complexity. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-88. Affected Red Hat products: Red Hat OpenShift AI 3.3; Exploit Intelligence; Lightspeed Core; OpenShift Lightspeed; Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI). Red Hat lists Red Hat OpenShift AI (RHOAI) as not affected. Will not fix / out of support: Exploit Intelligence; Red Hat Ansible Automation Platform 2. Red Hat fixing advisory: RHSA-2026:73987.
High [CVE-2025-71407] Nokogiri before 1.18.3 Stack Buffer Overflow and Use-After-Free
Nokogiri before 1.18.3, when using bundled libxml2, is affected by the libxml2 flaws CVE-2025-24928 and CVE-2024-56171. This CVE does not represent a flaw in Nokogiri, but is rather a duplicate assignment for different CVEs affecting libxml2 or libxslt. The rubygem-nokogiri packages as shipped in Red Hat products do not bundled libxml2 and libxslt, but rather use system packages of those libraries. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-121. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Satellite 6 as not affected.
High [CVE-2025-71406] Memory corruption via crafted XSLT
Nokogiri before 1.18.4 bundles a vulnerable version of libxslt (prior to 1.1.43) that contains two use-after-free vulnerabilities: CVE-2025-24855 (use-after-free of the XPath context node due to xsltEvalXPathStringNs leaking xpathCtxt->node) and CVE-2024-55549 (use-after-free related to excluded result prefixes/namespaces). Processing crafted XSLT can trigger memory corruption. Nokogiri 1.18.4 upgrades the bundled libxslt to 1.1.43 to resolve these issues. This vulnerability involves a use-after-free condition that can be triggered by processing specially crafted Extensible Stylesheet Language Transformations (XSLT). A remote attacker could exploit this to cause memory corruption, potentially leading to a denial of service or other impacts. This is an Important vulnerability. Red Hat products bundling Nokogiri versions prior to 1.18.4 are affected by use-after-free flaws in the integrated libxslt library. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Hardened Images; Red Hat Satellite 6. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Satellite 6 as not affected. Red Hat fixing advisory: RHSA-2026:41276.
High [CVE-2024-58378] Nokogiri before 1.16.2 Use-After-Free via xmlTextReader
Nokogiri before 1.15.6 and 1.16.x before 1.16.2, when using bundled libxml2, is affected by the libxml2 flaw CVE-2024-25062. This CVE does not represent a flaw in Nokogiri, but is rather a duplicate assignment for different CVEs affecting libxml2 or libxslt. The rubygem-nokogiri packages as shipped in Red Hat products do not bundled libxml2 and libxslt, but rather use system packages of those libraries. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-416. Under investigation: Red Hat 3scale API Management Platform 2. Red Hat lists Red Hat Satellite 6 as not affected.
High [CVE-2022-51000] Nokogiri before 1.13.2 Multiple Vulnerabilities via libxml2 libxslt
Nokogiri before 1.13.2 (CRuby, when using packaged libraries) ships vendored libxml2 2.9.12 and libxslt 1.1.34, which are affected by two upstream CVEs. Via CVE-2021-30560 in libxslt, an application transforming XML with untrusted XSL stylesheets is vulnerable to a denial-of-service attack. Via CVE-2022-23308 in libxml2, an application parsing an untrusted document with parse option DTDVALID set to true and NOENT set to false may be vulnerable to denial of service, memory disclosure, or code execution. Nokogiri before 1.13.2, when using bundled libxml2 and libxslt, is affected by the libxslt flaw CVE-2021-30560 and the libxml2 flaw CVE-2022-23308. This CVE does not represent a flaw in Nokogiri, but is rather a duplicate assignment for different CVEs affecting libxml2 or libxslt. The rubygem-nokogiri packages as shipped in Red Hat products do not bundled libxml2 and libxslt, but rather use system packages of those libraries. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-416. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Satellite 6 as not affected.
High [CVE-2022-50999] Integer overflow in libxml2 leads to information disclosure, data modification, or denial of service
Nokogiri versions before 1.13.5 contain an integer overflow vulnerability in packaged libxml2 buffer handling functions that allows attackers to cause out-of-bounds memory writes. Attackers can exploit this by crafting multi-gigabyte XML files to trigger buffer overflows resulting in information disclosure, data modification, or denial of service. A flaw was found in Nokogiri. The integer overflow in the bundled libxml2 library allows an attacker to cause out-of-bounds memory writes, potentially compromising system integrity or availability. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H). Weakness: CWE-787. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Hardened Images; Red Hat Satellite 6 as not affected.
High [CVE-2021-47996] Memory Corruption via Crafted XML Documents
Nokogiri before 1.11.4 (CRuby implementation only, when the packaged/vendored libxml2 is used) bundles libxml2 2.9.10, which is affected by multiple vulnerabilities addressed in libxml2 2.9.12, including a memory leak in xmlSchemaValidateStream (CVE-2019-20388), a global buffer over-read in xmlEncodeEntitiesInternal (CVE-2020-24977), a heap-based buffer overflow (CVE-2021-3517), and an out-of-bounds read (CVE-2021-3518). Processing crafted XML documents may lead to denial of service, information disclosure, or memory corruption. A flaw was found in Nokogiri, specifically within its bundled libxml2 library. A remote attacker could exploit multiple vulnerabilities, including memory leaks, buffer over-reads, heap-based buffer overflows, and out-of-bounds reads, by processing specially crafted XML documents. While Nokogiri's default parse options prevent exponential entity expansion attacks, other flaws remain. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-125. Red Hat lists Red Hat 3scale API Management Platform 2; Red Hat Hardened Images; Red Hat Satellite 6 as not affected.
High [CVE-2022-50998] Denial of Service and Memory Corruption via Crafted XML Input
Nokogiri before 1.13.9 (CRuby implementation using packaged libraries) bundles libxml2 v2.9.14, which is affected by CVE-2022-40304 (data corruption / double-free from an entity reference cycle when entity content is allocated from a dict) and CVE-2022-40303 (integer overflows when parsing with XML_PARSE_HUGE). Nokogiri 1.13.9 upgrades the packaged libxml2 to v2.10.3 to address these issues. Processing crafted XML input may lead to denial of service or memory corruption. (The advisory also references CVE-2022-2309, a NULL pointer dereference via iterwalk/canonicalize, which maintainers determined does not affect Nokogiri users.) A flaw was found in Nokogiri, a Ruby gem for parsing XML and HTML documents. This vulnerability arises from issues within its bundled libxml2 library, specifically involving data corruption from entity reference cycles and integer overflows when processing large XML files. A remote attacker could exploit these flaws by providing specially crafted XML input, potentially leading to denial of service or memory corruption within the application. Red Hat products utilizing `rubygem-nokogiri` are affected, making systems susceptible if they handle untrusted XML data. The flaw stems from underlying issues in `libxml2` bundled with Nokogiri, which could be triggered without complex attack vectors.
High [CVE-2026-2035364] Delegated token scope restrictions not consistently enforced across trust, OAuth1, and application credential endpoints
Delegated token scope restrictions not consistently enforced across trust, OAuth1, and application credential endpoints. Red Hat rates this important (CVSS 8.1). Weakness: CWE-863. Affected products named by the advisory: Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat OpenStack Platform 18.0.
High [CVE-2026-2035366] Application credential tokens can escape project scope via token-method reauthentication
Application credential tokens can escape project scope via token-method reauthentication. Red Hat rates this important (CVSS 7.1). Weakness: CWE-863.
High [CVE-2026-80182] Delegated token scope restrictions not consistently enforced across trust, OAuth1, and application credential endpoints
In OpenStack Keystone before 29.0.3, tokens obtained via OAuth1 access token, application credential, or trust-scoped authentication could create new long-lived credentials or authorize new delegations that persist independently of, and outlive, the credential used to obtain them. The delegation restrictions that block these operations did not consistently apply to all delegated token types, allowing an OAuth1-scoped token, for example, to create application credentials or authorize OAuth1 request tokens despite those operations being restricted for other delegated token types. All Keystone deployments that permit delegated authentication through OAuth1 access tokens, application credentials, or trusts are affected. A flaw was found in OpenStack Keystone where delegation boundary enforcement is incomplete across trust, application credential, and OAuth1 authorization endpoints. Tokens obtained via delegated authentication methods, such as OAuth1 access tokens or custom Keystone authentication plugins, can perform operations beyond their intended scope because endpoint guards only recognized specific delegation types rather than using a comprehensive allowlist. This allows creating trusts that delegate roles beyond the token's authorized scope, creating persistent application credentials, and authorizing new OAuth1 delegations.
High [CVE-2026-80184] Application credential tokens can escape project scope via token-method reauthentication
In OpenStack Keystone before 29.0.3, tokens obtained via delegated authentication mechanisms (OAuth1 access tokens, application credentials, trusts) could be submitted to the token-method authentication path for reauthentication to escape their intended project scope. When an application credential token was presented with no explicit scope, Keystone would issue a new token scoped to the credential owner's default project rather than the project for which the credential was issued, bypassing the intended project boundary. If the owner has roles on that default project, Keystone issues a new token scoped there while still carrying the original application credential identity. Custom Keystone authentication plugins are subject to the same incomplete rescope guard. This allows a limited-scope application credential for one project to access another project within the owner's role assignments. This vulnerability is rated as Important because an authenticated user with an application credential can escape the credential's project binding through token reauthentication and access the owner's default project. Application credential reauthentication only becomes practically exploitable from Keystone 27.0.1 on the 27.x stable line, and from 28.0.0 on the 28.x line. On earlier versions, exchanging an application credential token fails before a new token is issued.
High [CVE-2026-78360] missing authorization check in delete_user allows any authenticated user to delete arbitrary users
A missing authorization flaw was found in Anitya. The user deletion endpoint checks that the caller is logged in but does not check that the caller is an administrator. Any authenticated user can delete arbitrary user accounts, including administrator accounts, which can remove administrative access to the service. This vulnerability is rated as Important because any authenticated user can delete arbitrary Anitya users, including administrators, over the network with no extra conditions. Anitya is Fedora infrastructure (release-monitoring.org) maintained by the Fedora Infrastructure team. newcli found no Red Hat product streams shipping this component. Red Hat products are not affected. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L). Weakness: CWE-862.
High [CVE-2026-79655] path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write
A flaw was found in sos clean, a utility within the sos package. This vulnerability allows a local attacker to perform arbitrary file creation or overwrite. By crafting a malicious tar archive, an attacker can exploit a path traversal issue during tar extraction, where symlink and hardlink targets are not properly validated. This enables the attacker to write files to arbitrary locations on the system with the privileges of the sos clean process, which often runs as root. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: sos.
High [CVE-2026-12878] Privilege Escalation via API Endpoint
Privilege Escalation via API Endpoint. Red Hat rates this important (CVSS 8.1). Weakness: CWE-266. Affected product named by the advisory: Red Hat Trusted Artifact Signer.