Red Hat Linux Security Advisories & CVEs
12205 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-79772] Signature validation bypass via unchecked return value
Nokogiri versions before 1.19.1 fail to check the return value from xmlC14NExecute in the canonicalize method, returning an empty string on failure instead of raising an exception. Attackers can exploit this to bypass signature validation in downstream SAML libraries by providing invalid canonicalized XML that is incorrectly accepted as valid. A flaw was found in Nokogiri. A remote attacker could exploit this by providing specially crafted XML, leading to a bypass of signature validation in Security Assertion Markup Language (SAML) libraries that rely on Nokogiri, potentially allowing malicious data to be accepted as legitimate. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-252. Affected Red Hat products: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6. Red Hat lists Red Hat Satellite 6 as not affected. Will not fix / out of support: Red Hat 3scale API Management Platform 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-79771] Denial of Service via XSLT transform memory leak
Nokogiri versions before 1.19.3 contain a memory leak in the XSLT Stylesheet transform method when processing Ruby strings containing null bytes. Attackers can exploit this by passing attacker-controlled input with null bytes to transform parameters, causing heap allocations to leak and enabling denial of service against long-running processes. A flaw was found in Nokogiri. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6. Will not fix / out of support: Red Hat 3scale API Management Platform 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-79769] Process crash due to invalid memory read via programming error in internal method
Nokogiri versions before 1.19.4 contain a possible invalid (out-of-bounds) memory read in the protected internal Node#initialize_copy_with_args helper behind Node#dup and #clone, which unwrapped its source argument as an xmlNode without a type check. If application code calls this protected method with a non-Node argument (e.g., a Namespace), it reads an xmlNs out of bounds, crashing the process. This is only triggerable by a programming error and cannot be triggered by untrusted input or normal use of the public API. Only CRuby is affected. Version 1.19.4 adds a type check and raises TypeError. A flaw was found in Nokogiri. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-843. Affected Red Hat products: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6. Will not fix / out of support: Red Hat 3scale API Management Platform 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-79676] Information disclosure via path traversal with symlink bypass
NLTK versions before 3.10.3 contain a path traversal vulnerability in corpus readers that reopen root-derived paths using built-in open() instead of nltk.pathsec.open(), allowing symlinks to escape trusted roots. Attackers who stage symlinked corpus files under a trusted data root can disclose outside-root content through normal corpus reader methods like channels(), domains(), and synonyms(). A flaw was found in NLTK. This path traversal vulnerability allows attackers to bypass security measures by using symbolic links within trusted data roots. By staging specially crafted symlinked corpus files, an attacker can disclose sensitive information from outside the intended data directories. This could lead to unauthorized access to confidential data. When processing corpus operations like channels(), domains(), or synonyms(), the application fails to enforce path restrictions on symbolic links within data roots. An attacker capable of staging crafted symlinks in a trusted corpus directory can bypass path controls to disclose arbitrary readable files outside the corpus root. File access remains bounded by local OS discretionary access controls and host container security parameters. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22.
Medium [CVE-2023-54354] Denial of Service via crafted XML schema
Nokogiri before 1.14.3 (CRuby implementation only, when using the packaged libxml2) bundles libxml2 v2.10.3, which is vulnerable to NULL pointer dereferences in XML Schema processing (xmlSchemaFixupComplexType, CVE-2023-28484, and xmlSchemaCheckCOSSTDerivedOK). An attacker who supplies a crafted/malformed XML schema can cause libxml2 to dereference a NULL pointer and potentially segfault, resulting in a denial of service. Nokogiri 1.14.3 upgrades the packaged libxml2 to v2.10.4 to resolve these issues. A flaw was found in Nokogiri, specifically in its bundled libxml2 library when processing XML schemas. This is a Moderate denial of service flaw in Nokogiri's bundled libxml2, affecting CRuby implementations that process XML schemas using packaged libraries. A remote attacker could provide a specially crafted XML schema, leading to a NULL pointer dereference and causing the application to crash, thereby impacting service availability. The impact is limited to applications that directly process untrusted XML schemas with the vulnerable Nokogiri configuration. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Satellite 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-79717] blind SSRF via namespace avatar_url with no private-address restriction
A server-side request forgery (SSRF) vulnerability was found in galaxy_ng, the Ansible Galaxy server plugin for Pulp. An authenticated user with namespace management permissions can set a namespace avatar URL to an arbitrary address, including internal networks, loopback, or cloud instance metadata endpoints. A background worker fetches that URL without checking the destination, which lets the attacker probe internal services and enumerate reachable IP addresses. The HTTP client is also configured without an overall timeout, so a slow or non-responsive target can pin workers and cause a denial of service. This vulnerability is rated as Moderate because an authenticated user with namespace-change permission can cause a Pulp worker to request arbitrary internal addresses. The SSRF is blind: response bodies are discarded unless they look like an image, so cloud-metadata secrets are not returned to the attacker. The attacker can still enumerate reachable internal IP addresses and ports from the worker's network, and can pin workers with slow endpoints. Red Hat Ansible Automation Platform ships galaxy_ng as Private Automation Hub (python-galaxy-ng and hub container images in AAP 2.4 through 2.7). RHEL and Fedora do not ship this component as a base OS package. Red Hat severity: Moderate — CVSS 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L). Weakness: CWE-918.
Medium [CVE-2026-16599] Denial of Service via crafted FTP OPIE/S-KEY authentication challenge
GNU wget is vulnerable to denial of service in its FTP OPIE/S-KEY authentication functionality. The server-supplied sequence number from the FTP challenge line is used as an iteration count for an MD5 key-derivation loop without any upper bound validation. A malicious FTP server or a network attacker positioned to intercept FTP traffic can send a crafted OPIE challenge with a sequence number near INT_MAX, causing wget to perform up to approximately 2.1 billion MD5 computations and suspend for some time. The --timeout option does not mitigate this because it applies only to network I/O, not CPU computation. This issue was fixed in commit e9697d98e7249b0f68a6be040a4f3dcc5bc101fa This challenge contains a sequence number that, when processed by wget, can lead to an excessive number of cryptographic computations. This prolonged computation can cause wget to become unresponsive, resulting in a denial of service. All versions of wget as shipped with Red Hat Enterprise Linux, Red Hat In-Vehicle Operating System, and Fedora are affected. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-835. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more.
Medium [CVE-2026-78684] Denial of Service via DeepStream backend resource control bypass.
vLLM before 0.27.0 fails to properly classify DeepStream as a GPU backend and omits pixel-limit enforcement in its decode path. Unauthenticated attackers can activate DeepStream at request time to initialize the process-wide GPU decode pool and submit video that bypasses resource controls, causing partial denial of service for concurrent requests. A flaw was found in vLLM. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-79652] JWT Bearer authorization grant does not enforce consentRequired
A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handles various OAuth2 and OpenID Connect grant types used for issuing access tokens. The issue occurs because the JWT Bearer grant fails to check if a client requires user consent before issuing a token. This allows an authenticated attacker with valid client credentials and a trusted identity provider assertion to bypass the consent requirement and obtain unauthorized access to a user account at a consent-gated client. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a specific non-default client configuration and the possession of valid client credentials and a trusted IdP assertion. Successful exploitation allows an attacker to bypass user consent requirements and obtain an access token for a target user. The vulnerability's root cause is a missing authorization check in the JWT Bearer grant implementation that fails to honor the consentRequired configuration flag. Weakness: CWE-862. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7. Red Hat lists Red Hat Single Sign-On 7 as not affected. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-77117] Non-progress DoS in SHIFT_JISX0213 ->
Converting crafted SHIFT_JISX0213 input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU C Library version 2.3 to 2.44 may result in the converter making no progress, causing the calling application to hang. Some SHIFT_JISX0213 sequences decode to two code points. If the output buffer has room for only the first one, the converter stores the second in the conversion state and returns E2BIG, but it never clears that pending character after emitting it on the next call. The converter then keeps emitting the pending character without consuming further input, so an application that retries the conversion loops forever. The input must be attacker controlled and the application must convert it with an output buffer small enough to split the two code points. Only the SHIFT_JISX0213 character set is affected, which is not commonly used. The related defect in the EUC_JISX0213 converter is tracked separately as CVE-2026-80489. A flaw was found in glibc. A remote attacker could exploit this vulnerability by providing specially crafted input during SHIFT_JISX0213 to UCS-4 text conversion. This crafted input can cause the application to repeatedly emit a buffered code point without consuming further input, leading to persistent retry churn. This can result in a denial of service (DoS) for callers converting untrusted text.
Medium [CVE-2026-11610 +1] incomplete fix may introduce a connection-stall DoS
A flaw was found in 389-ds-base. A remote, authenticated attacker could exploit a vulnerability in the Simple Authentication and Security Layer (SASL) UNBIND process. By sending a specially crafted request, the attacker can cause a connection to stall, leading to resource exhaustion and a Denial of Service (DoS) for the server. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Directory Server 13.2; Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat fixing advisory: RHSA-2026:64785, RHSA-2026:64784, RHSA-2026:65119. Affected products named by the advisory: Red Hat package: 389-ds-base.
Medium [CVE-2026-19499] Buffer Overflow in strfmon right-justification padding
Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an application code path that calls strfmon or strfmon_l with right-justified width padding into a destination buffer that is large enough for the padding to succeed but too small for the internal memmove call. The field width or format may be attacker-influenced or a fixed susceptible pattern in the caller. At the time of publication, no network-facing application impact is known. A flaw was found in glibc. This occurs because an incorrect length is used for an internal memory operation, causing data to be written beyond its intended buffer. An attacker could exploit this by providing specially crafted input, potentially leading to arbitrary code execution or other severe impacts. This Moderate impact buffer overflow in `strfmon` or `strfmon_l` within glibc occurs when an application uses right-justified width padding with a specific buffer size, leading to an out-of-bounds write. Exploitation requires a vulnerable application code path that processes attacker-controlled formatting input or uses a fixed susceptible formatting pattern, limiting its general exploitability in typical Red Hat deployments.
Medium [CVE-2026-78322] stack buffer overflow in parse_progress_line for 7z and RAR handlers
A flaw was found in file-roller. The vulnerability, a stack buffer overflow, occurs when file paths from archive entries exceed fixed-size buffers during progress line parsing, causing the application to terminate. Exploitation requires user interaction and is difficult for arbitrary code execution on hardened Red Hat systems. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: file-roller.
Medium [CVE-2026-19542] Fix out-of-bounds array write in tdelete
Calling tdelete on a sufficiently deep tree in the GNU C Library version 2.1 to 2.44 may write one pointer past the end of an alloca-allocated array on the stack, which may crash the application. The tdelete implementation keeps an explicit stack of parent nodes for rebalancing, which is grown as needed while descending the tree. Two rebalancing branches push an additional entry without checking the capacity, and write past the array when the stack is exactly full. Triggering this requires a node at a depth of exactly 40 (or 40 plus a multiple of 20), which implies a tree with at least a million nodes, so an attacker must drive a large number of insertions and deletions through an application that uses tsearch and tdelete. The written value is a pointer into a tree node and is not directly attacker controlled. No affected application in common distributions has been identified. A flaw was found in glibc. An out-of-bounds array write vulnerability exists within the `tdelete` function. This issue occurs due to incorrect management of array sizes, which can lead to memory corruption. A local attacker with low privileges could potentially exploit this to cause a denial of service or disclose sensitive information. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; and 5 more.
Medium [CVE-2026-78679] Arbitrary file read via TagReference.create
GitPython before 3.1.59 contains an arbitrary file read vulnerability in TagReference.create() where a positional reference parameter bypasses the unsafe option guard. Attackers can supply a reference value like --file= to read arbitrary files, with contents returned in the annotated tag message. A flaw was found in GitPython. A remote attacker with low privileges can exploit a vulnerability in the `TagReference.create()` function, where a positional reference parameter bypasses a security guard. The contents of these files are then returned within the annotated tag message, leading to information disclosure. An incomplete fix for a prior vulnerability (GHSA-3f7w-8rr8-f37f) failed to validate positional parameters, allowing an attacker with low privileges to supply a specially crafted reference value (such as --file=/path/to/file) to read arbitrary files on the system. This vulnerability requires that the application forwards user-controlled input to the reference parameter of TagReference.create(), which limits the scope of exploitation to applications that expose this specific code path. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22.
Medium [CVE-2026-78678] Arbitrary file read via Repo.blame
GitPython versions before 3.1.59 contain an incomplete denylist in the unsafe_git_revision_options guard that omits --contents and -S options, allowing attackers to read arbitrary files by passing these options to Repo.blame(). Attackers can supply revision values like --contents=/etc/passwd to leak file contents through the blame result returned to the caller. A flaw was found in GitPython. This vulnerability requires that the application using GitPython forwards user-influenced input to the blame function's revision parameter. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-88. Affected Red Hat products: Exploit Intelligence; Migration Toolkit for Applications 8; Red Hat AI Inference Server; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat OpenStack Platform 16.2; Red Hat OpenStack Platform 17.1; Red Hat Satellite 6. Red Hat lists Red Hat Ansible Automation Platform 2; Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-78675] Local file content disclosure via malicious.gitmodules
GitPython before 3.1.59 fails to disable merge_includes when parsing.gitmodules, allowing attackers to disclose local file content by including arbitrary file paths via [include] directives. Attackers can craft a malicious.gitmodules file with include directives pointing to sensitive files; when repo.submodules is accessed, GitConfigParser raises MissingSectionHeaderError embedding the target file's first line verbatim in the exception message. A flaw was found in GitPython that could allow for local file content disclosure. This vulnerability occurs because GitPython does not properly disable merge_includes when processing.gitmodules files. An attacker could exploit this by creating a specially crafted.gitmodules file with include directives that reference sensitive local files. When a user interacts with the repository's submodules, the system may inadvertently reveal the first line of these sensitive files through an error message. When a user opens an untrusted repository and accesses the repository's submodules (e.g., via repo.submodules), the GitConfigParser may raise a MissingSectionHeaderError that embeds the first line of the target file verbatim in the exception message. This exception message can be exposed through CI logs, error pages, exception trackers, and code review bots, creating multiple disclosure channels.
Medium [CVE-2026-59183] Integer Overflow Vulnerability Leading to Application Crash
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. In versions 3.1.0 through 3.2.10, 3.3.0 through 3.3.12, and 3.4.0 through 3.4.13, an int32_t multiplication in OpenEXRCore's unpack_sample_table() can overflow while decoding a crafted deep tiled EXR file, producing an invalid pointer that leads to a read from an unmapped memory address and a crash. Because the overflow occurs in the standard decoding path (exr_decoding_run), any application that decodes deep tiled EXR files is affected. This issue is fixed in versions 3.2.11, 3.3.13, and 3.4.14. A flaw was found in OpenEXR. This overflow can lead to an invalid memory pointer, causing applications that process these files to crash. This issue results in a denial of service. Red Hat has determined that versions of OpenEXR shipped in Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 are within the affected version range (3.1.0 through 3.4.13). This flaw has been rated Moderate and is not currently planned to be addressed in future updates. For additional information, refer to the Mitigation section or the linked CVE page. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-125. Affected products named by the advisory: Red Hat package: openexr.
Medium [CVE-2026-55373] Denial of Service via infinite loop in sample count processing.
OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. Versions prior to 3.2.10, 3.3.12, and 3.4.13 contain an infinite-loop vulnerability in SampleCountChannel. The helper roundListSizeUp() rounds a sample-list size up to the next power of two using repeated unsigned left shifts, which terminates for normal values but fails for UINT_MAX: the sequence reaches 0x80000000, and the next left shift wraps the 32-bit value to 0. Because 0 remains less than UINT_MAX, the loop never progresses and never exits. The bug is reachable through public OpenEXRUtil APIs, either by editing the sample-count buffer through SampleCountChannel::Edit (whose destructor calls endEdit()) or by calling SampleCountChannel::set(x, y, UINT_MAX) on a valid pixel. This issue has been fixed in versions 3.2.10, 3.3.12, and 3.4.13. A flaw was found in OpenEXR. An attacker could trigger an infinite loop by providing a specially crafted sample count value (UINT_MAX) when processing image data. This vulnerability, located in the `SampleCountChannel` component, prevents the application from progressing, leading to a denial of service. Red Hat Enterprise Linux 6 and 7 ship OpenEXR 1.x, which does not include this component and is not affected.
Medium [CVE-2026-55371] Denial of Service via NULL pointer dereference in exr_attr_set_bytes
OpenEXR is the reference implementation and specification for the EXR high-dynamic-range image file format, widely used in the motion picture industry. Versions 3.4.0 through 3.4.12 contain a NULL pointer dereference in the OpenEXRCore function exr_attr_set_bytes(). The public setter validates the top-level exr_attr_bytes_t value pointer but does not verify that the nested type_hint pointer is non-NULL when hint_length is greater than zero. When a caller supplies a positive hint_length together with a NULL type_hint, exr_attr_bytes_create() allocates a destination type-hint buffer and then copies from the NULL source pointer, causing a deterministic crash. The flaw is reachable through the public OpenEXRCore C API and results in a denial of service. The issue is fixed in version 3.4.13. A flaw was found in OpenEXR. This can lead to a deterministic crash, resulting in a denial of service (DoS), which makes the affected system or application unavailable. This vulnerability only affects OpenEXR versions 3.4.0 through 3.4.12. No Red Hat products or Fedora community distributions ship a version within this range. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476.