Red Hat Linux Security Advisories & CVEs
4890 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-3083] Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay
Remote Code Execution via Out-Of-Bounds Write in rtpqdm2depay. Red Hat rates this important (CVSS 8.8). Weakness: CWE-787. Affected package(s): gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base, gstreamer1-plugins-bad-free, gstreamer-plugins-base, gstreamer-plugins-good. Resolved in Red Hat advisory RHSA-2026:19180 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 10 more.
High [CVE-2026-3086] Remote Code Execution via Out-Of-Bounds Write in H.266 Codec Parser
Remote Code Execution via Out-Of-Bounds Write in H.266 Codec Parser. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux 8.
High [CVE-2026-3085] Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay
Remote Code Execution via Heap-based Buffer Overflow in rtpqdm2depay. Red Hat rates this important (CVSS 8.8). Weakness: CWE-1284. Affected package(s): gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base, gstreamer1-plugins-bad-free, gstreamer-plugins-base, gstreamer-plugins-good. Resolved in Red Hat advisory RHSA-2026:19180 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 10 more.
High [CVE-2026-3082] Remote Code Execution via heap-based buffer overflow in JPEG parser
Remote Code Execution via heap-based buffer overflow in JPEG parser. Red Hat rates this important (CVSS 7.8). Weakness: CWE-120. Affected package(s): gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base, gstreamer1-plugins-bad-free. Resolved in Red Hat advisory RHSA-2026:19180 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 10 more.
High [CVE-2026-3081] Arbitrary code execution via H.266 codec parsing stack-based buffer overflow
Arbitrary code execution via H.266 codec parsing stack-based buffer overflow. Red Hat rates this important (CVSS 7.8). Weakness: CWE-120. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-2923] Remote Code Execution via out-of-bounds write in DVB Subtitles handling
Remote Code Execution via out-of-bounds write in DVB Subtitles handling. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Affected package(s): gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base, gstreamer1-plugins-bad-free. Resolved in Red Hat advisory RHSA-2026:19180 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.6 Extended Update Support.
High [CVE-2026-2922] Remote Code Execution via out-of-bounds write in RealMedia Demuxer
Remote Code Execution via out-of-bounds write in RealMedia Demuxer. Red Hat rates this important (CVSS 7.8). Weakness: CWE-787. Affected package(s): gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base, gstreamer1-plugins-bad-free. Resolved in Red Hat advisory RHSA-2026:19180 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.6 Extended Update Support.
High [CVE-2026-2920] Arbitrary code execution via ASF file processing
Arbitrary code execution via ASF file processing. Red Hat rates this important (CVSS 7.8). Weakness: CWE-120. Affected package(s): gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-plugins-base, gstreamer1-plugins-bad-free. Resolved in Red Hat advisory RHSA-2026:19180 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.6 Extended Update Support.
High [CVE-2026-31899] Denial of Service via recursive <use> element amplification
Denial of Service via recursive element amplification. Red Hat rates this important (CVSS 7.5). Weakness: CWE-776. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-31806] Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages
Arbitrary code execution via crafted Remote Desktop Protocol (RDP) server messages. Red Hat rates this important (CVSS 8.8). Weakness: CWE-131. Affected package(s): freerdp. Resolved in Red Hat advisory RHSA-2026:6958 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 10 more.
High [CVE-2026-31883] Denial of Service via crafted audio data in RDP
Denial of Service via crafted audio data in RDP. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-191. Affected package(s): freerdp. Resolved in Red Hat advisory RHSA-2026:19142 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 1.
High [CVE-2026-32597] PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)
PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation). Red Hat rates this important (CVSS 7.5). Weakness: CWE-347. Affected package(s): ansible-automation-platform, python3.12-pyjwt, quay/quay-rhel8:1775169155, quay/quay-rhel8:1775253092, fence-agents, rhelai3/bootc-aws-cuda-rhel9:1776871984. Resolved in Red Hat advisory RHSA-2026:13508 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Enterprise Linux 10.0 Extended Update Support; and 17 more.
High [CVE-2026-32304] Arbitrary code execution via unsanitized parameters in create_function
Arbitrary code execution via unsanitized parameters in create_function. Red Hat rates this important (CVSS 7.5). Weakness: CWE-88. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Logging Subsystem for Red Hat OpenShift.
High [CVE-2026-2229] Denial of Service via invalid WebSocket permessage-deflate extension parameter
Denial of Service via invalid WebSocket permessage-deflate extension parameter. Red Hat rates this important (CVSS 7.5). Weakness: CWE-248. Affected package(s): cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, rhoai/odh-dashboard-rhel8:1774282136, nodejs:22, cryostat/cryostat-openshift-console-plugin-rhel9:4.2.0, cluster-observability-operator/logging-console-plugin-pf5-rhel9:1782840539, rhdh/rhdh-hub-rhel9:1776784286. Resolved in Red Hat advisory RHSA-2026:13826 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.6 Extended Update Support; and 9 more.
High [CVE-2026-1528] Denial of Service via crafted WebSocket frame with large length
Denial of Service via crafted WebSocket frame with large length. Red Hat rates this important (CVSS 7.5). Weakness: CWE-248. Affected package(s): cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, rhoai/odh-dashboard-rhel8:1774282136, nodejs:22, cryostat/cryostat-openshift-console-plugin-rhel9:4.2.0, cluster-observability-operator/logging-console-plugin-pf5-rhel9:1782840539, rhdh/rhdh-hub-rhel9:1776784286. Resolved in Red Hat advisory RHSA-2026:13826 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.6 Extended Update Support; and 8 more.
High [CVE-2026-1526] Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression
Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, rhoai/odh-dashboard-rhel8:1774282136, nodejs:22, cryostat/cryostat-openshift-console-plugin-rhel9:4.2.0, cluster-observability-operator/logging-console-plugin-pf5-rhel9:1782840539, rhdh/rhdh-hub-rhel9:1776784286. Resolved in Red Hat advisory RHSA-2026:13826 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.6 Extended Update Support; and 9 more.
High [CVE-2026-1525] HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers
HTTP Request Smuggling and Denial of Service due to duplicate Content-Length headers. Red Hat rates this moderate (CVSS 7.3). Weakness: CWE-444. Affected package(s): nodejs:22, cryostat/cryostat-openshift-console-plugin-rhel9:4.2.0, rhdh/rhdh-hub-rhel9:1776784286, devspaces/code-rhel9:1779814592, nodejs:24, cryostat/cryostat-rhel9:4.2.0. Resolved in Red Hat advisory RHSA-2026:7350 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1.
High [CVE-2026-32274] Arbitrary file writes from unsanitized user input in cache file name
Arbitrary file writes from unsanitized user input in cache file name. Red Hat rates this important (CVSS 7.5). Weakness: CWE-22. Affected package(s): ansible-automation-platform, rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9:1776319179, rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9:1776319275, rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9:1776318795, rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9:1776319193, rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9:1776319185. Resolved in Red Hat advisory RHSA-2026:10184 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5; Red Hat Ansible Automation Platform 2.6; Red Hat OpenShift AI 2.25; OpenShift Lightspeed; and 3 more.
High [CVE-2026-3497] Information disclosure or denial of service due to uninitialized variables
Information disclosure or denial of service due to uninitialized variables. Red Hat rates this important (CVSS 8.2). Weakness: CWE-824. Affected package(s): openssh, rhcos, rhpam, rhaiis/vllm-rocm-rhel9:1778244531, rhaiis/vllm-cuda-rhel9:1778274666, rhui5/installer-rhel9:1776868772. Resolved in Red Hat advisory RHSA-2026:20040 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat OpenShift Container Platform 4.12; Middleware Containers for OpenShift; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; and 52 more.
High [CVE-2026-32141] Unbounded recursion DoS in parse() revive phase
Unbounded recursion DoS in parse() revive phase. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): rhdh/rhdh-hub-rhel9:1777903262, devspaces/dashboard-rhel9:1779341289, cluster-observability-operator/logging-console-plugin-pf4-rhel9:1782839279, cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, rhoai/odh-dashboard-rhel8:1774282136, cluster-observability-operator/logging-console-plugin-pf5-rhel9:1782840539. Resolved in Red Hat advisory RHSA-2026:13826 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9; Red Hat Edge Manager 1.0; Red Hat OpenShift AI 2.16; and 10 more.