Red Hat Linux Security Advisories & CVEs
4892 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-3497] Information disclosure or denial of service due to uninitialized variables
Information disclosure or denial of service due to uninitialized variables. Red Hat rates this important (CVSS 8.2). Weakness: CWE-824. Affected package(s): openssh, rhcos, rhpam, rhaiis/vllm-rocm-rhel9:1778244531, rhaiis/vllm-cuda-rhel9:1778274666, rhui5/installer-rhel9:1776868772. Resolved in Red Hat advisory RHSA-2026:20040 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat OpenShift Container Platform 4.12; Middleware Containers for OpenShift; Red Hat OpenShift Container Platform 4.13; Red Hat OpenShift Container Platform 4.14; and 52 more.
High [CVE-2026-32141] Unbounded recursion DoS in parse() revive phase
Unbounded recursion DoS in parse() revive phase. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): rhdh/rhdh-hub-rhel9:1777903262, devspaces/dashboard-rhel9:1779341289, cluster-observability-operator/logging-console-plugin-pf4-rhel9:1782839279, cluster-observability-operator/troubleshooting-panel-console-plugin-pf6-rhel9:1782839996, rhoai/odh-dashboard-rhel8:1774282136, cluster-observability-operator/logging-console-plugin-pf5-rhel9:1782840539. Resolved in Red Hat advisory RHSA-2026:13826 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Developer Hub 1.8; Red Hat Developer Hub 1.9; Red Hat Edge Manager 1.0; Red Hat OpenShift AI 2.16; and 10 more.
High [CVE-2026-28356] denial of service via maliciously crafted HTTP or multipart segment headers
denial of service via maliciously crafted HTTP or multipart segment headers. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1333. Affected package(s): rhaiis/vllm-cuda-rhel9:1774351144, rhaiis/model-opt-cuda-rhel9:1774547384, rhoai/odh-caikit-tgis-serving-rhel9:1776247907, rhaiis/vllm-rocm-rhel9:1775252598, rhoai/odh-feature-server-rhel9:1776338381. Resolved in Red Hat advisory RHSA-2026:10184 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat AI Inference Server 3.2; Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; OpenShift Lightspeed; and 3 more.
High [CVE-2026-3909] Out of bounds write in Skia
Out of bounds write in Skia. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3910] Inappropriate implementation in V8
Inappropriate implementation in V8. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-31870] Denial of Service via malformed Content-Length header
Denial of Service via malformed Content-Length header. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1287. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-28229] Argo Workflows has unauthorized access to Argo Workflows Template
Argo Workflows has unauthorized access to Argo Workflows Template. Red Hat rates this important (CVSS 7.5). Weakness: CWE-306. Affected package(s): rhoai/odh-ml-pipelines-persistenceagent-v2-rhel9:1776740351, rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9:1776740640, rhoai/odh-ml-pipelines-api-server-v2-rhel9:1776740726, rhoai/odh-data-science-pipelines-argo-argoexec-rhel9:1776740558, rhoai/odh-ml-pipelines-scheduledworkflow-v2-rhel9:1776740366, rhoai/odh-ml-pipelines-driver-rhel9:1776740379. Resolved in Red Hat advisory RHSA-2026:10184 — update the affected packages (`sudo dnf update`). Affected product named by the advisory: Red Hat OpenShift AI 2.25.
High [CVE-2026-4111] Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive
Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive. Red Hat rates this important (CVSS 7.5). Weakness: CWE-835. Affected package(s): rhcos, rhaiis/vllm-rocm-rhel9:1778244531, discovery/discovery-server-rhel9:1775668717, libarchive, rhui5/haproxy-rhel9:1776868744, rhui5/installer-rhel9:1776868772. Resolved in Red Hat advisory RHSA-2026:7329 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Extended Update Support; and 15 more.
High [CVE-2026-31837] Information disclosure and authentication bypass via JWKS resolver unavailability
Information disclosure and authentication bypass via JWKS resolver unavailability. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1392. Affected package(s): openshift-service-mesh/istio-proxyv2-rhel9:1774114903, rhoai/odh-kserve-agent-rhel9:1776343082, openshift-service-mesh/istio-proxyv2-rhel9:1774068855, openshift-service-mesh/istio-pilot-rhel9:1774037369, rhoai/odh-kserve-router-rhel9:1776343121, rhoai/odh-kserve-controller-rhel9:1776343105. Resolved in Red Hat advisory RHSA-2026:10184 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat OpenShift AI 2.25; Red Hat OpenShift Service Mesh 3.0; Red Hat OpenShift Service Mesh 3.1; Red Hat OpenShift Service Mesh 3.2; and 3 more.
High [CVE-2026-30951] Data exfiltration via SQL injection in JSON/JSONB where clause processing
Data exfiltration via SQL injection in JSON/JSONB where clause processing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-89. Affected package(s): satellite/iop-remediations-rhel9:1776194798. Resolved in Red Hat advisory RHSA-2026:8498 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Satellite 6.18; Confidential Compute Attestation.
High [CVE-2026-23868] Double-free vulnerability leading to memory corruption
Double-free vulnerability leading to memory corruption. Red Hat rates this important (CVSS 7). Weakness: CWE-825. Affected package(s): giflib, rhaiis/vllm-rocm-rhel9:1778244531, rhaiis/vllm-cuda-rhel9:1779223654, rhaiis/vllm-cuda-rhel9:1778274666, rhaiis/vllm-spyre-rhel9:1778244546, rhaiis/model-opt-cuda-rhel9:1780681984. Resolved in Red Hat advisory RHSA-2026:8859 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 12 more.
High [CVE-2026-28292] Remote Code Execution via bypass of prior security fixes
Remote Code Execution via bypass of prior security fixes. Red Hat rates this important (CVSS 8.8). Weakness: CWE-76. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Logging Subsystem for Red Hat OpenShift.
High [CVE-2026-26130] Denial of Service via uncontrolled resource allocation
Denial of Service via uncontrolled resource allocation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected package(s): dotnet8.0, dotnet9.0, dotnet10.0. Resolved in Red Hat advisory RHSA-2026:4458 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Enterprise Linux 9.6 Extended Update Support.
High [CVE-2026-26127] .net: .NET: Denial of Service via out-of-bounds read
.net:.NET: Denial of Service via out-of-bounds read. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-125. Affected package(s): dotnet9.0, dotnet10.0. Resolved in Red Hat advisory RHSA-2026:10083 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
High [CVE-2026-26131] .NET: Privilege escalation via incorrect default permissions
.NET: Privilege escalation via incorrect default permissions. Red Hat rates this moderate (CVSS 7.8). Weakness: CWE-276. Affected package(s): dotnet10. Resolved in Red Hat advisory RHSA-2026:9077 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3918] Use after free in WebMCP
Use after free in WebMCP. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3921] Use after free in TextEncoding
Use after free in TextEncoding. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3923] Use after free in WebMIDI
Use after free in WebMIDI. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3914] Integer overflow in WebML
Integer overflow in WebML. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
High [CVE-2026-3919] Use after free in Extensions
Use after free in Extensions. Red Hat rates this important (CVSS 8.8). No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.