Red Hat Linux Security Advisories & CVEs
6096 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-54902] Use-After-Free in Oj::Parser SAJ Long Key Callback
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, is vulnerable to Use-After-Free when in SAJ mode. The Oj::Parser does not protect cached object keys (≥ 35 bytes) from garbage collection, and a Ruby callback that triggers GC inside hash_end can cause the key string to be reclaimed while the C parser still holds a pointer to it. The subsequent access to the freed string VALUE results in a segfault, confirmed by an RIP pointing to address 0x4242 (a canary-style pattern suggesting control over the freed memory's content). This issue has been fixed in version 3.17.2. Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected. Red Hat severity: Moderate.
Medium [CVE-2026-54901] Use-After-Free in Oj::Parser array_class/hash_class GC Marking
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj::Parser in usual mode does not mark array_class and hash_class references during garbage collection, leading to Use-After-Free. If GC runs after the class is assigned but before a parse, the class object is reclaimed, leaving the parser holding a dangling VALUE. The subsequent parse call dereferences the freed object, producing a segfault. This issue has been fixed in version 3.17.2. Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected. Red Hat severity: Moderate.
Medium [CVE-2026-54898] Denial of Service via input string mutation during JSON parsing
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2,Oj::Parser#parse is vulnerable to a heap use-after-free when a SAJ/SAJ2 callback mutates the input JSON string during parsing. The C engine holds a raw const byte * pointer into the Ruby string's internal buffer. If a callback (e.g. hash_start) resizes the string — for example by calling String#replace with a longer value — Ruby reallocates the string buffer and frees the old one. The C parser's pointer is left dangling; the next character read at parser.c:607 is a use-after-free. This issue has been fixed in version 3.17.2. A flaw was found in Oj, a Ruby library designed for efficient JSON (JavaScript Object Notation) parsing. This action can lead to the program attempting to access memory that has already been freed, potentially causing the application to crash and resulting in a denial of service. Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-54502] Stack Buffer Overflow in Oj.dump via Large Indent
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.2, Oj.dump is vulnerable to a stack-based buffer overflow when a large:indent value is provided by the developer. fill_indent in dump.h calls memset(indent_str, ' ', (size_t)opts->indent) without validating the size. When opts->indent is set to INT_MAX (2,147,483,647), the (size_t) cast preserves the large value and memset writes 2 GB into the stack-allocated out buffer (4,184 bytes), corrupting the stack and crashing the process. This issue has been fixed in version 3.17.2. Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected. Red Hat severity: Moderate.
Medium [CVE-2026-54500] Information disclosure via uninitialized stack memory read
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. In versions prior to 3.17.3, Oj.load in:object mode reads uninitialized stack memory (and, for long keys, reads out of bounds) when parsing a JSON object whose key is 254 bytes or longer. The interned bytes can surface to the caller, disclosing process stack memory. In ext/oj/intern.c, form_attr() handles the long-key path by allocating a heap buffer, `b`, populating it with the attribute name, and then freeing it — but it passed the uninitialized stack buffer buf (not b) to rb_intern3(). rb_intern3 therefore reads len + 1 bytes of uninitialized stack memory. When the key length is >= 256, it also reads out of bounds past the 256-byte buf. This issue has been fixed in version 3.17.3. This vulnerability, an out-of-bounds read (CWE-125), can lead to information disclosure of process stack memory. The leaked information is uncontrolled and can only be accessed if the application exposes the resulting Symbol or an EncodingError. Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-125.
Medium [CVE-2026-54899] Use-After-Free in parser symbol key cache toggle
Oj (Optimized JSON) is a JSON parser and Object marshaller packaged as a Ruby gem. Prior to version 3.17.2, disabling symbol_keys on a reused Oj::Parser instance triggers a heap use-after-free. When symbol_keys is toggled from true to false, opt_symbol_keys_set frees the internal key cache (cache_free) but does not clear the pointer. The next parse call reads from the freed cache via cache_intern, producing a use-after-free. This issue has been fixed in version 3.17.2. A flaw was found in Oj (Optimized JSON), a Ruby gem for parsing JSON. This happens because the internal key cache is freed but its pointer is not cleared, allowing subsequent parse operations to read from freed memory. This can lead to unpredictable application behavior, crashes, or potentially arbitrary code execution. Red Hat's only product shipping the Oj Ruby gem (Compliance Backend) already includes version 3.17.3, which contains the fix for this vulnerability. No Red Hat products are affected. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-54673] Information disclosure via unstripped credential headers during HTTP redirects
electron-updater allows for automatic updates for Electron apps. Prior to 9.7.0, the HTTP redirect handler (HttpExecutor.prepareRedirectUrlOptions) only stripped a credential header whose key string matched exactly lowercase "authorization", exposing credentials. Other credential-bearing headers — most notably PRIVATE-TOKEN (used by GitLab's personal access token flow) and mixed-case Authorization (used by GitLab's Bearer/OAuth flow) — were not stripped and could be forwarded to an attacker-controlled cross-origin redirect destination. This issue has been fixed in version 9.7.0. This vulnerability allows a remote attacker to obtain sensitive user credentials. When an Electron application performs an HTTP redirect, the electron-updater's redirect handler fails to strip certain credential-bearing headers, such as PRIVATE-TOKEN or mixed-case Authorization headers. This oversight can lead to these credentials being forwarded to an attacker-controlled destination, resulting in information disclosure. This could allow an attacker who controls a redirect destination to capture authentication credentials used during application update checks. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-201. Affected Red Hat products: Red Hat Build of Podman Desktop; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9.
Medium [CVE-2026-57204] Denial of Service via crafted PDF with missing stream length
pypdf is a free and open-source pure-python PDF library. Prior to 6.13.3, a maliciously crafted PDF can cause DoS. An attacker who uses this vulnerability can craft a PDF which leads to large memory usage, as MAX_DECLARED_STREAM_LENGTH is sometimes ignored. This requires parsing a content stream without a /Length value. This issue has been fixed in version 6.13.3. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when parsed, leads to uncontrolled resource consumption and large memory usage. This occurs because the library sometimes ignores defined limits for stream lengths when a content stream lacks a /Length value. Successful exploitation could result in a Denial of Service (DoS) condition, making the system or application unavailable. This Moderate flaw in pypdf can lead to a Denial of Service (DoS) due to uncontrolled memory consumption when processing a specially crafted PDF file. The vulnerability arises from the library's failure to properly enforce stream length limits in certain scenarios, allowing an attacker to exhaust system resources. Red Hat products that process untrusted PDF content, such as Red Hat Enterprise Linux AI, Red Hat Quay, Red Hat Ansible Automation Platform, and OpenShift Lightspeed, are affected if they handle untrusted PDF inputs.
Medium [CVE-2026-49478] Server-Side Request Forgery and Kubernetes ServiceAccount token leakage
Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available. A flaw was found in Fulcio's OpenID Connect (OIDC) Discovery client. This vulnerability allows a remote attacker to perform Server-Side Request Forgery (SSRF) by redirecting discovery requests to internal systems. Additionally, an attacker can manipulate the JSON Web Key Set (JWKS) Uniform Resource Identifier (URI) to poison the verifier cache with malicious keys, enabling the validation of attacker-controlled signatures. Furthermore, the flaw can lead to the leakage of Kubernetes ServiceAccount tokens to third-party hosts through cross-host redirects or misconfigured MetaIssuers, potentially exposing sensitive cluster credentials. Exploitation requires a compromised or malicious OIDC issuer already trusted in the Fulcio configuration.
Medium [CVE-2026-49835] Denial of Service via unbounded metric label cardinality
Sigstore Timestamp Authority is a service for issuing RFC 3161 timestamps. Prior to 2.1.0, the global wrapMetrics middleware records raw HTTP request path r.URL.Path and raw HTTP request method r.Method as Prometheus labels for latency and request count metric vectors before routing, allowing an unauthenticated remote attacker to issue requests with random paths such as /api/v1/timestamp/ or random HTTP methods and create unbounded permanent time-series entries that exhaust memory. This issue is fixed in version 2.1.0. This leads to the creation of an excessive number of unique metric labels, causing unbounded memory growth and a denial of service (DoS) condition on the server. This issue is a type of Improper Restriction of Resource Consumption (CWE-770). Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Red Hat lists Red Hat Trusted Artifact Signer as not affected.
Medium [CVE-2026-13455] Information Disclosure via brute-force attack on hash function
PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. The problem is resolved in PostgreSQL Anonymizer 3.1.2 and later versions PostgreSQL Anonymizer is not shipped in any Red Hat product. It is available in Fedora and EPEL as a community package. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-916.
Medium [CVE-2026-58015] path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash. To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-22. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 15 more.
Medium [CVE-2026-58013] buffer over-read in glib/giochannel.c via "g_io_channel_read_line_backend"
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. Any applications calling g_io_channel_set_line_term() with a multi-byte line terminator (length greater than one) and subsequently calling g_io_channel_read_line_backend() are vulnerable to this issue. Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-126. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 19 more.
Medium [CVE-2026-58012] buffer over-read in g_regex_replace via glib/gregex.c:string_append and g_utf8_next_char
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary. Any applications that use g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag and allow user-controlled replacement strings containing case-change escapes (\u, \l, \U, \L) are vulnerable to this issue. Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-126. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 19 more.
Medium [CVE-2026-58011] out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service. Any applications that allow a user to submit a date to `g_date_time_add_full()` and later call any getter functions, such as `g_date_time_get_month()` or `g_date_time_get_year()`, with the returned GDateTime object are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 2 bytes, leading to a denial of service due to logic errors that a corrupted date can trigger. Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 19 more.
Medium [CVE-2026-58010] buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. Any applications calling the `g_variant_is_normal_form()`, `g_variant_get_normal_form()` or `g_variant_byteswap()` functions that process untrusted GVariant data received from D-Bus, network or file are vulnerable to this issue. Due to these reasons, this vulnerability has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-126. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 19 more.
Medium [CVE-2026-53432] Denial of Service via Integer Overflow in FuzzyMatchV2 function
fzf is vulnerable to Integer Overflow leading to crash in FuzzyMatchV2 function. When input line length is approximately 2,200,000 bytes and pattern length is 999 bytes, the product overflows. The Go runtime detects the invalid slice bounds and terminates the process immediately with a non-recoverable panic. This issue was fixed in version 0.73.1. A flaw was found in fzf. An integer overflow vulnerability exists in the FuzzyMatchV2 function when processing exceptionally long input lines and patterns. This can lead to the application terminating unexpectedly with a non-recoverable panic, resulting in a Denial of Service (DoS). A local user could exploit this by providing specially crafted input. An integer overflow in the FuzzyMatchV2 function can cause a non-recoverable Go runtime panic when processing a specially crafted input of approximately 2.2 million bytes with a 999-byte pattern. Exploitation requires local access and user interaction — an attacker must supply the crafted input to a running fzf process. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-190.
Medium [CVE-2026-4629] privilege escalation through hardcoded role mapper injection
A flaw was found in Keycloak. A highly privileged user with `manage-clients` permission can exploit this vulnerability by injecting a hardcoded role mapper into any client. This action allows the user to bypass existing scope restrictions and inject the `realm-admin` role into generated tokens, resulting in privilege escalation and full administrative access to the realm. Affected product named by the advisory: Red Hat build of Keycloak 26.4.
Medium [CVE-2026-12388] Privilege escalation to realm administrator via improper authorization in identity provider mapper
A flaw was found in the Identity Provider (IdP) mapper component of Keycloak, which is used to manage how user information from external services is mapped to Keycloak users. An administrator with limited permissions to manage identity providers can exploit this flaw by creating a "Hardcoded Role" mapper that assigns high-level administrative roles (like realm-admin) to themselves or others. This allows a restricted administrator to bypass security checks and gain full control over the entire realm. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess high-level administrative privileges (manage-identity-providers). Successful exploitation allows an attacker to escalate their privileges to realm-admin, granting them full control over the Keycloak realm. The vulnerability's root cause is a failure to enforce proper authorization checks (specifically requireMapRole) within the Identity Provider mapper endpoint. Weakness: CWE-266. Affected Red Hat products: Red Hat Build of Keycloak. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-14209] keycloak-admin-ui:Admin UI extension brute-force-user endpoint bypasses FGAPv2 user view restrictions
A vulnerability was discovered in Keycloak's Admin UI extension that allows certain administrative users to bypass security restrictions. When Fine-Grained Admin Permissions (FGAPv2) are enabled, an administrator who should only be able to search for users (but not view their full details) can use a specific "brute-force-user" endpoint to access a user's full profile. This includes sensitive information and security metadata. The issue occurs because the system fails to check if the administrator has the required "view" permission for that specific user when using this particular search path. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires the attacker to already possess administrative privileges (query-users role) and knowledge of the target user's ID. Successful exploitation allows an attacker to bypass fine-grained authorization controls to view sensitive user data they are not authorized to see. The vulnerability's root cause is a missing authorization check in the BruteForceUsersResource component of the Admin UI extension. Weakness: CWE-639. Affected Red Hat products: Red Hat build of Keycloak 26.4; Red Hat build of Keycloak 26.4.14; Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.5; Red Hat JBoss Enterprise Application Platform Expansion Pack.