Red Hat Linux Security Advisories & CVEs
6249 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-4462] Out of bounds read in Blink
Out of bounds read in Blink. Red Hat rates this important (CVSS 6.5). Weakness: CWE-125. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-4460] Out of bounds read in Skia
Out of bounds read in Skia. Red Hat rates this important (CVSS 6.5). Weakness: CWE-125. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-27448] TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback
TLS connection bypass via unhandled callback exception in set_tlsext_servername_callback. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-636. Affected package(s): pyopenssl-main. Resolved in Red Hat advisory RHSA-2026:7224 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-4324] Denial of Service and potential information disclosure via SQL injection
Denial of Service and potential information disclosure via SQL injection. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-89. Affected package(s): foreman, rubygem-katello, rubygem-fog-kubevirt, python-pulp-container, python-pulp-rpm, python-django. Resolved in Red Hat advisory RHSA-2026:5968 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9.
Medium [CVE-2026-4224] Stack overflow parsing XML with deeply nested DTD content models
Stack overflow parsing XML with deeply nested DTD content models. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-805. Affected package(s): python3.12, python3, python3.14, rhui5/rhua-rhel9:1779798222, rhui5/installer-rhel9:1779798165. Resolved in Red Hat advisory RHSA-2026:19019 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8.
Medium [CVE-2026-3644] Incomplete control character validation in http.cookies
Incomplete control character validation in http.cookies. Red Hat rates this moderate (CVSS 5.4). Weakness: CWE-791. Affected package(s): python3.12, python3, python3.14, rhui5/rhua-rhel9:1779798222, rhui5/installer-rhel9:1779798165. Resolved in Red Hat advisory RHSA-2026:19019 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8.
Medium [CVE-2026-4271] Denial of Service via Use-After-Free in HTTP/2 server
Denial of Service via Use-After-Free in HTTP/2 server. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-416. Affected package(s): libsoup3. Resolved in Red Hat advisory RHSA-2026:17482 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1.
Medium [CVE-2026-31885] FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected package(s): freerdp. Resolved in Red Hat advisory RHSA-2026:19142 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 1.
Medium [CVE-2026-31884] FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0
FreeRDP has a division-by-zero in ADPCM decoders when `nBlockAlign` is 0. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-369. Affected package(s): freerdp. Resolved in Red Hat advisory RHSA-2026:19142 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 1.
Medium [CVE-2026-29775] FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-787. Affected package(s): freerdp. Resolved in Red Hat advisory RHSA-2026:19142 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 1.
Medium [CVE-2026-2673] OpenSSL TLS 1.3 server may choose unexpected key agreement group
OpenSSL TLS 1.3 server may choose unexpected key agreement group. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-325. Affected package(s): openssl-main, jbcs-httpd24-openssl. Resolved in Red Hat advisory RHSA-2026:7261 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2025-8766] Excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container
Excessive permissions of /etc could lead to escalation of privilege in the noobaa-core container. Red Hat rates this important (CVSS 6.4). Weakness: CWE-276. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat Openshift Data Foundation 4.22.
Medium [CVE-2026-4105] Privilege escalation via improper access control in RegisterMachine D-Bus method
Privilege escalation via improper access control in RegisterMachine D-Bus method. Red Hat rates this moderate (CVSS 6.7). Weakness: CWE-284. Affected package(s): systemd-main. Resolved in Red Hat advisory RHSA-2026:7299 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 2 more.
Medium [CVE-2026-1527] HTTP header injection and request smuggling vulnerability
HTTP header injection and request smuggling vulnerability. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-93. Affected package(s): nodejs24, nodejs:24. Resolved in Red Hat advisory RHSA-2026:7350 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1.
Medium [CVE-2026-2581] Denial of Service due to uncontrolled resource consumption
Denial of Service due to uncontrolled resource consumption. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-770. Affected package(s): nodejs24, nodejs:24. Resolved in Red Hat advisory RHSA-2026:7350 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1.
Medium [CVE-2026-32235] @backstage/plugin-auth-backend: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass
@backstage/plugin-auth-backend: @backstage/plugin-auth-backend: OAuth redirect URI allowlist bypass. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-601. Affected package(s): rhdh/rhdh-hub-rhel9:1780930740. Resolved in Red Hat advisory RHSA-2026:24841 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-31988] Denial of Service vulnerability in zip file processing
Denial of Service vulnerability in zip file processing. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-193. Affected package(s): rhdh/rhdh-hub-rhel9:1780930740. Resolved in Red Hat advisory RHSA-2026:24841 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-31958] Denial of Service via large multipart bodies
Denial of Service via large multipart bodies. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-770. Affected package(s): rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9:1780078429, rhoai/odh-llama-stack-core-rhel9:1775144403, python-tornado, rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9:1780078388, rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9:1780069224, pcs. Resolved in Red Hat advisory RHSA-2026:24342 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 9.
Medium [CVE-2026-3904] nscd client crash on x86_64 under high nscd load
nscd client crash on x86_64 under high nscd load. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-366. Affected package(s): glibc-main. Resolved in Red Hat advisory RHSA-2026:7316 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.
Medium [CVE-2026-3805] Arbitrary code execution or Denial of Service via use-after-free in SMB request handling
Arbitrary code execution or Denial of Service via use-after-free in SMB request handling. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-825. Affected package(s): curl-main. Resolved in Red Hat advisory RHSA-2026:6893 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux.