Red Hat Linux Security Advisories & CVEs
13016 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-14668] Information disclosure via type confusion in ctid selectivity estimator
Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses precision, substantial memory value recovery appears possible. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL. This vulnerability, stemming from a type confusion issue in the ctid data type selectivity estimator, could allow an authenticated object creator to access and potentially recover sensitive information from memory. By manipulating input, an attacker could gain unauthorized insight into system memory. An Important-rated information disclosure vulnerability in PostgreSQL allows an authenticated user with object creation privileges to read arbitrary memory spans. Exploitation is limited to users possessing object creation rights Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). Weakness: CWE-843. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 10 more.
High [CVE-2026-14664] Arbitrary code execution via heap buffer overflow in regexp
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL. This can lead to unanticipated data growth, allowing the attacker to execute arbitrary code as the operating system user running the database. This flaw is rated as Important. This can lead to a complete compromise of the database server through specially crafted input that bypasses encoding validation. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-122. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 10 more.
High [CVE-2026-14662] Arbitrary code execution via integer wraparound in tsvector and tsquery functions
Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL. While direct exploitation by application users is considered unlikely as these functions are typically used by application logic, the flaw could still be leveraged in specific scenarios where crafted large inputs are processed. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; and 12 more.
High [CVE-2026-73627] Plugin manager lock-rule bypass allows unauthorized plugin control
JupyterLab (pip package 'jupyterlab') versions >=4.1.0, =4.6.0,<=4.6.1 contain a plugin manager lock-rule enforcement bypass. Two server-side enforcement gaps allow an authenticated user to circumvent administrator lock rules by making direct requests to the /lab/api/plugins endpoint, enabling or disabling plugins that were locked — including child plugins of multi-plugin extensions and plugins locked via the 'lock all' mechanism. This can impact data integrity and bypass hardening or restrictions (e.g., download/upload limits) implemented through locked plugins. Fixed in versions 4.6.2 and 4.5.10. A flaw was found in JupyterLab. Direct API requests can enable or disable plugins intended to be locked, impacting data integrity and bypassing security restrictions in Red Hat OpenShift AI and Migration Toolkit for Applications deployments. Red Hat severity: Moderate — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). Weakness: CWE-414. Affected Red Hat products: Red Hat OpenShift AI 2.25; Red Hat OpenShift AI 3.3; Red Hat OpenShift AI (RHOAI). Red Hat fixing advisory: RHSA-2026:65126, RHSA-2026:73987.
High [CVE-2026-73624] Arbitrary File Overwrite via improper git option validation
GitPython versions before 3.1.54 contain an arbitrary file overwrite vulnerability in the Diffable.diff method that fails to validate git options passed through kwargs. Attackers can supply the --output argument via the other parameter or output kwarg to write patch content to attacker-chosen file paths at process privilege level. A flaw was found in GitPython. This vulnerability allows a remote attacker to overwrite arbitrary files on the system. By failing to properly validate git options passed to the `Diffable.diff` method, an attacker can supply a malicious output argument to write patch content to attacker-controlled file paths, leading to potential system compromise. It allows an attacker to write arbitrary content to chosen file paths at the process's privilege level by manipulating git options, which could lead to system compromise or privilege escalation. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H). Weakness: CWE-88. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; and 9 more.
High [CVE-2026-73625] Remote Code Execution via kwarg value smuggling
GitPython versions before 3.1.54 contain a remote code execution vulnerability in the check_unsafe_options guard that can be bypassed by smuggling git options inside single-character kwarg values. Attackers can supply crafted option dictionaries to clone_from, fetch, pull, push, ls_remote, iter_commits, blame, or archive methods to execute arbitrary OS commands via the --upload-pack parameter. A flaw was found in GitPython. This allows them to supply specially crafted option dictionaries to various GitPython methods, such as `clone_from` or `fetch`, leading to arbitrary code execution. This is an Important remote code execution vulnerability in GitPython, affecting Red Hat products that utilize GitPython versions prior to 3.1.54. The flaw allows an attacker to bypass input sanitization by smuggling malicious Git options within single-character keyword arguments, leading to arbitrary command execution when GitPython methods process untrusted input. This poses a significant risk to the integrity and confidentiality of systems. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-78. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; and 9 more.
High [CVE-2026-73623] Remote Code Execution via malicious Git template
GitPython before 3.1.54 contains an incomplete denylist in unsafe_git_clone_options that omits --template, allowing attackers to achieve arbitrary command execution during clone operations. Attackers can supply --template pointing to a directory containing malicious post-checkout hooks that execute when git clones the repository. A flaw was found in GitPython. An incomplete denylist in the `unsafe_git_clone_options` function fails to restrict the `--template` option. This allows a remote attacker to supply a malicious Git template directory, leading to arbitrary command execution during clone operations. This is an Important severity flaw in GitPython where an incomplete denylist in `unsafe_git_clone_options` allows remote code execution. This risk is present when applications using GitPython clone untrusted repositories. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-78. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; and 9 more.
High [CVE-2026-73622] Information disclosure via environment variable expansion in URL handling
GitPython before 3.1.55 fails to disable environment variable expansion in Remote.create() and Submodule.add() URL handling, allowing attackers to exfiltrate secrets by supplying URLs containing variable references. Attackers can craft URLs with environment variable tokens that are expanded into.git/config and.gitmodules, then transmitted to attacker-controlled hosts during fetch or pull operations. A flaw was found in GitPython. This vulnerability allows a remote attacker to exfiltrate sensitive information, such as environment variables, by crafting malicious URLs. This is an Important information disclosure flaw in GitPython. This occurs because environment variable expansion is not disabled in URL handling, leading to secrets being embedded in Git configuration and transmitted to attacker-controlled hosts. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-914. Affected products named by the advisory: Red Hat Satellite 6.16 for RHEL 8; Red Hat Satellite 6.16 for RHEL 9; Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; and 9 more.
High [CVE-2026-73620] Arbitrary file overwrite and read via unsafe git option forwarding
GitPython before 3.1.57 fails to guard git option forwarding in IndexFile.checkout() and TagReference.create(), allowing attackers to pass unsafe options via kwargs. Attackers can use --prefix to overwrite arbitrary files with repository content or -F to read arbitrary files returned in-band. A flaw was found in GitPython. This vulnerability arises from insufficient guarding of git option forwarding within the `IndexFile.checkout()` and `TagReference.create()` functions. This could result in significant data integrity and confidentiality impacts. This is an Important flaw in GitPython that allows an authenticated attacker to achieve arbitrary file overwrite and read capabilities. The vulnerability stems from insufficient validation of git options passed to `IndexFile.checkout()` and `TagReference.create()`, enabling attackers to manipulate repository content or access sensitive files. This impacts several Red Hat products, including Red Hat OpenStack Platform, Red Hat Satellite, and Red Hat Ansible Automation Platform. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-88. Affected products named by the advisory: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Satellite 6.16 for RHEL 8; and 9 more.
High [CVE-2026-45819] Denial of Service via improper input handling
baseline-browser-mapping 2.x before 2.11.0 calls process.exit() instead of throwing on invalid or conflicting input parameters, and can trigger immediate process termination, causing denial of service. The affected component improperly terminates the process instead of handling the input error gracefully, leading to immediate service disruption. Applications utilizing this library may unexpectedly terminate if they process invalid or conflicting input parameters, potentially disrupting services. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Edge Manager 1.1; Red Hat Edge Manager 1.2; Red Hat Hardened Images; Red Hat OpenShift AI 2.25; Red Hat OpenShift Container Platform 4.21; Red Hat OpenShift Container Platform 4.22; Red Hat OpenShift Dev Spaces 3.30; Red Hat Satellite 6.18; Red Hat Satellite 6.19; OpenShift Lightspeed; OpenShift Pipelines; Red Hat Ansible Automation Platform 2; Red Hat Build of Podman Desktop; Red Hat Ceph Storage 9; Red Hat Discovery 2; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Openshift Data Foundation 4; Red Hat Satellite 6; Secrets Management Console for Red Hat OpenShift; Self-service automation portal 2.
High [CVE-2026-19484] Denial of Service via oversized multipart boundary
@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1. This can cause the Node.js event loop to stall, leading to a CPU-bound loop that consumes significant processing resources. Red Hat products that include @fastify/busboy are not affected by this vulnerability. CVE-2026-19484 is present only in @fastify/busboy versions 3.1.0 through 3.2.0. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606. Red Hat lists OpenShift Pipelines; Red Hat AMQ Broker 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4 as not affected.
High [CVE-2026-19481] Denial of Service from crafted form-data headers
@fastify/busboy is a multipart form-data parser. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1. A remote attacker can exploit this vulnerability by sending specially crafted multipart form-data headers. This can cause a TypeError in the parser, leading to the termination of the Node.js process and resulting in an unauthenticated Denial of Service (DoS). The unauthenticated nature and potential for service disruption elevate the impact to Important. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-915. Affected Red Hat products: OpenShift Pipelines; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat OpenShift AI (RHOAI). Red Hat lists Red Hat AMQ Broker 7; Red Hat OpenShift Container Platform 4 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-67986] Arbitrary code execution via Ruby code injection in AwesomeMethodArray#grep
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names. A flaw was found in amazing_print. This vulnerability allows an attacker to inject and execute arbitrary Ruby code within the host process. Red Hat Satellite includes the rubygem-amazing_print package as a dependency of the hammer CLI tool. While the vulnerable code exists in the shipped version, the specific code path that enables exploitation — calling grep with a block on method arrays — is not used by Satellite or any of its components. The gem is used solely for debug-level object formatting. As a result, this vulnerability is not exploitable in Red Hat Satellite as shipped. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-94. Red Hat lists Red Hat Satellite 6 as not affected.
High [CVE-2026-68453] Fix buffer over-read in cca_cipher2protkey
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functions. Additionally check in cca_gencipherkey() for possible underflow with returned key size. The CCA token structures contain user-controlled len fields that were used in operations without proper validation against both the actual buffer size and minimum token structure size. An attacker could set this field larger than the actual buffer size, leading to reading beyond buffer boundaries. This may result in a kernel crash or exposure of memory via sending this as part of a request down to the crypto card. Also an attacker could have used a very small len value and thus enforce a buffer under-run which may produce similar effects as a over-read. So now a key must - key buf length must be at least sizeof the token struct - the key len field inside the token must fit into the range of sizeof key token struct... key buf length This vulnerability arises from insufficient validation of user-controlled length fields within the Common Cryptographic Architecture (CCA) token structures. This could lead to a kernel crash, resulting in a denial of service, or the exposure of sensitive memory information.
High [CVE-2026-68452] Validate length for CCA AES cipher key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block. A local attacker could exploit this by providing a specially crafted key token, which may lead to a buffer overflow. This could result in a denial of service, making the system unavailable. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-68451] Validate length for CCA ECC private key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block. The `cca_ecc2protkey()` function, responsible for handling Common Cryptographic Architecture (CCA) Elliptic Curve Cryptography (ECC) private key requests, does not properly validate the length of the key token. This allows a local attacker to provide a malformed key token, potentially leading to memory corruption and a denial of service. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-805. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-73416] Extension blocklist bypass via weak package-name canonicalization
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. This issue is fixed in versions 4.5.10 and 4.6.2. A flaw was found in jupyterlab. The PyPI (Python Package Index) extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. Affected products named by the advisory: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-73428] Stored Cross-Site Scripting via HTML paste allows arbitrary code execution.
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18. This allows a malicious javascript: Uniform Resource Identifier (URI) to be embedded, which can then execute arbitrary code in the victim's browser when another user renders and clicks the content. No Red Hat products ship a vulnerable version of this component. Red Hat severity: Moderate — CVSS 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-79.
Medium [CVE-2026-73479] Terminal escape sequence injection via unfiltered marked file paths
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks. A terminal escape sequence injection flaw was found in dua-cli. Red Hat rates this as Moderate: exploitation is local, requires the victim to run dua-cli interactively on attacker-influenced content and to mark the malicious file, and the impact is limited to the terminal emulator rather than the application or host. Red Hat Enterprise Linux does not ship dua-cli; the package is present only in Fedora and EPEL (rust-dua-cli), which are addressed through the community update process. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-117.
Medium [CVE-2026-73480] Terminal Injection via Unstripped Escape Sequences
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects. A flaw was found in gdu, a disk usage analyzer. Red Hat products are not affected by this vulnerability as gdu is not shipped in any Red Hat product. Community packages in Fedora and EPEL are affected. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-838.