Red Hat Linux Security Advisories & CVEs
13025 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-58417] Information disclosure via REST API exposes private organization membership
REST API exposes organization membership of private organizations to public A flaw was found in Gitea. This allows an unauthenticated remote attacker to gain unauthorized access to sensitive organizational structure information, leading to information disclosure. This flaw has a Moderate impact. The information disclosed is limited to organization membership status. Red Hat products that bundle code.gitea.io/gitea as a Go dependency do not run the Gitea web server and may not expose the vulnerable API endpoint. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-863. Affected Red Hat products: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-58416] Information disclosure via Fork-PR Actions task
Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard) A flaw was found in Gitea. This occurs due to a missing guard that should prevent unauthorized access via the collaborative-owner branch. A remote attacker could leverage this vulnerability to gain unauthorized access to sensitive information. Due to a missing permission boundary check on collaborative-owner branches, a Gitea Actions workflow triggered by a fork pull request can access unauthorized repository contexts. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-1220. Affected Red Hat products: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-57897] Information disclosure via Org-Level Actions Run/Job APIs
Cross-Repo Information Disclosure via Org-Level Actions Run/Job APIs A flaw was found in Gitea. An attacker could exploit this to gain unauthorized access to sensitive information across different repositories. An authorization bypass vulnerability in Gitea's organization-level Actions REST API allows authenticated organization members to access workflow run and job details across all repositories within the organization. By querying the `/api/v1/orgs/{org}/actions/runs` or `/api/v1/orgs/{org}/actions/jobs` endpoints, an attacker can bypass per-repository access control lists (ACLs) to enumerate action execution data from private repositories or repositories to which they do not have access. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-1220. Affected Red Hat products: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-56657] Denial of Service in SSH Key Parser
Gitea SSH Key Parser Denial of Service A flaw was found in Gitea. Red Hat products are not affected as they do not expose any endpoint that ingest SSH key using Gitea. Products that import from code.gitea.io/gitea only compile the modules/structs and modules/json subpackages. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Red Hat lists OpenShift Pipelines as not affected.
Medium [CVE-2026-42931] Denial of Service due to unbounded memory consumption in NPM package tag endpoint
Denial of Service via Unbounded io.ReadAll in NPM Package Tag Endpoint A flaw was found in Gitea. The server attempts to read the entire request body into memory without a size limit, leading to an Out-of-Memory (OOM) error and crashing the Gitea instance. This can result in a persistent denial of service, making all hosted services unavailable to users. Red Hat products that bundle code.gitea.io/gitea as a Go dependency are affected by this vulnerability. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
Medium [CVE-2026-73559] Denial of Service via unbounded completion prompt lists
vLLM is an inference and serving engine for large language models. From 0.19.0 until 0.26.0, the /v1/completions CompletionRequest.prompt field in vllm/entrypoints/openai/completion/protocol.py accepts an unbounded list[str] or list[list[int]], prompt_to_seq() in vllm/renderers/inputs/preprocess.py and OnlineRenderer.preprocess_completion() in vllm/renderers/online_renderer.py expand every element, and vllm/entrypoints/openai/completion/serving.py creates one engine generator and response slot per prompt, allowing an authenticated API client to exhaust CPU, memory, async scheduling capacity, engine request slots, and response buffering with one request. This issue is fixed in version 0.26.0. An authenticated API client can exploit this vulnerability by sending a single request to the /v1/completions endpoint with an excessively large list of prompts. This unbounded input causes the vLLM server to allocate a disproportionate amount of CPU, memory, and other resources, leading to a Denial of Service (DoS) condition. This can disrupt or starve other services sharing the same vLLM instance. This could lead to resource exhaustion, causing a denial of service for the inference engine. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat AI Inference Server 3.5; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-73558] Cross-User Data Leakage via Integer Overflow
vLLM is an inference and serving engine for large language models. Prior to 0.27.0, an integer overflow in blockIdx.x * 2 * d in activation_kernels.cu can cause act_and_mul_kernel to consume another batched user's input, allowing a request processed in the same inference batch to receive a partial or complete copy of another user's inference result. This issue is fixed in version 0.27.0. An integer overflow vulnerability in the `act_and_mul_kernel` kernel allows a remote attacker to cause cross-user data leakage. This could lead to the unauthorized disclosure of sensitive information. This is particularly relevant in multi-tenant environments where vLLM processes requests concurrently from different users. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-190. Affected Red Hat products: Red Hat AI Inference Server 3.5; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat fixing advisory: RHSA-2026:82059, RHSA-2026:82061.
Medium [CVE-2026-73557] Incomplete remediation allows bypass via concurrent prompt processing
vLLM is an inference and serving engine for large language models. From 0.20.2rc0 until 0.26.0, safe_load_prompt_embeds in vllm/renderers/embed_utils.py uses torch.sparse.check_sparse_tensor_invariants, whose process-global save, enable, and restore state can be raced by concurrent prompt_embeds parts submitted to POST /v1/chat/completions through AsyncMultiModalItemTracker.resolve_items, asyncio.gather, and the default executor, allowing an invalid sparse tensor to reach tensor.to_dense despite the CVE-2025-62164 guard when enable_prompt_embeds is enabled. This issue is fixed in version 0.26.0. An incomplete remediation for a previous vulnerability (CVE-2025-62164) can be bypassed. This occurs when concurrent prompt parts are processed, leading to a race condition in the handling of sparse tensors. This vulnerability could allow an attacker to cause a denial of service. When `enable_prompt_embeds` is active, concurrent prompt processing can lead to an invalid sparse tensor being processed, potentially causing a denial of service. This issue primarily affects deployments utilizing vLLM with multimodal features enabled. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-367. Affected Red Hat products: Red Hat AI Inference Server 3.5. Red Hat fixing advisory: RHSA-2026:82059, RHSA-2026:82061.
Medium [CVE-2026-73555] Information Disclosure via Validation Error Messages
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the validation_exception_handler in vllm/entrypoints/openai/server_utils.py converts FastAPI RequestValidationError objects with str(exc), and sanitize_message in vllm/entrypoints/utils.py does not remove traceback-style file paths, allowing unauthenticated malformed JSON requests to /v1/chat/completions, /v1/completions, /tokenize, and /detokenize to disclose the OS username, home and virtual-environment paths, Python version, internal package structure, line numbers, and endpoint handler names. This issue is fixed in version 0.26.0. Unauthenticated attackers can send malformed JSON requests to various API endpoints, triggering validation errors. The system's error handling mechanism converts these validation errors into strings without properly sanitizing traceback-style file paths. Moderate: vLLM, as deployed in Red Hat AI Inference Server and Red Hat OpenShift AI, is susceptible to information disclosure. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-209. Affected Red Hat products: Red Hat AI Inference Server 3.5; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat fixing advisory: RHSA-2026:82059, RHSA-2026:82061.
Medium [CVE-2026-70453] Denial of Service via Algorithmic Complexity
rsync before 3.5.0 contains an algorithmic complexity vulnerability in the hash_search() function that allows a remote attacker to cause a denial of service by delivering a carefully constructed file list. A sender can exploit the quadratic-time worst-case behavior in hash lookups to exhaust receiver CPU resources with a modest number of crafted entries, causing a sustained denial of service. A flaw was found in rsync. By sending a specially crafted file list, an attacker can exhaust the receiver's CPU resources, leading to service unavailability. This is particularly relevant in Red Hat environments where rsync is used for remote file synchronization and may be exposed to untrusted networks. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4.22; Red Hat Cost Management On-Premise 1; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:74095, RHSA-2026:67462, RHSA-2026:71446, RHSA-2026:79357. Affected products named by the advisory: Red Hat package: rsync.
Medium [CVE-2026-70454] TLS Certificate Validation Bypass allows interception of encrypted sessions
rsync 3.2.0 through 3.2.3 (openssl mode) and rsync-ssl through 3.4.4 (stunnel mode) contain a TLS certificate validation vulnerability that allows on-path attackers to intercept encrypted sessions by presenting self-signed or otherwise invalid certificates. Attackers can exploit the failure to validate server TLS certificates against a trusted CA or verify certificate hostname matching to decrypt or tamper with rsync session content without detection by the client. A flaw was found in the rsync-ssl wrapper script's TLS certificate validation. The vulnerability arises from insufficient TLS certificate validation, enabling an attacker to present invalid certificates and compromise data integrity and confidentiality without detection. Exploitation requires an attacker to be positioned to intercept network traffic between the rsync client and server. Red Hat severity: Moderate — CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
Medium [CVE-2026-70462] Denial of Service via signed integer overflow in I/O timeout
rsync 3.1.0 before 3.5.0 contains a signed integer overflow vulnerability in the I/O timeout implementation that allows attackers to permanently disable connection timeouts by injecting MSG_IO_TIMEOUT messages carrying non-positive (zero or negative) values. Attackers can craft malicious MSG_IO_TIMEOUT messages that cause the timeout variable to wrap to a non-positive value, preventing the timeout check from firing and enabling idle or stalled connections to hold daemon slots indefinitely, leading to resource exhaustion. A flaw was found in rsync. A remote attacker can exploit a signed integer overflow vulnerability in the I/O timeout implementation by sending specially crafted messages. These messages can disable connection timeouts, causing idle or stalled connections to persist indefinitely. This leads to resource exhaustion, preventing legitimate users from accessing the rsync service and resulting in a denial of service. This is a Moderate denial of service flaw in rsync, where a remote, unauthenticated attacker can exhaust system resources. The impact is limited to denial of service and does not allow for arbitrary code execution or data compromise. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-190.
Medium [CVE-2026-53794] Denial of Service via --max-alloc=0 logic error
rsync before 3.5.0 contains a logic error in --max-alloc handling that allows a sender or configuration setting --max-alloc=0 to disable allocation sanity checks entirely rather than enforcing a zero-byte cap. Attackers can exploit this flaw to cause the receiver to attempt unbounded memory allocations for file list and data structures, potentially exhausting available memory and causing a denial of service. A flaw was found in rsync. This vulnerability in rsync is rated as Important. A remote attacker can exploit a logic error in the `--max-alloc` handling by providing `--max-alloc=0`, which disables memory allocation sanity checks. This can lead to unbounded memory consumption on the receiving system, resulting in a denial of service without requiring authentication or user interaction. Red Hat systems using rsync, particularly in daemon mode or when processing untrusted data, are at risk. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: rsync.
Medium [CVE-2026-53792] Denial of Service via out-of-bounds read with crafted checksum block
rsync before 3.5.0 contains an out-of-bounds read vulnerability in the sender-side block matching logic that allows a malicious receiver to trigger memory access before the start of an allocated buffer by sending a crafted checksum block with a length of zero. Attackers can send a specially crafted checksum set containing a zero-length block to cause a negative offset calculation during delta computation, resulting in an out-of-bounds read of file data buffer memory on the sender side. A flaw was found in rsync. This can lead to a denial of service on the sender side. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-129. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: rsync.
Medium [CVE-2026-73506] Terminal escape sequence injection via unsanitized prompt data
Oh My Posh is the most customisable and low-latency cross platform/shell prompt renderer. Prior to 29.35.1, write(s rune) in src/terminal/writer.go emitted attacker-controlled current directory names and Git metadata, including Commit. Subject, Commit. Author. Name, Commit. Email, and RawUpstreamURL, without removing C0/C1 terminal control characters such as ESC, BEL, CSI, and OSC, allowing terminal escape sequence injection during prompt rendering that could overwrite the clipboard, spoof the prompt or screen, manipulate the window title, or disrupt the terminal. This issue is fixed in version 29.35.1. A flaw was found in Oh My Posh, a customizable terminal prompt renderer. Oh My Posh is not shipped in any Red Hat product. It is available in Fedora as a community package. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). Weakness: CWE-791.
Medium [CVE-2026-6470] Denial of Service via missing authorization in DDL commands
Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subtype and referencing the type from an SQL expression did not. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL where missing authorization checks in DDL commands allow an authenticated user to create unauthorized dependencies on a data type (such as when assigning a range subtype or referencing the type in an SQL expression). This allows the user to block legitimate owners from altering or dropping that type, resulting in a targeted denial-of-service condition on the affected database object. This Moderate impact flaw allows an authenticated user with object creation rights to cause a targeted denial of service in PostgreSQL. Missing authorization checks during specific DDL operations allow an attacker to create type dependencies that block legitimate ALTER and DROP commands, preventing routine administrative management of affected data types. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-862.
Medium [CVE-2026-18024] Information disclosure via buffer over-read in ascii function
Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less impact. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL. This could lead to limited information disclosure. This Moderate impact information disclosure flaw in PostgreSQL's `ascii()` SQL function allows an authenticated attacker to read up to 3 bytes of memory beyond an allocated buffer by providing a specially crafted text value. The limited scope of data disclosure contributes to its Moderate severity. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-126. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Self-service automation portal 2. Red Hat lists Red Hat Hardened Images as not affected. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: postgresql16; Red Hat package: postgresql18.
Medium [CVE-2026-14681] Improper enforcement of GSSAPI encryption via direct TLS connection
Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchange data over TLS encryption alone. If the TLS settings are more permissive than the GSS settings, the connection may continue with lesser protection. Within major versions 17-18, minor versions before PostgreSQL 18.5 and 17.11 are affected. A flaw was found in PostgreSQL. This enables the connection to proceed with only TLS encryption, even when GSSAPI is required. This Moderate severity flaw in PostgreSQL's GSSAPI support allows a remote, authenticated attacker with low privileges to bypass `pg_hba.conf` rules requiring GSSAPI encryption. By initiating a direct TLS connection, the attacker can force a less secure connection if TLS settings are more permissive, potentially compromising data integrity and confidentiality. The high attack complexity reduces the overall risk. Red Hat severity: Moderate — CVSS 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-924. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: postgresql18.
Medium [CVE-2026-14678] Information disclosure via buffer over-read in pg_trgm
Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. A flaw was found in PostgreSQL. This Moderate impact information disclosure flaw in PostgreSQL's pg_trgm extension requires a table maintainer to exploit, limiting the attack surface to privileged database users. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-126. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Self-service automation portal 2. Red Hat lists Red Hat Hardened Images as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: postgresql16; Red Hat package: postgresql18.
Medium [CVE-2026-14672] User existence oracle in SCRAM authentication
Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, because the authentication challenge for a nonexistent user reports the default scram_iterations. Within major versions 16-18, minor versions before PostgreSQL 18.5, 17.11, and 16.15 are affected. Unauthenticated attackers can verify if a specific user exists by observing the authentication iteration count, provided the targeted user is configured with a non-default scram_iterations value. A moderate-severity vulnerability in PostgreSQL allows unauthenticated attackers to enumerate valid users. By observing discrepancies in SCRAM authentication responses, attackers can identify users configured with a non-default scram_iterations count, which may facilitate targeted brute-force attacks. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-204. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: postgresql16; Red Hat package: postgresql18.