Red Hat Linux Security Advisories & CVEs
13569 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-48099] Filesystem path traversal via encoded dot segments
WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4. A remote attacker could exploit this vulnerability by sending a specially crafted WebDAV request path containing encoded parent-directory segments. This could allow the attacker to escape the configured filesystem share root, potentially leading to unauthorized access to sensitive files or directories outside the intended scope. Red Hat products do not ship WsgiDAV. The vulnerable code path is therefore not present in any Red Hat-shipped build, and no Red Hat product is affected by this flaw. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L). Weakness: CWE-22.
High [CVE-2026-73643] Denial of Service via exponential parsing in flow collections
js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 until 5.2.2, parsing a small YAML document can take exponential time when an application calls load() or loadAll() on untrusted input. In src/parser/parser.ts, readFlowCollection uses restoreState and calls parseNode a second time when a flow-sequence entry is recognized as a key: value pair. If the key is a nested flow sequence of the same shape, every level is parsed twice, causing O(2^n) work and allowing an input under 200 bytes to keep one CPU busy for minutes, block the Node.js event loop, and stall the process. No anchors, aliases, merges, tags, or nondefault options are required. This issue is fixed in version 5.2.2. A remote attacker could exploit this vulnerability by providing specially crafted YAML input containing nested flow collections. This can lead to exponential parsing time when the application processes untrusted input, consuming excessive CPU resources. This resource exhaustion can block the Node.js event loop and cause a Denial of Service (DoS) for the affected process. This is an Important denial-of-service flaw in the `js-yaml` library, where processing specially crafted YAML input can lead to exponential parsing time.
High [CVE-2026-73569] Denial of Service via repeated DOCTYPE declarations
fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks. From 5.9.3 until 5.10.1, src/xmlparser/OrderedObjParser.js processes multiple DOCTYPE declarations within a single XML document and passes each declaration's entities through addInputEntities(). addInputEntities() resets maxTotalExpansions and maxExpandedLength every time it is called, allowing additional DOCTYPE declarations to repeatedly reset the configured entity-expansion limits during one parse operation. A crafted XML document can then cause excessive CPU use, event-loop blocking, memory exhaustion, and process termination. This issue is fixed in version 5.10.1. A remote attacker could exploit this by submitting a specially crafted XML document containing multiple DOCTYPE declarations. This is an Important denial of service vulnerability affecting Red Hat products that process untrusted XML input using the `fast-xml-parser` library versions 5.9.3 through 5.10.0. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-776. Affected Red Hat products: Red Hat Ansible Automation Platform 2.2; Red Hat Migration Toolkit for Applications 8.2; Red Hat Openshift Data Foundation 4.22; Red Hat OpenShift GitOps.
High [CVE-2026-73566] Denial of Service via crafted long-path tar archive
node-tar is a tar archive manipulation library for Node.js. Prior to 7.5.21, node-tar's filesFilter in src/list.ts uses the recursive mapHas helper to walk an archive entry path upward with path.dirname() and no segment cap when tar.t(...) or tar.x(...) receives a non-empty member-selection list. A crafted GNU L or PAX x long-path header with thousands of slash-separated segments reaches this.filter(entry.path, entry) in Parser[CONSUMEHEADER] in src/parse.ts before Unpack[CHECKPATH] applies maxDepth, causing an uncatchable RangeError stack overflow that terminates asynchronous and streaming Node.js consumers. This issue is fixed in version 7.5.21. A remote attacker could provide a specially crafted tar archive with a long-path header. When processing this archive with a non-empty member-selection list, an uncontrolled recursion in the `filesFilter` function can lead to a stack overflow. This issue results in a denial of service (DoS) by terminating Node.js applications that consume these archives. Important: A denial of service vulnerability exists in the `node-tar` library, affecting Node.js applications that process untrusted tar archives with member selection. This is considered Important due to the potential for service disruption in applications handling untrusted archive content. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
High [CVE-2026-58440] Information disclosure via incomplete webhook revocation
Webhooks created by a collaborator keep firing after their repo access is revoked → ongoing real-time exfiltration of private repo content (incomplete revocation cleanup in `DeleteCollaboration`) A flaw was found in Gitea. Webhooks created by a collaborator continue to function even after their repository access is revoked. This incomplete revocation allows for the ongoing, real-time exfiltration of private repository content, leading to information disclosure. An attacker who previously held collaborator permissions can leverage these orphaned webhooks to continuously exfiltrate event payloads and sensitive private repository content without authorization. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-459. Affected Red Hat products: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-58439] Branch protection bypass via stale approval flag in PR retargeting
Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval Flag A flaw was found in Gitea. This could lead to unauthorized code being merged into a protected branch, compromising code integrity. This is considered Important due to the potential for unauthorized code execution within a controlled environment, despite requiring specific user interaction. Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:N). Weakness: CWE-472. Red Hat lists OpenShift Pipelines as not affected.
High [CVE-2026-58436] Denial of Service via ParseAcceptLanguage and Locale middleware on unauthenticated requests
ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests A flaw was found in Gitea. This vulnerability allows an attacker to send specially crafted requests, leading to excessive resource consumption and a Denial of Service (DoS) condition, making the service unavailable to legitimate users. This is an Important denial of service vulnerability in Gitea. An unauthenticated remote attacker can exploit a quadratic-time algorithm in the ParseAcceptLanguage function, leading to excessive resource consumption and service unavailability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333. Red Hat lists OpenShift Pipelines as not affected.
High [CVE-2026-58437] Repository visibility manipulation via Git push options
Repository Visibility Manipulation via Git Push Options A flaw was found in Gitea. This could lead to unauthorized disclosure of repository information or unintended access control changes. This could lead to unauthorized disclosure of private repository contents or disruption of access to public repositories. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Weakness: CWE-1220. Affected Red Hat products: OpenShift Pipelines. Will not fix / out of support: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-58314] Server-Side Request Forgery via webhooks, repository migration, and OpenID discovery
Two SSRF findings in Gitea 1.26.2 A flaw was found in Gitea. This vulnerability, known as Server-Side Request Forgery (SSRF), allows an attacker to trick the server into making requests to internal network resources. A logged-in user can exploit this by crafting malicious webhooks or repository migration configurations, leading to the disclosure of sensitive information from internal hosts. Additionally, if OpenID sign-in is enabled, an unauthenticated attacker can trigger blind GET requests to internal IPs through the OpenID discovery process, which can be used for internal network reconnaissance. A flaw in Gitea's URL parsing logic allows both authenticated users (via webhooks or repository migrations) and unauthenticated users (via OpenID discovery) to trigger HTTP GET requests to internal endpoints. By manipulating these parameters, an attacker can bypass boundary controls to perform Server-Side Request Forgery (SSRF), allowing internal network reconnaissance and disclosure of sensitive information from internal hosts. Red Hat severity: Important — CVSS 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-918. Affected Red Hat products: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-56750] Unauthorized access due to remember-me token theft not invalidating attacker sessions.
Gitea Remember-Me Token Theft Not Invalidating Attacker Session A flaw was found in Gitea. An attacker who steals a user's "Remember Me" token can maintain unauthorized access to the user's account. This occurs because the system fails to invalidate the attacker's session even after the legitimate user logs out or changes their password. This vulnerability can lead to persistent unauthorized access and potential compromise of user data. This allows an attacker to retain unauthorized access to a user's account even after the legitimate user has logged out or changed their password, extending the window of compromise. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-613. Affected Red Hat products: OpenShift Pipelines. Will not fix / out of support: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-56654] Privilege Escalation via API Access Token Scope Escalation
Privilege Escalation via Access Token Scope Escalation in API A flaw was found in Gitea. This vulnerability allows an attacker to escalate their privileges by manipulating the scope of an access token within the API. This means an attacker could gain unauthorized access to sensitive functions or data, potentially leading to full control over affected resources. This is due to a flaw in how Gitea's API processes basic authentication with tokens, allowing the creation of new tokens with elevated scopes beyond the original token's permissions. Red Hat OpenShift Pipelines does not deploy Gitea web servers. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-266. Red Hat lists OpenShift Pipelines as not affected.
High [CVE-2026-54481] Insecure TLS verification in internal API client
Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295) A flaw was found in Gitea. The internal API HTTP client is configured to skip Transport Layer Security (TLS) certificate verification, which is an insecure practice. A remote attacker on the same network segment could exploit this vulnerability to perform man-in-the-middle (MITM) attacks. This allows the attacker to intercept and potentially alter communications with the internal API, leading to unauthorized information disclosure or data manipulation. This is an Important Man-in-the-Middle attack vulnerability in Gitea's internal API client. This flaw, caused by hardcoded InsecureSkipVerify:true, allows an attacker on an adjacent network to intercept and potentially manipulate internal communications, compromising data integrity and confidentiality. Red Hat products do not use the affected modules/private/internal.go component. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-295. Affected Red Hat products: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-73515] Memory Disclosure and Denial of Service via Malformed FlatGeobuf Buffer
PostGIS before 3.7.0beta2 contains an out-of-bounds read vulnerability that allows attackers to cause memory disclosure or a server crash by supplying a malformed FlatGeobuf buffer. The FlatGeobuf property metadata decoder verifies that a string length field is present but fails to verify that the subsequent string body is contained within the supplied buffer before materializing it into a SQL-visible value, enabling memory disclosure or denial of service. A flaw was found in PostGIS. This can lead to sensitive information disclosure or a denial of service. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:65899, RHSA-2026:67166, RHSA-2026:67491, RHSA-2026:67848. Affected products named by the advisory: Red Hat package: postgresql16-postgis; Red Hat package: postgresql18-postgis.
High [CVE-2026-73556] Denial of Service via Regular Expression processing
vLLM is an inference and serving engine for large language models. Prior to 0.26.0, the structured_outputs.regex parameter in vllm/v1/structured_output/backend_lm_format_enforcer.py is passed to lmformatenforcer. RegexParser without compile_regex_with_timeout or validation in validate_structured_output_request_lm_format_enforcer, allowing an unauthenticated /v1/completions request against the lm-format-enforcer backend to consume a CPU core and stall the structured-output engine path with a catastrophic regular expression. This issue is fixed in version 0.26.0. An unauthenticated remote attacker can exploit a Regular Expression Denial of Service (ReDoS) vulnerability in the lm-format-enforcer backend. By submitting a specially crafted regular expression through the structured_outputs.regex parameter, the attacker can cause the system to consume excessive CPU resources. This leads to a denial of service, stalling the structured-output engine and preventing legitimate requests from being processed. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333. Affected products named by the advisory: Red Hat AI Inference Server 3.3; Red Hat AI Inference Server 3.4; Red Hat AI Inference Server 3.5; Red Hat Enterprise Linux AI 3.3; and 3 more.
High [CVE-2026-70452] rsync 3.1.0 < 3.5.0 Access Control Bypass via DNS Resolution Failure
rsync 3.1.0 before 3.5.0 contains an access control bypass vulnerability that allows remote attackers to circumvent hosts deny rules by inducing DNS resolution failures during hostname-based access control evaluation. When a DNS lookup for a hostname-based deny rule fails, the daemon skips the rule rather than defaulting to a deny decision, enabling attackers who can trigger DNS failures to bypass module-level IP access controls and gain unauthorized access to restricted module file trees. A flaw was found in rsync. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-636. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 6 as not affected. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70455] Denial of Service via Zstandard compression thread exhaustion
rsync 3.4.2 before 3.5.0 contains a denial of service vulnerability that allows a remote sender to exhaust system resources by specifying the --zt short alias for --compress-threads, which bypasses the refuse options directive's string matching on long option names. Attackers can specify --zt=N with a large value to spawn an unbounded number of Zstandard worker threads on the receiver, exhausting available thread and memory resources. By sending requests using the --zt Zstandard compression alias, an attacker can bypass security directives and spawn an excessive number of worker threads. RHEL 9 and older versions are unaffected. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 10. Red Hat fixing advisory: RHSA-2026:67463. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70456] Heap Out-of-Bounds Write via crafted argument list
rsync 3.0.1 before 3.5.0 contains an out-of-bounds write vulnerability in the read_args() function that allows a malicious sender to corrupt adjacent heap memory by sending a crafted argument list. When the argument count causes the argv allocation to be exactly full, the trailing NULL terminator is written one slot beyond the allocation boundary, corrupting adjacent heap memory. A flaw was found in rsync. This could lead to corruption of adjacent memory, potentially causing a denial of service or, in some cases, arbitrary code execution. This is an Important severity flaw in rsync, allowing a remote attacker to corrupt heap memory via a specially crafted argument list. The vulnerability, exploitable without authentication or user interaction, could lead to denial of service or potentially arbitrary code execution, elevating its impact beyond Moderate due to the remote, unauthenticated nature of the attack. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70458] Memory corruption via crafted file entries
rsync 3.0.0 before 3.5.0 contains an out-of-bounds write vulnerability that allows attackers to corrupt memory by triggering HLINK_BUMP processing on file entries with the FLAG_HLINKED flag set while the hard-link preservation option is inactive. Attackers can exploit the missing F_SUM field in the file_struct layout to access memory past the end of the allocated structure, corrupting adjacent heap or stack data. A flaw was found in rsync. This can lead to denial of service or other unpredictable system behavior. This Important out-of-bounds write vulnerability in rsync can lead to memory corruption when processing specially crafted file entries, potentially resulting in a denial of service. The flaw is triggered when hard-link preservation is inactive, allowing a remote attacker to exploit it without requiring user interaction or elevated privileges. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70460] rsync 2.3.3 < 3.5.0 Path Traversal via --partial-dir/--backup-dir Symlink
rsync 2.3.3 before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to escape the module root by exploiting symlinks within the module file tree when using --partial-dir or --backup-dir options. Attackers with write access to place a symlink under the module root, or who can exploit a pre-existing trusted symlink, can direct file writes to locations outside the intended module root, achieving arbitrary file write relative to the module root parent. A path traversal and symlink vulnerability in rsync allows a malicious sender with write access to write files outside the intended directory. By exploiting symbolic links in conjunction with the --partial-dir or --backup-dir options, an attacker can bypass path restrictions to modify arbitrary system files, compromising system integrity Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.
High [CVE-2026-70461] Information disclosure and denial of service via crafted files-from entry
rsync 3.2.5 before 3.5.0 contains a heap out-of-bounds write vulnerability that allows remote unauthenticated attackers to write one attacker-controlled byte past the end of a heap allocation by supplying a crafted files-from entry. Attackers can trigger the vulnerability against a read-only rsync daemon module by providing a files-from entry containing both an interior and trailing backslash, causing the add_implied_include() function to under-count the trailing backslash when sizing the destination buffer. A flaw was found in rsync. This can lead to information disclosure or denial of service. This can be exploited against read-only rsync daemon modules, making it a significant risk for publicly exposed rsync services. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 6 as not affected. Red Hat fixing advisory: RHSA-2026:67463, RHSA-2026:67462. Affected products named by the advisory: Red Hat package: rsync.