Red Hat Linux Security Advisories & CVEs
13569 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-19484] Denial of Service via oversized multipart boundary
@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1. This can cause the Node.js event loop to stall, leading to a CPU-bound loop that consumes significant processing resources. Red Hat products that include @fastify/busboy are not affected by this vulnerability. CVE-2026-19484 is present only in @fastify/busboy versions 3.1.0 through 3.2.0. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606. Red Hat lists OpenShift Pipelines; Red Hat AMQ Broker 7; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4 as not affected.
High [CVE-2026-19481] Denial of Service from crafted form-data headers
@fastify/busboy is a multipart form-data parser. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1. A remote attacker can exploit this vulnerability by sending specially crafted multipart form-data headers. This can cause a TypeError in the parser, leading to the termination of the Node.js process and resulting in an unauthenticated Denial of Service (DoS). The unauthenticated nature and potential for service disruption elevate the impact to Important. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-915. Affected Red Hat products: OpenShift Pipelines; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat OpenShift AI (RHOAI). Red Hat lists Red Hat AMQ Broker 7; Red Hat OpenShift Container Platform 4 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
High [CVE-2026-67986] Arbitrary code execution via Ruby code injection in AwesomeMethodArray#grep
amazing-print/amazing_print at commit dc890dfafdf07088ea901df53c19c2710e5c5234 contains a Ruby code injection condition in AwesomeMethodArray#grep. A specially named method containing Ruby interpolation syntax can be interpolated into a dynamically constructed eval string when grep is called with a block, resulting in Ruby code execution in the host process. Exploitation requires an application path that allows an attacker to influence dynamic method names. A flaw was found in amazing_print. This vulnerability allows an attacker to inject and execute arbitrary Ruby code within the host process. Red Hat Satellite includes the rubygem-amazing_print package as a dependency of the hammer CLI tool. While the vulnerable code exists in the shipped version, the specific code path that enables exploitation — calling grep with a block on method arrays — is not used by Satellite or any of its components. The gem is used solely for debug-level object formatting. As a result, this vulnerability is not exploitable in Red Hat Satellite as shipped. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-94. Red Hat lists Red Hat Satellite 6 as not affected.
High [CVE-2026-68453] Fix buffer over-read in cca_cipher2protkey
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Fix buffer over-read in cca_cipher2protkey Add validation of both the actual key buffer size and token length fields in all the cca_check_sec*token() functions. Additionally check in cca_gencipherkey() for possible underflow with returned key size. The CCA token structures contain user-controlled len fields that were used in operations without proper validation against both the actual buffer size and minimum token structure size. An attacker could set this field larger than the actual buffer size, leading to reading beyond buffer boundaries. This may result in a kernel crash or exposure of memory via sending this as part of a request down to the crypto card. Also an attacker could have used a very small len value and thus enforce a buffer under-run which may produce similar effects as a over-read. So now a key must - key buf length must be at least sizeof the token struct - the key len field inside the token must fit into the range of sizeof key token struct... key buf length This vulnerability arises from insufficient validation of user-controlled length fields within the Common Cryptographic Architecture (CCA) token structures. This could lead to a kernel crash, resulting in a denial of service, or the exposure of sensitive memory information.
High [CVE-2026-68452] Validate length for CCA AES cipher key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA AES cipher key requests cca_cipher2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block. A local attacker could exploit this by providing a specially crafted key token, which may lead to a buffer overflow. This could result in a denial of service, making the system unavailable. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-68451] Validate length for CCA ECC private key requests
In the Linux kernel, the following vulnerability has been resolved: s390/zcrypt: Validate length for CCA ECC private key requests cca_ecc2protkey() derives the copy length for the CPRB parameter block directly from the length field in the key token. Reject the request early if the token length exceeds the available space in the parameter block. The `cca_ecc2protkey()` function, responsible for handling Common Cryptographic Architecture (CCA) Elliptic Curve Cryptography (ECC) private key requests, does not properly validate the length of the key token. This allows a local attacker to provide a malformed key token, potentially leading to memory corruption and a denial of service. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-805. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-73416] Extension blocklist bypass via weak package-name canonicalization
jupyterlab is an extensible environment for interactive and reproducible computing, based on the Jupyter Notebook Architecture. From 4.5.0 until 4.5.10 and 4.6.2, in jupyterlab/extensions/manager.py and jupyterlab/extensions/pypi.py, JupyterLab's PyPI extension manager enforces blocked_extensions_uris by comparing requested install names to blocklist entries with custom normalization that is weaker than PyPI package-name canonicalization. An authenticated user can request a PyPI-equivalent spelling such as JupyterLab.Git for a blocklisted package such as jupyterlab-git, and JupyterLab accepts the install request even though pip resolves the variant to the same package. Security impact requires an allowlist or blocklist intended to restrict package installation, the PyPI Extension Manager, and kernels and terminals that are disabled or delegated to remote hosts. The bypass lets an authenticated user install a prohibited extension, defeat integrity restrictions, and affect availability without gaining new read access. This issue is fixed in versions 4.5.10 and 4.6.2. A flaw was found in jupyterlab. The PyPI (Python Package Index) extension manager uses a custom normalization process for package names that is weaker than the official PyPI canonicalization. Affected products named by the advisory: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-73428] Stored Cross-Site Scripting via HTML paste allows arbitrary code execution.
Trix is a what-you-see-is-what-you-get rich text editor for everyday writing. Prior to 2.1.18, Trix is vulnerable to stored cross-site scripting when crafted HTML is pasted into the editor. HTMLParser processes a mock attachment in a `` with an empty `data-trix-attachment="{}"` value, causing data-trix-attributes to be applied to a plain string piece. StringPiece.fromJSON accepts an unvalidated href, allowing a javascript: URI to enter the document model and serialized HTML and execute when another user renders and clicks the content. Applications that apply server-side HTML sanitization can neutralize the payload on save. This issue is fixed in version 2.1.18. This allows a malicious javascript: Uniform Resource Identifier (URI) to be embedded, which can then execute arbitrary code in the victim's browser when another user renders and clicks the content. No Red Hat products ship a vulnerable version of this component. Red Hat severity: Moderate — CVSS 4.6 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N). Weakness: CWE-79.
Medium [CVE-2026-73479] Terminal escape sequence injection via unfiltered marked file paths
dua-cli fails to filter terminal escape sequences when printing marked file paths after exiting the TUI interface. Attackers can craft file names containing OSC/CSI escape sequences that are interpreted by the terminal emulator when printed, enabling title spoofing, clipboard manipulation, or other escape-sequence attacks. A terminal escape sequence injection flaw was found in dua-cli. Red Hat rates this as Moderate: exploitation is local, requires the victim to run dua-cli interactively on attacker-influenced content and to mark the malicious file, and the impact is limited to the terminal emulator rather than the application or host. Red Hat Enterprise Linux does not ship dua-cli; the package is present only in Fedora and EPEL (rust-dua-cli), which are addressed through the community update process. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-117.
Medium [CVE-2026-73480] Terminal Injection via Unstripped Escape Sequences
gdu fails to strip terminal escape sequences from directory and file names when printing paths after TUI exit. Attackers can craft malicious directory or file names containing escape sequences that are interpreted by the terminal, enabling title spoofing, clipboard manipulation, or other terminal-dependent effects. A flaw was found in gdu, a disk usage analyzer. Red Hat products are not affected by this vulnerability as gdu is not shipped in any Red Hat product. Community packages in Fedora and EPEL are affected. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-838.
Medium [CVE-2026-72647] Denial of Service via uncontrolled recursion in search requests
Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An authenticated user holding only read privileges on a single index can submit one specially crafted search request whose deeply nested structure is processed without a depth limit, exhausting the thread stack and terminating the affected node. A flaw was found in Elasticsearch. This request, containing deeply nested serialized data, is processed without a depth limit, leading to uncontrolled recursion. This flaw has a Moderate impact. A remote, authenticated attacker with read-level index access can send a specially crafted search request that exhausts the thread stack and terminates the affected Elasticsearch node, resulting in denial of service. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606. Affected Red Hat products: Red Hat OpenShift AI (RHOAI). Red Hat lists Red Hat Quay 3 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-72656] Denial of Service via excessive memory allocation in ES|QL queries
Memory Allocation with Excessive Size Value (CWE-789) in the ES|QL query processing of Elasticsearch can lead to denial of service via Excessive Allocation (CAPEC-130). An authenticated user able to submit ES|QL queries could send a specially crafted query whose evaluation allocates an unbounded amount of heap memory, exhausting the available heap on the receiving node and causing the node to become unavailable. A flaw was found in Elasticsearch. This excessive memory consumption exhausts the available resources on the receiving node, leading to a denial of service (DoS) condition where the node becomes unavailable. When evaluating a specially crafted ES|QL query, the engine fails to enforce upper bounds on memory allocation requests, triggering unbounded heap consumption. An authenticated remote attacker can exploit this issue by submitting malformed queries to exhaust the receiving node's heap memory, causing node instability or service crashes, posing an Important impact to availability. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-789.
Medium [CVE-2026-72678] Denial of Service via excessive memory allocation
Elasticsearch does not validate a size value taken from a user-supplied input before that value is used to reserve memory for an internal data structure. An authenticated user holding only read privileges can submit a single small crafted request to a product API endpoint that causes the node to attempt an excessively large allocation. The resulting memory exhaustion raises a fatal error that terminates the Elasticsearch node process, causing a denial of service for the affected node and degrading cluster health. The defect is not volumetric, so a single request is sufficient regardless of the heap size configured on the target node. A flaw was found in Elasticsearch. An unvalidated allocation flaw exists in Elasticsearch's API request processing mechanisms. When handling user-supplied size parameters during data structure initialization, Elasticsearch fails to bound memory allocation requests. This results in service disruption and degraded cluster health, posing a high impact to availability. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
Medium [CVE-2026-73651] Arbitrary code execution via template literal code injection
TypeORM is a TypeScript and JavaScript ORM for Node.js that supports PostgreSQL, MySQL, MariaDB, SQLite, SQL Server, Oracle, and other databases. Prior to versions 0.3.31 and 1.1.0, typeorm migration:generate embeds database schema metadata into JavaScript or TypeScript template literals in src/commands/MigrationGenerateCommand.ts, escaping backticks but not ${...} interpolation. An attacker with database schema write access can place a payload in column COMMENT or DEFAULT metadata, or another introspected schema string, and the JavaScript engine evaluates the payload when the generated migration is loaded through migration:run, import, or require. This issue is fixed in versions 0.3.31 and 1.1.0. A flaw was found in TypeORM. This process incorrectly escapes backticks but fails to escape interpolation, creating a vulnerability. TypeORM's migration:generate command builds JavaScript or TypeScript migration files by embedding database schema metadata, such as column comments and default values, into template literals. This issue is rated Moderate. Exploitation requires an attacker to already have elevated, direct write access to the affected database schema, a condition not exposed through any Red Hat product's normal user-facing interfaces, and requires an administrator to subsequently run migration:generate against that compromised schema and load the resulting file.
Medium [CVE-2026-73648] Cross-Site Scripting vulnerability due to improper SVG sanitization
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. From 1.0.3 until 1.7.1, Rails::HTML::PermitScrubber restricted SVG reference elements in SVG_ALLOW_LOCAL_HREF only when they used xlink:href, even though browsers also accept the plain href attribute. Applications with non-default allowed tags that included SVG use or feImage elements could therefore permit external references; a same-origin external SVG referenced by use could execute scripts in the sanitized document's context, while feImage could load external images for tracking. This issue is fixed in version 1.7.1. This vulnerability allows a remote attacker to perform Cross-Site Scripting (XSS) by exploiting improper sanitization of SVG (Scalable Vector Graphics) reference elements. Exploitation requires that the application has overridden the sanitizer's default allowed tags to include SVG reference elements such as use or feImage. Red Hat rates this Moderate. Weakness: CWE-79. Affected Red Hat products: Red Hat 3scale API Management Platform 2; Red Hat Satellite 6. Red Hat lists Red Hat Satellite 6 as not affected. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-19730] Quadlet install --replace non-truncating write retains removed host-access directives
The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no warning. There is no risk of information leakage as the user already had access to the Quadlet in order to replace it, and in most cases, this would only lead to invalid Quadlet files. However, security-related options from the end of the old Quadlet could be included in the new Quadlet, and if the truncation resulted in a valid Quadlet file, this could result in undesirable behavior. For example, running podman quadlet install --replace to remove a single line from the end of a Quadlet - including security-sensitive content, like AddCapability - will fail, and the option will continue to be used. Further, with Volume Quadlets, this can include additional mounts which can cause content to be unintentionally exposed into containers. If, later, the image is updated then compromised content might be leaked to an attacker.
Medium [CVE-2026-73565] @hono/node-server: @hono/node-server: Denial of Service via aborted WebSocket handshake
@hono/node-server allows running the Hono application on Node.js. From 2.0.0 until 2.0.10, a WebSocket upgrade request to an upgradeWebSocket route with a missing or malformed Sec-WebSocket-Key header causes src/websocket.ts to retain the request's IncomingMessage in waiterMap and leave waitForWebSocket pending because ws.handleUpgrade emits no connection event. The aborted handshake therefore has no cleanup path, allowing an unauthenticated attacker to flood a public route, cause unbounded memory growth, and eventually make the service unavailable. This issue is fixed in version 2.0.10. This action causes the server to retain request data, leading to unbounded memory growth and eventually a Denial of Service (DoS), making the service unavailable. An unauthenticated attacker can trigger a denial of service by sending malformed WebSocket upgrade requests, leading to unbounded memory growth. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-459. Red Hat lists Migration Toolkit for Applications 8; Red Hat Ansible Automation Platform 2; Red Hat Developer Hub; Red Hat Hardened Images; Red Hat OpenShift Dev Spaces as not affected.
Medium [CVE-2026-73563] @backstage/plugin-auth-backend: Backstage: Unauthenticated OAuth account takeover via `redirect_uri` allowlist bypass
Backstage is an open framework for building developer portals. Prior to 0.29.2, the experimental dynamic client registration and client ID metadata document features in the @backstage/plugin-auth-backend use full-string matcher.isMatch glob matching for auth.experimentalDynamicClientRegistration.allowedRedirectUriPatterns and the auth.experimentalClientIdMetadataDocuments allowedClientIdPatterns and allowedRedirectUriPatterns options. A hostname wildcard can match across URL component boundaries, allowing an attacker-controlled redirect URI with a trusted hostname suffix in its path to pass the allowlist and receive an OAuth authorization code after a victim completes the flow. Patterns without an explicit protocol can match unintended protocols, and redirect URIs containing embedded credentials are accepted after user information is stripped for matching. The features are experimental and disabled by default; only deployments that enable them and configure custom wildcard-hostname or protocol-less patterns are affected. This issue is first fixed in prerelease version 0.29.2. This vulnerability allows an unauthenticated remote attacker to bypass the `redirect_uri` allowlist in the experimental dynamic client registration feature. Affected products named by the advisory: Red Hat Ansible Automation Platform 2.1; Red Hat Ansible Automation Platform 2.2.
Medium [CVE-2026-58438] Unauthorized tampering and commenting on private repositories via insecure direct object reference
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access A flaw was found in Gitea. This vulnerability, identified as an Insecure Direct Object Reference (IDOR), exists within the issue-dependency removal function. A remote attacker with write access to issues in one repository can exploit this flaw to remove a dependency link to an issue in a private repository they are not authorized to access. This allows the attacker to tamper with issue-tracking states and inject comments into private repositories, leading to unauthorized write operations across private repository boundaries. Due to insufficient authorization checks, a remote user with issue-write access in one repository can manipulate dependency relations pointing to an issue in a separate, restricted private repository. An attacker can exploit this IDOR flaw by targeting known issue IDs to remove dependency links and inject unauthorized system comments into private repositories beyond their permitted access scope, compromising cross-repository data integrity. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-639. Affected Red Hat products: OpenShift Pipelines. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-58428] Attachment allowlist bypass via web release edit form
Release attachment extension allowlist bypass via web release edit form (variant of CVE-2025-68939) A flaw was found in Gitea. This vulnerability allows the attacker to rename existing release attachments to forbidden file extensions, potentially leading to the distribution of malicious files or stored Cross-Site Scripting (XSS) attacks. The vulnerability, a Moderate attachment allowlist bypass in Gitea, allows an authenticated attacker to upload files with forbidden extensions by manipulating the web release edit form. However, Red Hat products are not affected by this flaw as the vulnerable code from routers/web/repo/release.go is not present in shipped components. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-434. Red Hat lists OpenShift Pipelines as not affected.