Red Hat Linux Security Advisories & CVEs
13569 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-73228] Django REST framework: Denial of Service via oversized request bodies
Django REST framework is a toolkit for building Web APIs. Prior to 3.17.2, Django REST Framework's request.data parsing in rest_framework/request.py Request._parse() passes the underlying HttpRequest stream to JSONParser and FormParser for application/json and application/x-www-form-urlencoded bodies, bypassing Django's DATA_UPLOAD_MAX_MEMORY_SIZE protection and allowing oversized request bodies to consume additional memory and CPU. This issue is fixed in version 3.17.2. This allows an attacker to send oversized JSON and URL-encoded request bodies, leading to excessive consumption of memory and CPU resources. This could result in a Denial of Service (DoS) for the affected application. This vulnerability is rated as having a Moderate impact because, while unauthenticated remote clients can submit large payloads to drive excessive processing and memory consumption, the flaw is confined to resource exhaustion without compromising system confidentiality or data integrity. In Red Hat environments, such as Ansible Automation Platform and Satellite, the vulnerable framework is embedded within backend services to handle API requests. The overall exposure is limited by standard deployment topologies, where services operate behind network boundaries or API gateways that restrict incoming traffic. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L).
Medium [CVE-2026-73216] Authenticated client can exhaust relay capacity via quota bypass
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, shutdown_client_connection() in src/server/ns_turn_server.c prematurely calls dec_quota() and releases bandwidth accounting during the first-stage close of a mobility-enabled allocation while preserving the allocation, relay socket, session, and mobility ticket, allowing an authenticated client to bypass --user-quota and --total-quota and exhaust relay ports. This issue is fixed in version 4.17.0. A flaw was found in coturn. This allows the client to bypass user and total quotas, leading to the exhaustion of relay ports and a Denial of Service (DoS) condition. Red Hat has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-911.
Medium [CVE-2026-73215] Denial of Service due to incorrect port allocation
Coturn is a free open source implementation of TURN and STUN Server. Prior to 4.17.0, turnports_allocate_even() in src/apps/relay/turn_ports.c marks the unused odd sibling port as TPS_TAKEN_ODD for an EVEN-PORT Allocate request with reservation bit R=0 even though no RTCP socket will release it, allowing an authenticated client to permanently exhaust the relay port pool and cause subsequent allocations to fail with STUN error 508. This issue is fixed in version 4.17.0. A flaw was found in Coturn. An authenticated client can exploit a vulnerability by sending a specially crafted 'EVEN-PORT Allocate request' with a reservation bit set to zero. This causes the server to incorrectly mark an unused port as taken, leading to the permanent exhaustion of the relay port pool. Consequently, new connection allocations will fail, resulting in a Denial of Service (DoS) for legitimate users. This Moderate impact flaw affects the community-maintained coturn TURN/STUN server as shipped in Fedora and EPEL. Red Hat does not ship coturn in any core Red Hat product. By sending a crafted port allocation request, an attacker can permanently exhaust the server's relay port pool, preventing new connections. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-772.
Medium [CVE-2026-72712] Denial of Service via zero-length TCP option packet
Nmap versions up to and including 7.99 contains a denial of service vulnerability that allows remote attackers to crash the application by sending a crafted packet containing a zero-length TCP option. The malformed packet forces the Packet:parse_options() function in nselib/packet.lua to allocate objects in an infinite loop, causing an out-of-memory condition that results in application crash. A flaw was found in Nmap. A remote attacker can exploit this denial of service vulnerability by sending a specially crafted packet that includes a zero-length Transmission Control Protocol (TCP) option. This malformed packet forces the application to enter an infinite loop during packet processing, consuming excessive memory and ultimately causing the Nmap application to crash. The impact is limited to the availability of the Nmap process itself, typically affecting active network scanning operations rather than persistent services. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-835. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-62902] .NET: Information Disclosure Vulnerability
Inclusion of functionality from untrusted control sphere in.NET allows an unauthorized attacker to disclose information over a network. A flaw was found in.NET. The issue arises from the inclusion of functionality from an untrusted control sphere, which can be exploited to reveal data. Red Hat has determined that shipped versions of.NET in Red Hat products already include the fix for this vulnerability. The.NET 8.0 (8.0.30), 9.0 (9.0.19), and 10.0 (10.0.11) runtime fix versions are included in current Red Hat packages. Furthermore, the upstream advisory identifies only Microsoft. WindowsDesktop. App.Runtime (Windows Desktop) packages as vulnerable — a component not present in Red Hat's Linux.NET builds. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-829. Affected Red Hat products: Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:44914, RHSA-2026:55405.
Medium [CVE-2026-32791] Escalation of Privilege via Untrusted Search Path
Untrusted search path for some Intel(R) Performance Counter Monitor (Intel(R) PCM) before version tag 202604 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. An unprivileged, authenticated local attacker could exploit an untrusted search path vulnerability. This could lead to an escalation of privilege, allowing the attacker to gain higher access rights. Due to improper path resolution, an authenticated local attacker with low privileges can place a malicious shared library or executable binary in a directory searched by PCM applications. When a privileged user or service executes PCM, it loads the attacker's binary, leading to local privilege escalation and full compromise of system confidentiality, integrity, and availability. Red Hat severity: Moderate — CVSS 6.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H).
Medium [CVE-2025-31936] Privilege escalation via improper memory range handling in SMM
Improper handling of overlap between protected memory ranges for some Intel(R) Xeon(R) 6 processors when using Intel(R) TDX within SMM may allow an escalation of privilege. SMM adversary with a privileged user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present with special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (none) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Improper handling of overlap between protected memory ranges may allow a local attacker with privileged user access to escalate privileges. This Important privilege escalation flaw affects Intel Xeon 6 Processors when Intel TDX is enabled, allowing a privileged local attacker to escalate privileges within the System Management Mode (SMM). Exploitation requires a high complexity attack and specific internal knowledge, impacting the confidentiality and integrity of the system. Red Hat severity: Moderate — CVSS 5.7 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-823.
Medium [CVE-2026-21399] Intel Open Volume Kernel Library: Intel Open Volume Kernel Library: Denial of Service via heap-based buffer overflow
Heap-based buffer overflow for the Intel(R) Open Volume Kernel Library (Intel(R) Open VKL) library maintained by intel(R) before version 2.0.2 within Ring 3: User Applications may allow a denial of service. System software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. This attack has low complexity and requires no user interaction, primarily impacting the availability of the system. Due to improper bounds checking during volume processing, an authenticated local attacker with low privileges can pass malformed volumetric data to an application using the Open VKL API. This triggers a heap memory write beyond allocated boundaries, leading to application instability, localized data integrity degradation, or a localized denial of service via process crashes. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-120.
Medium [CVE-2026-20908] Intel NPU Driver for Windows: Denial of Service via time-of-check time-of-use race condition
Time-of-check time-of-use race condition for the Intel(R) NPU Driver for Windows for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. This time-of-check time-of-use (TOCTOU) race condition vulnerability allows an unprivileged, authenticated local attacker to cause a denial of service. The attack has high complexity and requires no user interaction. This CVE affects the Intel NPU Driver for Windows, which is a separate proprietary codebase from the Linux NPU driver (linux-npu-driver). Red Hat ships the Linux NPU driver in Fedora and EPEL, which uses the Linux DRM kernel subsystem and does not contain the Windows Ring 1 driver code where this TOCTOU race condition exists. Therefore, no Red Hat products or community builds are affected. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H).
Medium [CVE-2026-20786] Denial of service via out-of-bounds read
Out-of-bounds read for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. This vulnerability, an out-of-bounds read, could allow a local attacker with low privileges to cause a denial of service (DoS). A denial of service means the system or application becomes unavailable to legitimate users. The flaw can be exploited by an unprivileged, authenticated user through local access without requiring user interaction or special knowledge. Successful exploitation primarily impacts the availability of the system, making it unresponsive or unusable. Red Hat products are not affected by this vulnerability as they do not ship the Intel NPU Driver. Community packages in Fedora and EPEL are tracked separately. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-125.
Medium [CVE-2026-20783] Denial of Service via improper conditions check
Improper conditions check in the firmware for the Intel(R) NPU Driver for all versions within Ring 1: Device Drivers may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. An unprivileged attacker with authenticated user access can exploit this vulnerability locally with low complexity and no user interaction. This can lead to a denial of service, severely impacting the availability of the system. Red Hat products are not affected by this vulnerability as they do not ship the Intel NPU Driver. Community packages in Fedora and EPEL are tracked separately. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-606.
Medium [CVE-2026-20769] Denial of Service via improper conditions check
Improper conditions check for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. An unprivileged software adversary with an authenticated user can exploit an improper conditions check. This vulnerability, requiring local access and no user interaction, may lead to a denial of service on the affected system. Red Hat products are not affected by this vulnerability as they do not ship the Intel NPU Driver. Community packages in Fedora and EPEL are tracked separately. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-606.
Medium [CVE-2026-20731] Denial of Service via Improper Buffer Restrictions
Improper buffer restrictions for the Intel(R) NPU Driver for all versions within Ring 3: User Applications may allow a denial of service. Unprivileged software adversary with an authenticated user combined with a low complexity attack may enable denial of service. This result may potentially occur via local access when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (low) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Due to improper buffer restrictions, an unprivileged local attacker with authenticated user access could exploit this vulnerability. This could lead to a denial of service (DoS) condition, impacting the availability of the system. Red Hat products are not affected by this vulnerability as they do not ship the Intel NPU Driver. Community packages in Fedora and EPEL are tracked separately. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H). Weakness: CWE-131.
Medium [CVE-2026-73075] Out-of-bounds Access in Popup Opacity Handling
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843. This vulnerability involves an out-of-bounds memory access within the popup opacity handling feature. A local attacker could exploit this by using specially crafted Vim script, leading to an out-of-bounds read and a limited out-of-bounds write. While the editor is expected to continue functioning, this could potentially result in unexpected behavior or information disclosure. Exploitation requires a local attacker to execute specially crafted Vim script that utilizes specific popup window features, making user interaction a prerequisite. The impact is typically limited to an out-of-bounds read and a constrained write, which may lead to unexpected behavior but is not expected to result in immediate system compromise or arbitrary code execution. None of the Red Hat products ship this vulnerable code. Hence, are not affected. Red Hat severity: Moderate — CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L). Weakness: CWE-125.
Medium [CVE-2026-73074] Heap buffer overflow via integer wraparound in text property handling
Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841. An integer overflow in Vim's prop_add_one() function allows a local attacker to cause a denial of service or potentially execute arbitrary code by adding an excessive number of text properties to a single line. This Moderate impact vulnerability in Vim's text property handling can lead to a heap buffer overflow. Exploitation requires a local attacker to provide specially crafted input, such as a malicious file or Vim script, that causes an integer wraparound. This scenario is not expected during normal use of the editor. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H). Weakness: CWE-190. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 as not affected.
Medium [CVE-2026-19078] Open redirect vulnerability enables phishing via unvalidated parameter.
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website. This could enable phishing attacks, potentially tricking users into revealing sensitive information. Red Hat has determined that this vulnerability is Low severity. The open redirect in the OAuth server's grant handler enables phishing by redirecting users to attacker-controlled origins after the consent prompt, but does not expose OAuth tokens, authorization codes, or session credentials. The authorization code is issued separately to the client's registered redirect_uri. Weakness: CWE-601. Affected Red Hat products: Red Hat OpenShift Container Platform 4. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-14180] Undertow:HTTP request smuggling via oversized chunk-size bit overlap
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that exploitation requires a frontend proxy to forward oversized, non-standard chunk-size values to the backend Undertow server. Successful exploitation allows an attacker to perform HTTP request smuggling, leading to request desynchronization. The vulnerability's root cause is an internal bitmask overlap in the ChunkReader state management logic where large chunk-size values collide with internal parser flags. Weakness: CWE-444.
Medium [CVE-2026-73070] Stack Buffer Overflow via unbounded socket connections
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. A flaw was found in Vim. This can lead to a denial of service (DoS) for the Vim server. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Hardened Images; Red Hat OpenShift Container Platform 4. Under investigation: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:56636.
Medium [CVE-2026-71193] cross-tenant DNS zone overlap via pool-scoped ownership checks when using AttributeFilter scheduler
In OpenStack Designate before 22.0.1, zone creation checks (_is_subzone, _is_superzone, and the duplicate-zone DB constraint) are scoped to the target pool only. An authenticated user can bypass these checks by scheduling a zone to a different pool via the AttributeFilter scheduler, creating an overlapping zone that conflicts with another tenant's zone. This enables cross-tenant DNS hijack (redirecting traffic to attacker-controlled IPs) and DNS denial of service (NODATA responses). Exploitation requires a multi-pool deployment with AttributeFilter enabled in scheduler_filters, which is a non-default but documented and supported configuration for self-service tiering. The database uniqueness constraint on zone names is pool-scoped, and the subzone/superzone ownership checks in the Central service include pool_id in their query criteria, making them pool-scoped rather than global. This allows a tenant to create zones that overlap with another tenant's zones in a different pool, bypassing cross-tenant namespace isolation. Successful exploitation could lead to cross-tenant DNS zone overlap and subzone ownership bypass. Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions. Multipool deployments using the AttributeFilter scheduler were never a fully supported configuration in any RHOSP version.
Medium [CVE-2026-71194] mDNS NOTIFY handler DoS via pool-blind zone lookup
In OpenStack Designate before 22.0.2, the mDNS handler performs pool-blind lookups when resolving record queries and NOTIFY requests. When two zones with the same name exist across different pools, the lookup fails with a deterministic error, causing the handler to return REFUSED for all DNS queries through that path. The _handle_notify path is exploitable via a single unauthenticated UDP packet. This is independently reachable through the cross-tenant zone overlap described in a different recent CVE, and also affects legitimate same-tenant cross-pool configurations. BIND9 views do not mitigate this issue as mDNS is a shared service upstream of any view configuration. The _handle_notify method performs zone lookups without pool_id scoping, unlike the QUERY and AXFR handlers which were previously updated to be pool-aware. When zones with the same name exist across different DNS pools, the storage layer finds multiple matches and raises a NotFound exception, causing all NOTIFY processing for the affected zone name to fail. This results in denial of service for DNS zone transfer notifications, causing stale zone data on secondary DNS servers. The mDNS NOTIFY path is reachable via unauthenticated UDP on port 5354. Red Hat OpenStack Platform (RHOSP) ships Designate across multiple versions.