Red Hat Linux Security Advisories & CVEs
13625 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-43627] Arbitrary Code Execution via Integer Overflow in Memory Allocation
llama.cpp builds b1283 through b9058 contain an integer overflow vulnerability in the llama_batch_init() function where unchecked multiplications in malloc() calls can wrap past INT32_MAX when computing allocation sizes. Attackers can pass specially crafted parameters to trigger integer overflow, causing heap corruption and potentially achieving arbitrary code execution through subsequent batch operations that write past allocated buffer boundaries. Exploitation requires convincing a user or local process to execute inference workloads using maliciously oversized batch sizing parameters, leading to an arithmetic overflow during memory allocation and subsequent heap corruption. Full impact across Confidentiality, Integrity, and Availability (C:H, I:H, A:H) is possible if local memory execution controls fail, potentially resulting in arbitrary code execution within the application context. Deployments operating strictly with validated, bounded batch size inputs or running non-interactive server pipelines where batch parameters are hard-coded or strictly validated are unaffected. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-805. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3. Will not fix / out of support: Red Hat Enterprise Linux AI (RHEL AI) 3.
High [CVE-2026-7867] Local Privilege Escalation via as-user option spoofing
Local Privilege Escalation via as-user option spoofing. Red Hat rates this important (CVSS 7.8). Weakness: CWE-863. Red Hat lists fixing advisory RHSA-2026:53435 with package udisks2-0:2.11.0-2.el10_2.1. Affected product named by the advisory: Red Hat Enterprise Linux 10. Affected product named by the advisory: Red Hat Enterprise Linux 10.0 Extended Update Support.
High [CVE-2026-18427] @fastify/static: @fastify/static: Information disclosure via route guard bypass
@fastify/static: @fastify/static: Information disclosure via route guard bypass. Red Hat rates this important (CVSS 7.5). Weakness: CWE-41. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-34191] SQL Injection via apr_dbd_oracle
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. This vulnerability, known as SQL Injection, occurs in the `apr_dbd_oracle` provider. A remote attacker could exploit this by injecting malicious SQL commands, potentially leading to unauthorized access, modification, or deletion of data within the database. Red Hat products are not affected by this flaw. The vulnerability is specific to the apr_dbd_oracle database driver module in the Apache Portable Runtime Utility (apr-util), which provides Oracle database connectivity. Red Hat does not build apr-util with Oracle database support enabled, so the vulnerable code is not present in any shipped Red Hat package. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-89. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images as not affected.
High [CVE-2026-34501] Heap buffer overflow in redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. Users are recommended to upgrade to version 1.6.4, which fixes the issue. A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service. The impact of this vulnerability is rated as Moderate. Although the flaw involves a heap buffer overflow and the CVSS base score reflects an unauthenticated network vector, exploitation requires the attacker to control or compromise the Redis server that the application queries. An attacker cannot trigger this condition by sending data directly to the affected application — they must first be in a position to influence Redis responses, either by compromising the Redis backend or performing a man-in-the-middle attack on the connection. Additionally, the overflow does not result in arbitrary code execution; the observed impact is limited to a denial of service. This prerequisite significantly limits real-world exploitability. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
High [CVE-2026-34502] Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3. A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of service. The impact of this vulnerability is rated as Moderate. While the flaw is network-reachable and requires no authentication against the application itself, exploitation depends on the attacker controlling or compromising the memcached server that the application queries. An attacker cannot trigger the denial of service by sending data directly to the affected application — they must first be in a position to influence memcached responses, either by compromising the memcached backend or performing a man-in-the-middle attack on the connection between the application and memcached. This prerequisite significantly limits the real-world exploitability compared to a direct network denial-of-service attack. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
High [CVE-2026-46581] com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include
com.sun.faces:jsf-impl: org.glassfish:jakarta.faces: mojarra: Unauthenticated RCE in EAP JSF applications via EL injection in ui:include. Red Hat rates this important (CVSS 8.1). Weakness: CWE-94. Red Hat lists fixing advisory RHSA-2026:53806 with package eap7-ironjacamar-0:1.5.26-2.Final_redhat_00001.1.el7eap, eap7-undertow-0:2.2.40-2.SP3_redhat_00001.1.el7eap, eap7-wildfly-0:7.4.25-2.GA_redhat_00001.1.el7eap, eap7-netty-0:4.1.135-1.Final_redhat_00001.1.el7eap. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-68480] Safe RET Interrupt Vulnerability
Safe RET Interrupt Vulnerability. Red Hat rates this important (CVSS 8.8). Weakness: CWE-201. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-63687] Security bypass due to improper handling of authorization parameters
Apache CXF's JwtRequestCodeFilter copies all claims from a signed request JWT into the authorization parameter map without excluding security-sensitive parameters. A client that can produce a validly-signed request JWT (e.g., one whose client_secret is known or compromised) can thereby substitute the code_challenge, code_challenge_method, nonce, and state values that were set in the outer HTTP request, undermining PKCE integrity and OpenID Connect replay protection. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. This vulnerability allows an attacker, who has compromised a client's secret, to bypass critical security protections in the authorization process. By injecting malicious values for parameters like code_challenge and nonce, the attacker can undermine the integrity of Proof Key for Code Exchange (PKCE) and OpenID Connect replay protection, potentially leading to unauthorized access or session hijacking. This could lead to unauthorized access or session hijacking in applications utilizing affected Red Hat middleware products that rely on these security mechanisms. Red Hat severity: Important — CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N). Weakness: CWE-807.
High [CVE-2026-66909] Remote Code Execution via unsafe deserialization of JMS ObjectMessage
Apache CXF's JMS transport deserializes the body of any inbound JMS ObjectMessage using native Java deserialization, with no type restrictions in place. Any attacker able to place a message on the service's JMS destination can submit a malicious serialized object, leading to denial of service or, if a suitable gadget class is on the classpath, remote code execution. The fix disables ObjectMessage deserialization by default, with a configuration switch to re-enable it if needed. Users are recommended to upgrade to versions 4.2.3 or 4.1.8 or 3.6.12, which fix this issue. The Java Message Service (JMS) transport component improperly deserializes inbound JMS ObjectMessages without type restrictions. This vulnerability could lead to a denial of service or, in certain configurations, enable remote code execution on the affected system. This vulnerability in Apache CXF's JMS transport is rated as Important because it allows for remote code execution or denial of service if an attacker can send a specially crafted JMS ObjectMessage to a service. This is particularly relevant in Red Hat environments where Apache CXF is used in applications that process JMS messages, as the default deserialization behavior without type restrictions increases the attack surface. Red Hat severity: Important — CVSS 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-502.
High [CVE-2026-18649] unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders
unbounded memory growth in rtph264depay and rtph265depay RTP depayloaders. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:53451 with package gstreamer1-plugins-good-0:1.26.7-2.el10_2.3, gstreamer1-plugins-good-0:1.22.12-7.el9_8.2, gstreamer1-plugins-good-0:1.16.1-7.el8_10.3. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8. Affected products named by the advisory: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; and 7 more.
High [CVE-2026-64597] fix double-free in SMB2_close replay
In the Linux kernel, the following vulnerability has been resolved: smb: client: fix double-free in SMB2_close() replay A response-bearing attempt can return a replayable error and free its response buffer. If SMB2_close_init() fails before the next send, cleanup retains the previous buffer type and frees that response again. Reset response bookkeeping before each attempt to prevent the stale free. This double-free condition can lead to memory corruption, potentially resulting in a denial of service or the execution of arbitrary code. Exploitation requires the victim system to connect to a malicious or compromised SMB server. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-415. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:64775, RHSA-2026:66180. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-71498] Information disclosure via out-of-bounds read with malformed UTF-8 input
Information disclosure via out-of-bounds read with malformed UTF-8 input. Red Hat rates this moderate (CVSS 5.1). Weakness: CWE-125.
Medium [CVE-2026-70631] Information disclosure via uninitialized heap memory read in TIFF decoder
FFmpeg versions from 0.5 up to, but not including, 9.0 contain an uninitialized heap memory disclosure vulnerability in the native TIFF decoder in libavcodec/tiff.c. An attacker who can cause FFmpeg to decode a crafted TIFF file can supply a valid Deflate-compressed strip that terminates successfully after producing fewer bytes than the declared strip requires. The tiff_unpack_zlib() function allocates a heap buffer sized for the full declared strip but copies all declared rows via memcpy() regardless of how many bytes zlib actually decompressed, causing unwritten bytes that can contain stale data from prior heap allocations to be incorporated into decoded image output and potentially exposing sensitive data in persistent services. A flaw was found in FFmpeg. An attacker can exploit an uninitialized heap memory disclosure vulnerability in the native TIFF decoder by providing a specially crafted TIFF file. When decoding a crafted TIFF file containing an undersized Deflate-compressed strip, tiff_unpack_zlib() fails to verify actual decompressed output length before executing frame-buffer memcpy() operations. This incorporates uninitialized stale heap memory from prior allocations into the rendered image stream. Affected products named by the advisory: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-70630] Information disclosure via uninitialized heap memory read in Screenpresso decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native Screenpresso decoder (libavcodec/screenpresso.c) that allows attackers to recover sensitive memory contents by supplying a crafted SPV1 packet with a valid zlib stream that decompresses fewer bytes than the full frame requires. The screenpresso_decode_frame() function fails to validate the produced byte count before calling av_image_copy_plane() to copy the complete frame dimensions from the persistent ctx->inflated_buf buffer, causing unwritten heap memory from prior allocations or prior frames to be copied into decoded output and potentially exposing sensitive data such as userspace addresses from persistent decoding services. A flaw was found in FFmpeg. This occurs when a crafted SPV1 packet with a valid zlib stream is supplied, causing the screenpresso_decode_frame() function to fail in validating the produced byte count. When decoding a crafted SPV1 packet containing a truncated zlib stream, screenpresso_decode_frame() fails to validate the decompressed byte length before invoking av_image_copy_plane(). When FFmpeg operates in persistent or shared-process services, processing untrusted media can expose sensitive memory contents, posing a Moderate impact to confidentiality.
Medium [CVE-2026-70629] Information disclosure via uninitialized heap memory read in RSCC decoder
FFmpeg versions from 3.0 up to, but not including, 9.0 contain an uninitialized heap memory read vulnerability in the native RSCC decoder (libavcodec/rscc.c) that allows attackers to disclose heap memory contents by supplying a crafted video file with a compressed tile that decompresses fewer bytes than the declared tile geometry requires. When rscc_decode_frame() calls av_image_copy_plane() without validating the decompressed byte count against the tile dimensions, the unwritten suffix of the persistent intermediate buffer ctx->inflated_buf is copied into the decoded frame, potentially exposing data from prior heap allocations or previous decoded frames in persistent decoding services. A flaw was found in FFmpeg. When decoding a crafted video file containing a truncated compressed tile, rscc_decode_frame() fails to validate the decompressed byte count before invoking av_image_copy_plane(). When FFmpeg runs in persistent or shared-process services, processing untrusted media can expose sensitive heap memory contents, posing a High impact to confidentiality. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-908. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI). Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-71497] Cross-site scripting via malformed HTML tag names
Cross-site scripting via malformed HTML tag names. Red Hat rates this moderate (CVSS 4.7). Weakness: CWE-1289. Affected products named by the advisory: Cryostat 4; Migration Toolkit for Applications 8; OpenShift Developer Tools and Services; Red Hat AMQ Broker 7; and 12 more. Affected products named by the advisory: Red Hat build of Apache Camel - HawtIO 4; Red Hat build of Apicurio Registry 3; Red Hat build of Quarkus Native builder; Red Hat Enterprise Linux 10; and 8 more.
Medium [CVE-2026-61632] Information disclosure via path traversal in b64 extension
Information disclosure via path traversal in b64 extension. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Red Hat Developer Hub; Red Hat OpenShift Container Platform 4; Self-service automation portal 2.
Medium [CVE-2026-19167] Cross-origin data leakage via integer overflow in GPU
Integer overflow in GPU in Google Chrome prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) This exploitation is possible by enticing a user to visit a specially crafted HTML page. This risk is primarily relevant to users who process untrusted web content. Red Hat severity: Moderate — CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:N/A:N). Weakness: CWE-190.
Medium [CVE-2026-19146] Google Chrome (Android): Information disclosure via uninitialized GPU memory use
Uninitialized Use in GPU in Google Chrome on Android prior to 151.0.7922.109 allowed a remote attacker who had compromised the renderer process to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High) A flaw was found in Google Chrome on Android, specifically within its Graphics Processing Unit (GPU) component. This Moderate impact information disclosure flaw affects the Chromium component in Red Hat community projects such as Fedora and EPEL. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-824.