Red Hat Linux Security Advisories & CVEs
13668 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-71202] Denial of Service via integer underflow in image cropping function
Denial of Service via integer underflow in image cropping function. Red Hat rates this important (CVSS 7.5). Weakness: CWE-191. Affected product named by the advisory: Red Hat OpenShift Container Platform 4.
High [CVE-2026-66274] Denial of Service via unbounded type nesting
Denial of Service via unbounded type nesting. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 2 more. Affected products named by the advisory: Red Hat build of Quarkus; Red Hat JBoss Enterprise Application Platform Expansion Pack.
High [CVE-2026-67589] Denial of Service via excessive memory allocation
Denial of Service via excessive memory allocation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected product named by the advisory: Red Hat AMQ Clients.
High [CVE-2026-66273] Denial of Service due to excessive allocation
A pre-authentication attacker could leverage type size/count handling to cause excessive allocation leading to potential denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue. A remote attacker, without needing to authenticate, could exploit a vulnerability in how the software handles type sizes and counts. This could lead to excessive memory allocation, causing the system to become unresponsive and resulting in a denial of service. By sending specially crafted messages, an attacker can trigger excessive memory allocation, leading to resource exhaustion in applications utilizing the library within Red Hat products such as AMQ, Quarkus, Camel, and EAP. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: AMQ Clients 2026.Q3; Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Build of Apache Camel 3.33.3.SP1; Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16; Red Hat build of Quarkus 3.27.5.SP1; Red Hat build of Quarkus 3.33.3.SP1; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat JBoss Enterprise Application Platform Expansion Pack. Red Hat fixing advisory: RHSA-2026:69459, RHSA-2026:66545, RHSA-2026:66488, RHSA-2026:63302, RHSA-2026:71675, RHSA-2026:62515, RHSA-2026:62555.
High [CVE-2026-67588] Denial of Service via unbounded symbol value caching
Denial of Service via unbounded symbol value caching. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected product named by the advisory: Red Hat AMQ Clients.
High [CVE-2026-66257] Denial of Service via unbounded symbol value caching
A pre-authentication attacker could leverage unbounded symbol value caching to cause resource exhaustion leading to denial of service. This issue affects Apache Qpid Proton-J: through 0.34.1. Users are recommended to upgrade to version 0.35.0, which fixes the issue. A remote attacker, without needing to authenticate, could exploit an issue with unbounded symbol value caching. This could lead to resource exhaustion, where the system runs out of available resources, ultimately causing a denial of service (DoS). A denial of service attack makes the affected system unavailable to legitimate users. This can lead to service unavailability in Red Hat products utilizing affected versions of Proton-J that expose a network endpoint. The vulnerability's impact is significant due to the potential for unauthenticated remote attackers to disrupt service. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: AMQ Clients 2026.Q3; Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Build of Apache Camel 3.33.3.SP1; Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16; Red Hat build of Quarkus 3.27.5.SP1; Red Hat build of Quarkus 3.33.3.SP1; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat JBoss Enterprise Application Platform Expansion Pack.
High [CVE-2026-64572] free fib_alias with kfree_rcu on insert error path
free fib_alias with kfree_rcu() on insert error path. Red Hat rates this moderate (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-67863] Denial of Service via use-after-free vulnerability
Denial of Service via use-after-free vulnerability. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825.
High [CVE-2026-67870] Denial of Service via incomplete validation in AddReferences
Denial of Service via incomplete validation in AddReferences. Red Hat rates this important (CVSS 7.5). Weakness: CWE-476.
High [CVE-2026-67869] Denial of Service via buffer overflow in Service_Call
Denial of Service via buffer overflow in Service_Call. Red Hat rates this important (CVSS 7.5). Weakness: CWE-125.
High [CVE-2026-64577] check skb_pull_data return in gtp1u_send_echo_resp
check skb_pull_data() return in gtp1u_send_echo_resp(). Red Hat rates this moderate (CVSS 7). Weakness: CWE-124.
High [CVE-2026-64573] fix NVM tag length underflow in TLV parser
fix NVM tag length underflow in TLV parser. Red Hat rates this moderate (CVSS 7). Weakness: CWE-125.
High [CVE-2026-64582] Fix a use-after-free problem in rxe_mmap
Fix a use-after-free problem in rxe_mmap. Red Hat rates this important (CVSS 7). Weakness: CWE-825. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-67864] Denial of Service via NodeManagement type-instantiation logic
Denial of Service via NodeManagement type-instantiation logic. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1287.
Medium [CVE-2026-19028] Denial of Service via integer underflow in Fletcher32 filter
H5Z__filter_fletcher32 in H5Zfletcher32.c in HDF5 through 2.3.0 computes the data length to checksum by subtracting the 4-byte trailing checksum size from the input buffer size without checking that the buffer is at least 4 bytes, allowing a size_t underflow. This allows attackers to cause a denial of service (massively out-of-bounds read and application crash in H5_checksum_fletcher32) via a crafted HDF5 file with a Fletcher32-filtered chunk smaller than 4 bytes, triggered via H5Dread, e.g. by the h5ls or h5dump tools. A flaw was found in HDF5. An attacker can craft a malicious HDF5 file with a specially designed Fletcher32-filtered chunk. When this file is processed, an integer underflow occurs due to insufficient size validation, leading to a massive out-of-bounds read. An integer underflow vulnerability exists in HDF5's H5Z__filter_fletcher32() function within H5Zfletcher32.c. When reading dataset chunks via H5Dread(), the Fletcher32 filter subtracts a 4-byte checksum length from the buffer size without validating that the buffer is at least 4 bytes. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat fixing advisory: RHSA-2026:73539.
Medium [CVE-2026-19027] Information disclosure and denial of service via crafted HDF5 file
The H5Z__nbit_decompress_one_byte, H5Z__nbit_decompress_one_nooptype, and H5Z__nbit_decompress_one_atomic functions in H5Znbit.c in HDF5 through 2.3.0 advance a read index into the compressed chunk buffer without bounding it against the buffer's actual size. This allows attackers to cause an out-of-bounds heap read, and in constrained cases disclosure of adjacent heap memory into decompressed dataset values, via a crafted HDF5 file whose N-Bit filter parameters describe more decompressed data than the stored compressed chunk actually contains, triggered via H5Dread, e.g. by the h5ls or h5repack tools. A flaw was found in HDF5, a widely used data management library. This vulnerability allows an attacker to craft a malicious HDF5 file that, when processed, can cause the application to read beyond its allocated memory. This out-of-bounds read could lead to the disclosure of sensitive information or result in a denial of service (DoS), making the application unavailable. A boundary validation flaw exists in the N-Bit decompression routines (H5Z__nbit_decompress_one_*) within the HDF5 library. When processing datasets via H5Dread(), the functions fail to bound the read index against the compressed buffer size. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3.
Medium [CVE-2026-19026] Denial of service via crafted HDF5 file
H5Z__filter_nbit in H5Znbit.c in HDF5 through 2.3.0 dereferences cd_values[0] through cd_values[4] without validating that cd_values is non-NULL or that cd_nelmts is at least 5, the fixed size of the filter's header. This allows attackers to cause a denial of service via a crafted HDF5 file that stores the N-Bit filter pipeline message with zero client-data values, opened and read via H5Dread, e.g. by the h5ls or h5repack tools. A flaw was found in HDF5. A remote attacker could craft a malicious HDF5 file that, when opened and read, would cause an application using the HDF5 library to crash. This issue stems from improper validation of input data within the N-Bit filter, leading to a denial of service (DoS) and impacting the availability of services that process these files. When processing dataset pipelines, the function accesses elements in the cd_values array without verifying that the pointer is non-NULL or that cd_nelmts meets the minimum 5-element header requirement. Opening and reading this file using H5Dread() or utilities like h5ls and h5repack triggers a NULL pointer dereference or out-of-bounds read, causing an application crash and denial of service. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3.
Medium [CVE-2026-19025] Denial of Service due to malformed chunk data in files
H5O__layout_decode in H5Olayout.c in HDF5 through 2.3.0 does not validate that a chunked dataset's stored chunk-layout dimensionality matches its dataspace rank when an existing dataset is opened, whereas this check is performed only at dataset-creation time. This allows attackers to cause a denial of service (divide-by-zero and application crash in H5S__hyper_iter_get_seq_list in src/H5Shyper.c) via a crafted HDF5 file with mismatched chunk/dataspace ranks that is opened and read via H5Dopen2 and H5Dread, e.g. by the h5repack tool. A flaw was found in HDF5. An attacker can craft a malicious HDF5 file that, when opened and read by an application, exploits a validation bypass. This bypass, related to mismatched chunk-layout dimensionality and dataspace rank, leads to a divide-by-zero error, causing a denial of service (DoS) and application crash. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-369. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat fixing advisory: RHSA-2026:61630.
Medium [CVE-2026-19024] Denial of service via malformed dataset
NULL pointer dereference in H5Pget_fill_value in HDF5 before 2.3.0 allows attackers to cause a denial of service via a dataset whose version 1 or 2 fill value message has the "defined" flag set together with a negative size field, which is not normalized to the library's "undefined" sentinel and reaches H5T_path_find with a NULL datatype. A flaw was found in HDF5. A local attacker could exploit a vulnerability in the `H5Pget_fill_value` function by providing a specially crafted dataset. This could lead to a denial of service, making the system unavailable. When this unnormalized structure is evaluated, it passes a NULL datatype pointer to H5T_path_find, resulting in a NULL pointer dereference. Successful exploitation causes the calling application process to terminate abruptly, resulting in a localized denial of service (DoS). Because the vulnerability results strictly in a NULL dereference crash without memory corruption, privilege escalation, or unauthorized data exposure, confidentiality and integrity are unaffected, and the blast radius is confined to the individual parsing process. Due to these reasons, this vulnerability has been rated with a Moderate severity. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3.
Medium [CVE-2026-71313] Path Traversal allows arbitrary file write
Path Traversal allows arbitrary file write. Red Hat rates this moderate (CVSS 6.9). Weakness: CWE-22. Affected product named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.