Red Hat Linux Security Advisories & CVEs
13755 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-63362] Denial of Service via unsigned integer underflow
An unsigned integer underflow in the PubSub signature verification path in open62541 may allow a remote attacker to cause a denial of service via a crafted UDP packet. A flaw was found in open62541. This vulnerability could make the affected system unavailable to legitimate users. This Moderate severity flaw in open62541 can lead to a denial of service. The high attack complexity associated with this vulnerability reduces the likelihood of successful exploitation. This component is only present in Fedora. Red Hat does not ship this component in any core Red Hat products. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-191.
Medium [CVE-2026-68563] Information disclosure of PostgreSQL data via insecure backup permissions
A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure. The vulnerability occurs when a specific Leapp remediation task, intended to back up and remove old PostgreSQL data, creates a world-readable archive in `/var/backups`. Exploitation requires local access to a managed node where this particular remediation workflow has been executed and `/var/lib/pgsql/data` existed. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-732. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: ansible-collection-redhat-leapp.
Medium [CVE-2026-68562] Information disclosure via Leapp report tampering
A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials. When an operator subsequently runs the `leapp_corrupted_grubenv_file` remediation, the Ansible controller may be tricked into disclosing sensitive controller-local files to the compromised managed node, crossing a trust boundary. Exploitation depends on both prior compromise of the managed node and specific operator action. Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N). Weakness: CWE-610. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: ansible-collection-redhat-leapp.
Medium [CVE-2026-67550] Denial of Service via out-of-bounds read
Denial of Service via out-of-bounds read. Red Hat rates this moderate (CVSS 5.7). Weakness: CWE-125.
Medium [CVE-2026-59881] Denial of Service via unnegotiated WebSocket compression
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.2, the WebSocket client accepts and decompresses frames with the RSV1 bit set even when the permessage-deflate extension was not negotiated, allowing a malicious server to cause unexpected CPU and memory consumption. This issue is fixed in version 3.14.2. A flaw was found in AIOHTTP. The WebSocket client in AIOHTTP processes compressed data frames even when the compression mechanism, known as permessage-deflate, has not been properly negotiated. A malicious server can exploit this by sending specially crafted compressed frames. This can lead to unexpected and excessive consumption of the system's central processing unit (CPU) and memory, potentially resulting in a denial of service (DoS) for legitimate users. Red Hat rates this flaw as Moderate with a CVSS score of 5.3 because exploitation requires an aiohttp WebSocket client to connect to an attacker-controlled server. In typical Red Hat product deployments, aiohttp serves as an HTTP client library for internal service communication rather than establishing WebSocket connections to untrusted endpoints. The resulting resource consumption is limited to the individual process running the affected client and does not propagate to other services or the host system. Weakness: CWE-409.
Medium [CVE-2026-12996] Denial of Service or memory leak via crafted packets
A use-after-free in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to potentially cause a denial of service or leak memory via crafted packets during TLS session promotion or expiry A flaw was found in OpenVPN. Successful exploitation of this flaw could lead to a denial of service, making the service unavailable, or result in a memory leak, potentially exposing sensitive information. Moderate impact. While it can lead to a denial of service or memory leak, the need for prior authentication limits the attack vector, making it less severe than unauthenticated vulnerabilities. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-11771] Denial of Service via crafted NTLM proxy response
OpenVPN version 2.1.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows attackers via an off-by-one buffer write in the NTLM proxy authentication to potentially cause a crash via a crafted NTLM response from a malicious proxy server A flaw was found in OpenVPN. A remote attacker could exploit an off-by-one buffer write vulnerability during NTLM (NT LAN Manager) proxy authentication. By sending a specially crafted NTLM response from a malicious proxy server, the attacker could cause the OpenVPN client to crash, leading to a denial of service. Exploitation requires a client to connect through a malicious NTLM proxy server, which can then send a specially crafted response. The necessity of user interaction with a compromised proxy limits the overall risk. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-787.
Medium [CVE-2026-13117] Denial of service or memory leakage via incomplete TLS guard
An incomplete guard in OpenVPN 2.6.0 through 2.6.20 and 2.7_alpha1 through 2.7.4 allows remote authenticated peers to trigger a use-after-free during TLS session promotion, potentially leading to a denial of service or memory leakage A flaw was found in OpenVPN. This can lead to a denial of service, making the service unavailable, or memory leakage, which could potentially expose sensitive information. The high attack complexity and requirement for prior authentication limit the immediate risk, but successful exploitation could disrupt VPN services or expose sensitive information. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-60074] Date::Manip: Incorrect date parsing leads to logic errors
Date::Manip: Incorrect date parsing leads to logic errors. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-681.
Medium [CVE-2026-7260] Denial of Service via circular symbolic links in phar archives
Denial of Service via circular symbolic links in phar archives. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-606. Red Hat lists fixing advisory RHSA-2026:47200 with package php-main-8.5.9-1.hum1.
Medium [CVE-2026-18369] ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error. Red Hat rates this Moderate because exploitation is limited to HTTP GET requests (no integrity impact), the attacker cannot read internal responses on production-supported backends (low confidentiality impact), and the ACME responder must be explicitly deployed. The Scope is Changed (S:C) because the ACME responder causes the Dogtag server to make outbound requests to services outside its own trust boundary, but the actual information gained on supported configurations is limited to network topology probing. While the SSRF is GET-only and does not directly allow data modification, administrators should be aware that internal services reachable from the Dogtag host which perform actions on HTTP GET (such as cloud instance metadata endpoints that issue temporary credentials) could be indirectly affected.
Medium [CVE-2026-56850] mTLS client identities can be reused due to HTTPS Agent connection flaw
A flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. A flaw was found in Node.js. The HTTPS Agent, responsible for managing secure connections, can incorrectly reuse client identities across different requests. As a result, a client's identity, established through mutual TLS (mTLS) authentication, could be mistakenly applied to another request, potentially leading to unauthorized access or identity spoofing. This can lead to unintended identity confusion if applications are configured to use different client certificates with reused connections, potentially enabling unauthorized access within the mTLS context. Red Hat severity: Moderate — CVSS 4.1 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-303. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Hardened Images. Red Hat fixing advisory: RHSA-2026:48273, RHSA-2026:48305, RHSA-2026:48537. Affected products named by the advisory: Red Hat package: nodejs22; Red Hat package: nodejs24.
Medium [CVE-2026-58040] HTTPS Agent TLS session reuse skips hostname verification
HTTPS Agent TLS session reuse skips hostname verification. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-322. Red Hat lists fixing advisory RHSA-2026:48273 with package nodejs26-main-26.5.1-1.5.hum1, nodejs22-main-22.23.2-2.3.hum1, nodejs24-main-24.18.1-0.1.hum1.
Medium [CVE-2026-16531] Arbitrary file creation via path traversal in pmproxy logger servlet
An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service. This can lead to a denial of service or other impacts on systems where pmproxy is exposed on TCP port 44322, as the logger servlet is unconditionally active. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: pcp.
Medium [CVE-2026-16530] Remote denial of service and information leakage
A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory. This Moderate impact flaw in the PCP `pmproxy` service allows a remote, unauthenticated attacker to trigger a denial of service or information leakage. The vulnerability stems from a bypassed bounds check in the `pmLogLoadInDom()` function, which can lead to service instability or memory exposure. Exploitation requires the `pmproxy` service to be reachable on its default TCP port 44322. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: pcp.
Medium [CVE-2026-18019] Side-channel information leakage in Media
Side-channel information leakage in Media in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low) Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Weakness: CWE-205.
Medium [CVE-2026-18015] Inappropriate implementation in Tint
Inappropriate implementation in Tint in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low) An inappropriate implementation flaw was found in the Tint component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Weakness: CWE-653.
Medium [CVE-2026-18017] Use after free in Dawn
Use after free in Dawn in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Low) An use after free flaw was found in the Dawn component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Weakness: CWE-825.
Medium [CVE-2026-18012] Use after free in PDFium
Use after free in PDFium in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file. (Chromium security severity: Low) An use after free flaw was found in the PDFium component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L). Weakness: CWE-825.
Medium [CVE-2026-18008] Inappropriate implementation in Settings
Inappropriate implementation in Settings in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via malicious network traffic. (Chromium security severity: Low) An inappropriate implementation flaw was found in the Settings component of the Chromium browser. Upstream bug(s): Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory. Red Hat severity: Low — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N). Weakness: CWE-1021.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.