Red Hat Linux Security Advisories & CVEs
13766 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-55968] Apache Thrift Node.js bindings: Denial of Service due to inefficient algorithmic complexity and resource allocation
Inefficient Algorithmic Complexity, Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Node.js bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. By exploiting this, an attacker can consume excessive resources, making the service unavailable to legitimate users. This flaw primarily impacts Red Hat OpenShift Container Platform components that utilize the vulnerable Thrift Node.js bindings, potentially leading to service unavailability. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Confidential Compute Attestation; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Update Service as not affected. Red Hat fixing advisory: RHSA-2026:49837.
High [CVE-2026-49158] Apache Thrift Ruby bindings: Denial of Service via improper handling of highly compressed data
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Ruby bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. By sending specially crafted highly compressed data, an attacker can exhaust system resources, making the service unavailable to legitimate users. This Important vulnerability in Apache Thrift Ruby bindings could allow a remote, unauthenticated attacker to trigger a denial of service. By sending specially crafted compressed data, an attacker can cause excessive resource consumption, leading to service unavailability in affected Red Hat products that utilize these bindings, such as OpenShift Container Platform components. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-409. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Confidential Compute Attestation; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Update Service as not affected. Red Hat fixing advisory: RHSA-2026:49837.
High [CVE-2026-48586] Denial of Service via improper handling of highly compressed data
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift C++, Java, Python, Go, D, C/GLib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This vulnerability, categorized as improper handling of highly compressed data (also known as data amplification), allows a remote attacker to cause a Denial of Service (DoS) by sending specially crafted, highly compressed data. The affected component fails to properly manage the expansion of this data, leading to resource exhaustion and system unavailability. This Important vulnerability in Apache Thrift's handling of highly compressed data can lead to a denial of service. Remote, unauthenticated attackers could exploit this flaw by sending specially crafted compressed data, causing excessive resource consumption and disrupting the availability of services utilizing vulnerable Thrift bindings in Red Hat products. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-409. Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Build of Apache Camel 4.18 for Quarkus 3.33; Multicluster Global Hub 1.4.9; Multicluster Global Hub 1.5.8; and 27 more.
High [CVE-2026-45112] Denial of Service due to uncontrolled resource allocation
Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Java bindings. This issue affects Apache Thrift: from 0.19.0 before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This vulnerability, categorized as an Allocation of Resources Without Limits or Throttling, allows a remote attacker to cause a denial of service by exhausting system resources. The flaw occurs when the application fails to properly limit or throttle resource allocation, leading to potential system instability or unresponsiveness. This vulnerability is rated as Important. It stems from uncontrolled resource allocation in Apache Thrift Java bindings, which can lead to a denial of service. This impacts Red Hat products such as Red Hat OpenShift AI, Red Hat build of Apache Camel, Red Hat Ceph Storage, Red Hat Connectivity Link, and Cryostat, where services utilizing these vulnerable bindings could experience resource exhaustion and service disruption. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat Build of Apache Camel 4.18 for Quarkus 3.33; Red Hat Hardened Images; Red Hat OpenShift AI 2.25; and 7 more.
High [CVE-2026-43871] Denial of Service via infinite loop
Denial of Service via infinite loop. Red Hat rates this important (CVSS 7.5). Weakness: CWE-835.
High [CVE-2026-41608] Apache Thrift Python bindings: Denial of Service via data amplification
Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. An attacker could exploit this by providing specially crafted compressed input, which may cause the application to consume excessive resources. This could potentially result in a denial of service (DoS) for affected systems. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-409. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Confidential Compute Attestation; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4; Red Hat OpenShift Update Service as not affected. Red Hat fixing advisory: RHSA-2026:49837.
High [CVE-2026-17527] cdi.kubevirt.io:view aggregated ClusterRole grants create on datavolumes/source, allowing unauthorized PVC clone
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role. This flaw is confirmed upstream in kubevirt/containerized-data-importer and affects all downstream consumers using CDI's default aggregated RBAC roles, including OpenShift Virtualization. It is distinct from the SSP operator's "golden images" pattern, which deliberately and correctly scopes an equivalent permission via a namespace-scoped Role/RoleBinding. Red Hat severity: Important — CVSS 7.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N). Weakness: CWE-639.
High [CVE-2026-17523] can:bcm: arbitrary kernel code execution leading to escalate privileges
A flaw was found in the Linux kernel in net/can/bcm.c in can: bcm, where an unprivileged local user can exploit this vulnerability to execute arbitrary code within the kernel, which leads to a local privilege escalation (LPE). This allows the attacker to gain root privileges and take full control of the affected system. This is an Important flaw in the Linux kernel's CAN BCM module that allows a local unprivileged attacker to achieve root privileges through arbitrary kernel code execution. The vulnerability is present in Red Hat Enterprise Linux 8, where a proof of concept has demonstrated local privilege escalation, even without unprivileged user namespaces or the `kernel-modules-extra` package. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions. Affected products named by the advisory: Red Hat package: kernel-rt.
High [CVE-2026-15928] Cross-Site Scripting in error page component
XMLRPC-C Library versions 1.07 through 1.67.01 are vulnerable to a reflected cross-site scripting (XSS) vulnerability in the error page component. A remote attacker could exploit this by tricking a user into clicking a specially crafted link. Successful exploitation could lead to the execution of malicious scripts in the user's browser, potentially resulting in information disclosure or session hijacking. This reflected cross-site scripting (XSS) vulnerability relies entirely on client-side interaction through a web browser. If executed, the script runs within the context of the user's browser session, making sensitive session tokens or client-side data accessible to the attacker. While external CVSSv4 scoring rates this flaw to an 8.2 High, Red Hat bounds the severity to CVSS 7.4 based on explicit CIA triad mechanics. The impact is strictly confined to Confidentiality (C:H) via potential browser-side data disclosure. The flaw carries zero impact on system Integrity (I:N) or Availability (A:N), as it cannot alter server-side application logic, modify stored data, or disrupt underlying XML-RPC services.
High [CVE-2026-51300] Application crash and information leakage due to use-after-free
A flaw was found in SQLite. This use-after-free vulnerability exists in the expression parsing and memory management logic. A remote attacker can exploit this by crafting malicious SQL queries, which leads to invalid memory access. This can result in an application crash and the leakage of sensitive memory information. Red Hat Product Security has evaluated CVE-2026-51300, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious ( ). This CVE has been marked as Rejected by the assigning CNA. Red Hat severity: not rated. Weakness: CWE-825. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 as not affected.
High [CVE-2026-51298] Denial of Service via use-after-free in JSON extraction
A flaw was found in SQLite. A remote attacker could exploit a use-after-free vulnerability in the JSON extraction function. This occurs when the program attempts to access memory after it has been freed, specifically within the `JsonParse` object. Successful exploitation of this vulnerability can lead to a service crash and a denial of service (DoS) for affected systems. This Moderate flaw in SQLite's JSON extraction function can lead to a denial of service. Applications that process untrusted JSON input using SQLite in Red Hat products are susceptible to a service crash due to a use-after-free vulnerability. This could impact the availability of services relying on SQLite for JSON data handling. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:45779.
High [CVE-2026-51302] Arbitrary code execution via malicious SQL statement
A flaw was found in SQLite. A use-after-free vulnerability in the expression evaluation logic, specifically within the sqlite3ReleaseTempReg and exprComputeOperands functions, allows a remote attacker to exploit the system. By supplying a malicious SQL statement, an attacker can cause a denial of service, leak sensitive information, or potentially execute arbitrary code. Red Hat Product Security has evaluated CVE-2026-51302, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious ( ). This CVE has been marked as Rejected by the assigning CNA. Red Hat severity: not rated. Weakness: CWE-825. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected. Red Hat fixing advisory: RHSA-2026:45779.
High [CVE-2026-51296] Use-after-free vulnerability leads to denial of service and information disclosure
A flaw was found in SQLite. A use-after-free vulnerability in the SQLite JSON module's jsonRemoveFunc allows a remote attacker to cause a denial of service by crashing the service. This vulnerability can also lead to the disclosure of sensitive heap memory information. Red Hat Product Security has evaluated CVE-2026-51296, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious ( ). This CVE has been marked as Rejected by the assigning CNA. Red Hat severity: not rated. Weakness: CWE-825. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 as not affected.
High [CVE-2026-51297] Arbitrary code execution via use-after-free in JSON parsing
A flaw was found in sqlite. This use-after-free vulnerability in the JSON parsing logic allows remote attackers to craft malicious JSON payloads. This can trigger memory deallocation followed by illegal memory access, potentially leading to arbitrary code execution, sensitive information leakage, or denial of service. Red Hat Product Security has evaluated CVE-2026-51297, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious ( ). This CVE has been marked as Rejected by the assigning CNA. Red Hat severity: not rated. Weakness: CWE-825. Affected Red Hat products: Red Hat Hardened Images. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift Container Platform 4 as not affected. Red Hat fixing advisory: RHSA-2026:45779.
High [CVE-2026-51303] Arbitrary code execution via specially crafted SQL queries
A flaw was found in SQLite. A remote attacker can exploit a use-after-free vulnerability in the core parsing component by sending specially crafted SQL queries. This can lead to an application crash, sensitive information disclosure, and potentially allow the attacker to execute arbitrary code on the affected system. Red Hat Product Security has evaluated CVE-2026-51303, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious ( ). This CVE has been marked as Rejected by the assigning CNA. Red Hat severity: not rated. Weakness: CWE-825. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat Hardened Images; Red Hat OpenShift Container Platform 4 as not affected.
High [CVE-2026-51304] Arbitrary code execution via malicious SQL statement
A flaw was found in sqlite. A remote attacker can exploit a use-after-free vulnerability in the ORDER BY clause parsing routine by crafting a malicious SQL statement. This can lead to an application crash, sensitive information disclosure, and in some cases, arbitrary code execution, allowing the attacker to run their own commands on the affected system. Red Hat Product Security has evaluated CVE-2026-51304, which claims a Use-After-Free vulnerability in SQLite. After conducting independent analysis of the affected SQLite versions, Red Hat has determined that this vulnerability does not affect our products. SQLite upstream have confirmed this CVE as fictitious ( ). This CVE has been marked as Rejected by the assigning CNA. Red Hat severity: not rated. Weakness: CWE-825. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected. Red Hat fixing advisory: RHSA-2026:45779.
High [CVE-2026-64534] check INIT_FAILED before nvmet_req_uninit in digest error path
In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path In nvmet_tcp_try_recv_ddgst(), when a data digest mismatch is detected, nvmet_req_uninit() is called unconditionally. However, if the command arrived via the nvmet_tcp_handle_req_failure() path, nvmet_req_init() had returned false and percpu_ref_tryget_live() was never executed. The unconditional percpu_ref_put() inside nvmet_req_uninit() then causes a refcount underflow, leading to a WARNING in percpu_ref_switch_to_atomic_rcu, a use-after-free diagnostic, and eventually a permanent workqueue deadlock. Check cmd->flags & NVMET_TCP_F_INIT_FAILED before calling nvmet_req_uninit(), matching the existing pattern in nvmet_tcp_execute_request(). A flaw was found in the Linux kernel's NVMe over TCP (nvmet-tcp) implementation. When a data digest mismatch occurs, a reference count underflow can happen due to an unconditional cleanup call. This issue can lead to a use-after-free condition and ultimately result in a permanent workqueue deadlock, causing a Denial of Service (DoS) for the system. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-911. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-64531] reject oversized nested action attrs
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, whose nla_len field is u16. Commit a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check") allowed the total sw_flow_actions stream to grow beyond 64 KiB, which is valid, but also removed the last guard preventing a generated nested action attribute from exceeding U16_MAX. An oversized generated container can thus be closed with a truncated nla_len. A later dump or teardown then walks a structurally different stream than the one that was validated. In particular, an oversized nested CLONE/CT action may cause subsequent bytes in the generated stream to be interpreted as independent actions. Keep the larger total-action-stream behavior, but make nested action close reject generated containers that do not fit in nla_len, and return the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse construction order before discarding failed wrappers, so resources copied into the rejected tails are released before the wrappers are removed. Most failed outer wrappers are discarded by truncating actions_len after child resources have been released.
High [CVE-2026-51235] Buffer Overflow vulnerability in image processing
A flaw was found in LibRaw, an open-source library for processing raw image files. This vulnerability is a buffer overflow, which occurs in the `stretch()` and `fuji_rotate()` functions. A buffer overflow can allow an attacker to overwrite memory, potentially leading to a denial of service or the execution of unauthorized code. Successful exploitation requires a local attacker to trick a user into processing a specially crafted raw image file, which could lead to arbitrary code execution or a denial of service. Red Hat Enterprise Linux 9 is affected, while Red Hat Enterprise Linux 8 and older versions are not vulnerable as they ship with older, unaffected versions of LibRaw or do not contain the vulnerable code. Red Hat severity: Important — CVSS 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-120. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat fixing advisory: RHSA-2026:51105, RHSA-2026:61353, RHSA-2026:61352. Affected products named by the advisory: Red Hat package: libraw.
High [CVE-2026-64552] fix len check in receive_big
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised. A malicious virtio backend can exploit an insufficient length check in the `receive_big()` function, leading to an out-of-bounds write. This vulnerability can result in a denial of service (DoS) due to system instability or crashes. Red Hat severity: Important — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-787. Under investigation: Red Hat Enterprise Linux 6.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.