Red Hat Linux Security Advisories & CVEs
14183 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-65624] Denial of Service via HTTP/1.1 duplicate header names
Allocation of Resources Without Limits or Throttling vulnerability in ninenines cowboy allows an unauthenticated remote attacker to exhaust connection process memory over HTTP/1.1. The HTTP/1.1 handler in cowboy_http enforces the max_headers limit by counting the number of distinct header names in a map (maps:size(Headers)). When a request contains multiple header lines with the same name, the values are concatenated into a single ever-growing binary stored under that one map key (", " for regular headers, "; " for cookies), so the map size stays at one and the max_headers cap (default 100) is never reached. Because no accumulator bounds the total number of header lines or the total byte size of the header block (only per-line max_header_name_length and max_header_value_length apply), an unauthenticated client can send an arbitrary number of header lines with the same name and grow the connection process's binary memory to arbitrary size within the request window. The impact per connection is bounded by request_timeout (default 5 seconds, not reset by header data), and by max_heap_size when set (the offending connection process is killed once its heap grows past the limit). When max_heap_size is left at the default (unset), sustained abuse can drive the Erlang VM into out-of-memory conditions. This issue affects cowboy from 2.0.0-pre.4 before 2.18.0.
High [CVE-2026-6949] TSIG packet with crafted name compression can crash DNS server
A flaw was found in Samba's internal DNS server when processing TSIG-signed DNS packets containing compressed names. Incorrect size calculations while determining the portion of the DNS packet covered by the TSIG signature can result in an integer underflow, leading to an out-of-bounds memory write during packet processing. A remote attacker can send a specially crafted TSIG-signed DNS packet to cause the DNS server to terminate unexpectedly. Red Hat Product Security evaluates this vulnerability as having an Important impact for Samba deployments operating as an Active Directory Domain Controller (AD DC) using the internal DNS server engine. ``` Red Hat Enterprise Linux (RHEL) Context: Default installations of Red Hat Enterprise Linux (RHEL) are not affected. RHEL does not ship or support the Samba Active Directory Domain Controller (AD DC) role or its internal DNS server component where this vulnerability resides. ``` ``` Additionally, Samba AD DC deployments that use the external BIND9 DLZ plugin instead of the internal DNS server engine are completely unaffected by this issue. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-787.
High [CVE-2026-58222] Samba AD LDAP Compare filter injection and trusted-request confusion disclose protected attributes
A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present. Red Hat Product Security has rated this vulnerability as having an Important security impact for Samba deployments operating as an Active Directory Domain Controller (AD DC) ``` Red Hat Enterprise Linux (RHEL) context: Standard installations of Red Hat Enterprise Linux (RHEL) are not affected. RHEL packages Samba strictly to operate as a file server (smbd), print server, or Active Directory domain member (winbindd).
High [CVE-2026-58221] authenticated LDAP access to internal LDB special DNs permits domain takeover
A flaw was found in Samba Active Directory Domain Controller (AD DC). Improper authorization checks allow an authenticated low-privilege domain user to modify internal LDB special records through LDAP. By altering the DSDB module configuration, an attacker can bypass directory ACL enforcement on new LDAP connections and elevate privileges, potentially leading to complete domain compromise. ``` Red Hat Enterprise Linux (RHEL) context: Default installations of Red Hat Enterprise Linux (RHEL) are not affected. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-284. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected.
High [CVE-2026-59248] Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid.
Medium [CVE-2026-54620] Use-After-Free vulnerability in SQLite aggregate function callbacks
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5. A local attacker could potentially exploit this use-after-free condition to cause unpredictable application behavior, which may lead to information disclosure or a denial of service (DoS). Red Hat severity: Moderate — CVSS 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-825. Red Hat lists Red Hat Satellite 6 as not affected.
Medium [CVE-2026-54619] Use-after-free when redefining SQLite functions with different arity
Use-after-free when redefining SQLite functions with different arity. Red Hat rates this moderate (CVSS 4.5). Weakness: CWE-825.
Medium [CVE-2026-71192] S3API cross-tenant object read via Swift-native header injection
S3API cross-tenant object read via Swift-native header injection. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-863.
Medium [CVE-2026-66299] Denial of Service via WebSocket chat example
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. This can lead to the affected system becoming unresponsive or crashing. The impact is limited as the vulnerable component is part of an example application, which is generally not deployed in production environments. Exploitation requires the example application to be present and accessible. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat JBoss Web Server 6.2.5; Red Hat JBoss Web Server 6.2 on RHEL 10; Red Hat JBoss Web Server 6.2 on RHEL 8; Red Hat JBoss Web Server 6.2 on RHEL 9; Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:73982, RHSA-2026:73981, RHSA-2026:56039. Affected products named by the advisory: Red Hat package: tomcat9.
Medium [CVE-2026-18047] ACME admin enable/disable endpoint authentication bypass via trailing slash
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service. Red Hat rates this as Moderate because the impact of the authentication bypass is limited in scope and consequence. The vulnerability only affects the ACME enable/disable admin endpoints — other PKI subsystems (CA, KRA, OCSP, TPS) enforce authorization at the application layer and are not affected by this flaw. An attacker who exploits this flaw can only toggle the ACME service on or off. While re-enabling a disabled ACME service restores the full ACME protocol stack, certificate issuance through ACME still requires completing the standard RFC 8555 challenge-response flow, including proof of domain control — the enable/disable bypass alone does not grant the ability to obtain certificates. The ACME responder requires explicit installation and deployment and is not present in default PKI server configurations. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-288.
Medium [CVE-2026-58216] kpasswd service: kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unallocated memory leading server to crash
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service. Red Hat Product Security has rated this vulnerability as having a Moderate security impact. Successful exploitation requires an authenticated attacker to craft a malformed ASN.1-encoded Kerberos password change request that precisely triggers the underlying parsing flaw, increasing the attack complexity. The Samba project also notes that the attack is unreliable in practice and an attacker may need to perform numerous kpasswd attempts before successfully causing the service to terminate. ``` Standard RHEL Server Deployments (Not Affected): Default Red Hat Enterprise Linux (RHEL) deployments are not affected.
Medium [CVE-2026-58218] DNS signing DoS via TKEY name cache exhaustion
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service. Red Hat Product Security has rated this vulnerability as having a Moderate security impact for Samba deployments operating as an Active Directory Domain Controller (AD DC) using the internal DNS server. ``` Red Hat Enterprise Linux (RHEL) context: Standard Red Hat Enterprise Linux deployments are not affected. RHEL does not support the Samba Active Directory Domain Controller (AD DC) role or its internal DNS server, where this vulnerability resides. ``` ``` Additionally, Samba AD DC deployments configured to use the external BIND9 DLZ backend instead of the internal DNS server are not affected by this vulnerability. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-410. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected.
Medium [CVE-2026-58224] CTDB fails to do integrity checking of received packets
A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents. CTDB is an optional clustering component of Samba used strictly for multi-node active/active file sharing and is not installed, configured, or running by default on standard Red Hat Enterprise Linux (RHEL) deployments. Red Hat historically supported CTDB in RHEL High Availability and Resilient Storage configurations (including RHEL 6 and RHEL 7) and officially deprecated standalone CTDB usage as of RHEL 8.4 in favor of Pacemaker-managed cluster deployments. Network Architecture Mitigations: For legacy or historical environments actively utilizing CTDB via supported RHEL High Availability or Resilient Storage cluster configurations, Red Hat’s official Support Policies for RHEL High Availability Clusters explicitly mandate that CTDB private interconnect traffic must run on a dedicated, isolated private network segment segregated from client networks.
Medium [CVE-2024-14041] Bouncy Castle for Java: Private key recovery via timing side-channel in ML-KEM (CRYSTALS-Kyber) routines
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected. Successful exploitation allows the attacker to recover the long-term private key, leading to a significant compromise of cryptographic security. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-208. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform Expansion Pack. Red Hat does not currently list a fixing RHSA for this CVE.
Low [CVE-2026-6879] Performance degradation in XML processing due to quadratic time complexity
Performance degradation in XML processing due to quadratic time complexity. Red Hat rates this low (CVSS 2.2). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:54534 with package python3-12-main-3.12.13-3.8.hum1, python3-10-main-3.10.20-3.2.hum1, python3-14-main-3.14.7-1.hum1, python3-14-main-3.14.6-2.2.hum1.
Low [CVE-2026-58341] CSRF risk in group messaging state toggle
CSRF risk in group messaging state toggle. Red Hat rates this moderate (CVSS 3.5). Weakness: CWE-22.
Low [CVE-2026-17072] 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing FLAC codec data in Matroska containers
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory. This vulnerability is rated as Low severity because the out-of-bounds read is limited to 4 bytes, is read-only (no memory corruption), and the read cannot be directly observed or controlled by a remote attacker. User interaction is required to trigger it, as a victim must open a crafted Matroska or WebM media file. In practice, modern heap allocators align allocations such that the 4 overread bytes typically fall within adjacent allocated memory, making a crash unlikely in production builds. Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle OS 2 ship gstreamer1-plugins-good with the affected Matroska demuxer code path and are affected. All RHEL and RHIVOS streams are deferred (low severity, low exploitability). Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Weakness: CWE-125.
High [CVE-2026-64649] Server-Side Request Forgery via malicious host redirection in Server Actions
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11. This can lead to Server-Side Request Forgery (SSRF), where the server is tricked into making requests to an attacker-controlled host. Such an attack could potentially expose internal system information or bypass authorization controls. This Important Server-Side Request Forgery (SSRF) flaw in Next.js Server Actions allows an attacker to redirect outbound requests to a malicious host.
High [CVE-2026-64648] Information disclosure via server-side fetch cache
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11. A flaw was found in Next.js. The vulnerability is triggered by specific unsafe fetch patterns where the request object's initialization differs from the fetch call's initialization. Red Hat customers using Next.js applications should review their fetch implementations, noting that applications built with Pages Router are not impacted. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-524. Affected Red Hat products: Streams for Apache Kafka 3.2.1; Red Hat Enterprise Linux AI (RHEL AI) 3; streams for Apache Kafka 2. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Trusted Artifact Signer as not affected.
High [CVE-2026-12383] ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions. This flaw is a defense-in-depth failure in EDA that becomes exploitable when combined with the gateway header-forwarding issue (tracked as a separate CVE). The DN leak in the error response further reduces the difficulty of exploitation. EDA has been included in AAP since version 2.4. The mTLS external event stream feature and the trust-of-Subject-header pattern apply to all EDA versions that support external event streams with mTLS authentication. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-345. Affected Red Hat products: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Ansible Automation Platform 2.7.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.