Red Hat Linux Security Advisories & CVEs
14280 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-58221] authenticated LDAP access to internal LDB special DNs permits domain takeover
A flaw was found in Samba Active Directory Domain Controller (AD DC). Improper authorization checks allow an authenticated low-privilege domain user to modify internal LDB special records through LDAP. By altering the DSDB module configuration, an attacker can bypass directory ACL enforcement on new LDAP connections and elevate privileges, potentially leading to complete domain compromise. ``` Red Hat Enterprise Linux (RHEL) context: Default installations of Red Hat Enterprise Linux (RHEL) are not affected. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-284. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected.
High [CVE-2026-59248] Denial of Service due to unbounded HPACK/QPACK prefixed-integer decoding
Allocation of resources without limits vulnerability in ninenines cowlib allows an unauthenticated remote HTTP/2 or HTTP/3 peer to exhaust memory on the vulnerable server (or client) and cause a denial of service. The HPACK and QPACK prefixed-integer decoder cow_hpack_common:dec_big_int/3 in src/cow_hpack_common.hrl (invoked from cow_hpack:decode/2 in src/cow_hpack.erl and from cow_qpack:decode_field_section/3 in src/cow_qpack.erl) reads continuation octets until it sees one whose high bit is clear, evaluating Int + (Value bsl M) at each step with the shift M growing by seven per octet. No limit is enforced on the number of continuation octets, on the resulting bit width, or on the value; the decoder consumes whatever encoded length the peer supplies. Because Erlang integers are immutable, each intermediate Value bsl M and each accumulator update allocates a fresh bignum whose digit width grows linearly with the number of octets processed so far. Summed across the whole decode, the transient bignum digit materialization is on the order of the square of the encoded length. A single maximal HPACK indexed representation carried inside one HTTP/2 HEADERS plus one CONTINUATION frame at Cowboy's default max_frame_size_received can force hundreds of megabytes of transient allocation and garbage-collection churn before the resulting header-table index is rejected as invalid.
Medium [CVE-2026-54620] Use-After-Free vulnerability in SQLite aggregate function callbacks
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite aggregate functions can be freed while still referenced during aggregation, resulting in a use-after-free. This issue is fixed in version 2.9.5. A local attacker could potentially exploit this use-after-free condition to cause unpredictable application behavior, which may lead to information disclosure or a denial of service (DoS). Red Hat severity: Moderate — CVSS 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-825. Red Hat lists Red Hat Satellite 6 as not affected.
Medium [CVE-2026-54619] Use-after-free when redefining SQLite functions with different arity
Use-after-free when redefining SQLite functions with different arity. Red Hat rates this moderate (CVSS 4.5). Weakness: CWE-825.
Medium [CVE-2026-71192] S3API cross-tenant object read via Swift-native header injection
S3API cross-tenant object read via Swift-native header injection. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-863.
Medium [CVE-2026-66299] Denial of Service via WebSocket chat example
Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web application are not affected by this issue. This can lead to the affected system becoming unresponsive or crashing. The impact is limited as the vulnerable component is part of an example application, which is generally not deployed in production environments. Exploitation requires the example application to be present and accessible. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-770. Affected Red Hat products: Red Hat JBoss Web Server 6.2.5; Red Hat JBoss Web Server 6.2 on RHEL 10; Red Hat JBoss Web Server 6.2 on RHEL 8; Red Hat JBoss Web Server 6.2 on RHEL 9; Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:73982, RHSA-2026:73981, RHSA-2026:56039. Affected products named by the advisory: Red Hat package: tomcat9.
Medium [CVE-2026-18047] ACME admin enable/disable endpoint authentication bypass via trailing slash
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service. Red Hat rates this as Moderate because the impact of the authentication bypass is limited in scope and consequence. The vulnerability only affects the ACME enable/disable admin endpoints — other PKI subsystems (CA, KRA, OCSP, TPS) enforce authorization at the application layer and are not affected by this flaw. An attacker who exploits this flaw can only toggle the ACME service on or off. While re-enabling a disabled ACME service restores the full ACME protocol stack, certificate issuance through ACME still requires completing the standard RFC 8555 challenge-response flow, including proof of domain control — the enable/disable bypass alone does not grant the ability to obtain certificates. The ACME responder requires explicit installation and deployment and is not present in default PKI server configurations. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-288.
Medium [CVE-2026-58216] kpasswd service: kpasswd packet that contains malformed ASN.1 might cause the server to access 6 bytes of unallocated memory leading server to crash
An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service. Red Hat Product Security has rated this vulnerability as having a Moderate security impact. Successful exploitation requires an authenticated attacker to craft a malformed ASN.1-encoded Kerberos password change request that precisely triggers the underlying parsing flaw, increasing the attack complexity. The Samba project also notes that the attack is unreliable in practice and an attacker may need to perform numerous kpasswd attempts before successfully causing the service to terminate. ``` Standard RHEL Server Deployments (Not Affected): Default Red Hat Enterprise Linux (RHEL) deployments are not affected.
Medium [CVE-2026-58218] DNS signing DoS via TKEY name cache exhaustion
A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service. Red Hat Product Security has rated this vulnerability as having a Moderate security impact for Samba deployments operating as an Active Directory Domain Controller (AD DC) using the internal DNS server. ``` Red Hat Enterprise Linux (RHEL) context: Standard Red Hat Enterprise Linux deployments are not affected. RHEL does not support the Samba Active Directory Domain Controller (AD DC) role or its internal DNS server, where this vulnerability resides. ``` ``` Additionally, Samba AD DC deployments configured to use the external BIND9 DLZ backend instead of the internal DNS server are not affected by this vulnerability. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-410. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4 as not affected.
Medium [CVE-2026-58224] CTDB fails to do integrity checking of received packets
A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packet sizes to be processed without adequate bounds checking. A remote attacker with access to the CTDB private network may trigger a denial of service through process crashes or excessive memory consumption and, in limited cases, disclose adjacent memory contents. CTDB is an optional clustering component of Samba used strictly for multi-node active/active file sharing and is not installed, configured, or running by default on standard Red Hat Enterprise Linux (RHEL) deployments. Red Hat historically supported CTDB in RHEL High Availability and Resilient Storage configurations (including RHEL 6 and RHEL 7) and officially deprecated standalone CTDB usage as of RHEL 8.4 in favor of Pacemaker-managed cluster deployments. Network Architecture Mitigations: For legacy or historical environments actively utilizing CTDB via supported RHEL High Availability or Resilient Storage cluster configurations, Red Hat’s official Support Policies for RHEL High Availability Clusters explicitly mandate that CTDB private interconnect traffic must run on a dedicated, isolated private network segment segregated from client networks.
Medium [CVE-2024-14041] Bouncy Castle for Java: Private key recovery via timing side-channel in ML-KEM (CRYSTALS-Kyber) routines
In Bouncy Castle for Java from 1.73 to before 1.78, three ML-KEM (CRYSTALS-Kyber) routines divided secret-derived polynomial coefficients by the modulus q: Poly.toMsg, which decodes the decrypted message, and the ciphertext compression routines Poly.compressPoly and PolyVec.compressPolyVec. An attacker able to measure the timing of a large number of decapsulations performed with the same long-term private key can recover that key. Compression performed during encapsulation operates on values that become the public ciphertext and is not affected. Successful exploitation allows the attacker to recover the long-term private key, leading to a significant compromise of cryptographic security. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-208. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform Expansion Pack. Red Hat does not currently list a fixing RHSA for this CVE.
Low [CVE-2026-6879] Performance degradation in XML processing due to quadratic time complexity
Performance degradation in XML processing due to quadratic time complexity. Red Hat rates this low (CVSS 2.2). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:54534 with package python3-12-main-3.12.13-3.8.hum1, python3-10-main-3.10.20-3.2.hum1, python3-14-main-3.14.7-1.hum1, python3-14-main-3.14.6-2.2.hum1.
Low [CVE-2026-58341] CSRF risk in group messaging state toggle
CSRF risk in group messaging state toggle. Red Hat rates this moderate (CVSS 3.5). Weakness: CWE-22.
Low [CVE-2026-17072] 4-byte heap over-read in gst_matroska_parse_flac_stream_headers when parsing FLAC codec data in Matroska containers
A flaw was found in GStreamer's gst-plugins-good. A heap-based out-of-bounds read of 4 bytes can occur when parsing FLAC audio stream headers embedded in a Matroska or WebM container file. The vulnerability is triggered by a boundary check that does not account for the full size of the data being copied, allowing a small read past the end of the allocated buffer. An attacker could exploit this by crafting a malicious Matroska or WebM file and tricking a user into opening it, potentially leaking a small amount of adjacent heap memory. This vulnerability is rated as Low severity because the out-of-bounds read is limited to 4 bytes, is read-only (no memory corruption), and the read cannot be directly observed or controlled by a remote attacker. User interaction is required to trigger it, as a victim must open a crafted Matroska or WebM media file. In practice, modern heap allocators align allocations such that the 4 overread bytes typically fall within adjacent allocated memory, making a crash unlikely in production builds. Red Hat Enterprise Linux 8, 9, 10, and Red Hat In-Vehicle OS 2 ship gstreamer1-plugins-good with the affected Matroska demuxer code path and are affected. All RHEL and RHIVOS streams are deferred (low severity, low exploitability). Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Weakness: CWE-125.
High [CVE-2026-64649] Server-Side Request Forgery via malicious host redirection in Server Actions
Next.js is a React framework for building full-stack web applications. In versions 14.1.1 through 15.5.20 and 16.0.0 through 16.2.10, when a Server Action forwards or redirects a request, an attacker can cause the server to send that outbound request to a malicious host (Server-Side Request Forgery). This requires the attacker's request to control Host-associated headers. In some configurations, it's also possible to obtain internal values that weaken middleware/proxy authorization. Applications that use Server Actions are affected when the incoming host header is not fixed to a trusted value. This typically occurs on custom servers, or on deployments not behind a proxy that pins the host. Managed hosting pins the host upstream and is not affected; next start and standalone output do the same from version 14.2 onward. This issue has been fixed in versions 15.5.21 and 16.2.11. This can lead to Server-Side Request Forgery (SSRF), where the server is tricked into making requests to an attacker-controlled host. Such an attack could potentially expose internal system information or bypass authorization controls. This Important Server-Side Request Forgery (SSRF) flaw in Next.js Server Actions allows an attacker to redirect outbound requests to a malicious host.
High [CVE-2026-64648] Information disclosure via server-side fetch cache
Next.js is a React framework for building full-stack web applications. In versions 12.0.0 through 15.5.20 and 16.0.0 through 16.2.10, a server-side fetch with a request body may return a cached response body from a different request to the same URL but different body. Confidential data in the POST's response body would then leak to unauthorized requests. Though the request itself will not be deduped. This only applies to fetch calls with a request that has a different init than the one passed to fetch. An unsafe request would be: fetch(new Request(init), aDifferentInit). This issue has been fixed in versions 15.5.21 and 16.2.11. A flaw was found in Next.js. The vulnerability is triggered by specific unsafe fetch patterns where the request object's initialization differs from the fetch call's initialization. Red Hat customers using Next.js applications should review their fetch implementations, noting that applications built with Pages Router are not impacted. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-524. Affected Red Hat products: Streams for Apache Kafka 3.2.1; Red Hat Enterprise Linux AI (RHEL AI) 3; streams for Apache Kafka 2. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Trusted Artifact Signer as not affected.
High [CVE-2026-12383] ExternalEventStreamViewSet trusts Subject header without validation and leaks expected DN
A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication without verifying that the header originated from a trusted proxy. Additionally, the expected certificate Distinguished Name is leaked in the 403 error response body. An attacker who can reach the EDA API endpoint with a spoofed Subject header can inject arbitrary events into mTLS-protected event streams, triggering downstream automation actions. This flaw is a defense-in-depth failure in EDA that becomes exploitable when combined with the gateway header-forwarding issue (tracked as a separate CVE). The DN leak in the error response further reduces the difficulty of exploitation. EDA has been included in AAP since version 2.4. The mTLS external event stream feature and the trust-of-Subject-header pattern apply to all EDA versions that support external event streams with mTLS authentication. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-345. Affected Red Hat products: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Ansible Automation Platform 2.7.
High [CVE-2026-66759] out-of-bounds read in file-icns plugin causes information disclosure or crash on crafted ICNS images
A flaw was found in the file-icns plugin in GIMP. When applying a decompressed mask during ICNS image processing, the plugin reads from the mask data buffer without verifying if the cursor exceeds the allocated resource size. If a crafted file contains a truncated mask resource, the icns_decompress function continues reading past the bounds of the buffer. This out-of-bounds read vulnerability results in information disclosure of heap contents, where memory contents are leaked as alpha channel pixel values, or a crash leading to a denial of service if unmapped memory is accessed. To exploit this vulnerability, an attacker needs to convince a user to process a specially crafted ICNS image with GIMP, reducing the likelihood of exploitation. Due to this reason, this flaw has been rated with a moderate severity. Red Hat severity: Moderate — CVSS 7.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:50817. Affected products named by the advisory: Red Hat package: gimp.
High [CVE-2026-66758] integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
A flaw was found in the file-fits plugin in GIMP. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an undersized heap-based buffer allocation. This integer overflow issue results in a heap-based buffer overflow when cfitsio subsequently writes a full row of pixels in the buffer, causing memory corruption, potentially leading to arbitrary code execution or a denial of service. To exploit this vulnerability, an attacker needs to convince a user to process a specially crafted FITS image with GIMP, reducing the likelihood of exploitation. However, successful exploitation may potentially lead to arbitrary code execution or a denial of service. Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability. Due to this reason, this flaw has been rated with an important severity. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.6 Extended Update Support; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
High [CVE-2026-64646] Denial of Service via excessive memory consumption in Server Actions
Next.js is a React framework for building full-stack web applications. In versions 13.0.0 through 15.5.20 and 16.0.0 through 16.2.10, requests targeting Next.js applications using App Router with at least one Server Action can lead to excessive memory consumption if that Server Actions uses the Edge runtime. This issue has been fixed in versions 15.5.21 and 16.2.11. A flaw was found in Next.js. This can lead to a denial of service (DoS) due to resource exhaustion. An Important denial of service flaw exists in Next.js applications utilizing the App Router with Server Actions configured to use the Edge runtime. This vulnerability can lead to excessive memory consumption, potentially causing service unavailability. Red Hat products that embed or deploy Next.js applications with this specific configuration are affected. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Streams for Apache Kafka 3.2.1; Red Hat Enterprise Linux AI (RHEL AI) 3; streams for Apache Kafka 2. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Trusted Artifact Signer as not affected. Red Hat fixing advisory: RHSA-2026:54435.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.