Red Hat Linux Security Advisories & CVEs
3038 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-56820] Certificate revocation bypass via OCSP response replay attack
Certificate revocation bypass via OCSP response replay attack. Red Hat rates this important (CVSS 7.4). Weakness: CWE-295.
High [CVE-2026-56819] Denial of Service via HTTP/2 DATA frame memory leak
Denial of Service via HTTP/2 DATA frame memory leak. Red Hat rates this important (CVSS 7.5). Weakness: CWE-911. Red Hat lists fixing advisory RHSA-2026:47172 with package netty-codec-http2.
High [CVE-2026-56817] Information disclosure via XML External Entity (XXE) vulnerability
Information disclosure via XML External Entity (XXE) vulnerability. Red Hat rates this important (CVSS 7.5). Weakness: CWE-611.
High [CVE-2026-56746] Security control bypass allows unauthorized requests via null origin header
Security control bypass allows unauthorized requests via null origin header. Red Hat rates this important (CVSS 7.5). Weakness: CWE-807. Red Hat lists fixing advisory RHSA-2026:47172 with package netty-codec-http.
High [CVE-2026-56745] Denial of Service via memory exhaustion in SPDY-to-HTTP codec
Denial of Service via memory exhaustion in SPDY-to-HTTP codec. Red Hat rates this important (CVSS 7.5). Weakness: CWE-772. Red Hat lists fixing advisory RHSA-2026:47172 with package netty-codec-http.
High [CVE-2026-55851] Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message
Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:47172 with package netty-codec-haproxy.
High [CVE-2026-47063] Enhance Jar handling (Oracle CPU 2026-07)
Enhance Jar handling (Oracle CPU 2026-07). Red Hat rates this important (CVSS 7.5). Weakness: CWE-347. Red Hat lists fixing advisory RHSA-2026:50281 with package java-21-openjdk-1:21.0.12.0.8-1.1.el8, java-25-openjdk-main-25.0.4.0.7-1.1.1.hum1, java-21-openjdk-1:21.0.12.0.8-1.1.el9, java-25-openjdk-windows. Affected products named by the advisory: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7.
High [CVE-2026-47057] Improve Nashorn index handling (Oracle CPU 2026-07)
Improve Nashorn index handling (Oracle CPU 2026-07). Red Hat rates this important (CVSS 7.5). Weakness: CWE-190. Red Hat lists fixing advisory RHSA-2026:42882 with package java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el7_9, java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10, java-1.8.0-openjdk-1:1.8.0.502.b07-1.2.el9, java-1.8.0-openjdk-windows. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-47058] Enhance Dataview Implementation (Oracle CPU 2026-07)
Enhance Dataview Implementation (Oracle CPU 2026-07). Red Hat rates this important (CVSS 7.4). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:42882 with package java-1.8.0-openjdk-1:1.8.0.502.b07-1.1.el7_9, java-1.8.0-ibm-1:1.8.0.8.70-1.el8_10, java-1.8.0-openjdk-1:1.8.0.502.b07-1.2.el9, java-1.8.0-openjdk-windows. Affected products named by the advisory: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-56852] Denial of Service via invalid UTF-8 input
Denial of Service via invalid UTF-8 input. Red Hat rates this important (CVSS 7.5). Weakness: CWE-835. Red Hat lists fixing advisory RHSA-2026:49360 with package prometheus3-5-main-3.5.5-0.3.hum1, buildah-main-1.45.0-2.hum1, opentofu1-10-main-1.10.10-0.3.hum1, podman-main-6.0.2-2.1.hum1.
High [CVE-2026-11332 +1] argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)
argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332). Red Hat rates this important (CVSS 7.8). Weakness: CWE-88.
High [CVE-2026-59851] authentication bypass via missing GSSAPI principal check
authentication bypass via missing GSSAPI principal check. Red Hat rates this important (CVSS 8.8). Weakness: CWE-863. Red Hat lists fixing advisory RHSA-2026:42922 with package libssh-main-0.12.1-4.hum1. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Hardened Images.
High [CVE-2026-46681] @nevware21/ts-utils: @nevware21/ts-utils: Arbitrary Code Execution via Prototype Pollution
@nevware21/ts-utils: @nevware21/ts-utils: Arbitrary Code Execution via Prototype Pollution. Red Hat rates this important (CVSS 7.5). Weakness: CWE-915.
High [CVE-2026-16445] Root code execution via DHCP options command injection in NetworkManager initrd module
Root code execution via DHCP options command injection in NetworkManager initrd module. Red Hat rates this important (CVSS 7.5). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:40700 with package dracut-0:049-244.git20260529.el8_10, dracut-main-109-7.hum1. Affected product named by the advisory: Red Hat Enterprise Linux 8. Affected products named by the advisory: Red Hat Hardened Images; Red Hat OpenShift Container Platform 4.
High [CVE-2026-16361] Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13
Memory safety bugs fixed in Firefox ESR 115.38 and Firefox ESR 140.13. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:47101 with package firefox-0:140.13.0-1.el10_2, firefox-0:140.13.0-1.el8_10, firefox-0:140.13.0-1.el9_8, thunderbird-0:140.13.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-16360] Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153
Memory safety bugs fixed in Firefox ESR 115.38, Firefox ESR 140.13 and Firefox 153. Red Hat rates this important (CVSS 7.5). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:47101 with package firefox-0:140.13.0-1.el10_2, firefox-0:140.13.0-1.el8_10, firefox-0:140.13.0-1.el9_8, thunderbird-0:140.13.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-16412] Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153
Memory safety bugs fixed in Firefox ESR 140.13 and Firefox 153. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:47101 with package firefox-0:140.13.0-1.el10_2, firefox-0:140.13.0-1.el8_10, firefox-0:140.13.0-1.el9_8, thunderbird-0:140.13.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-16411] Memory safety bugs fixed in Firefox 153
Memory safety bugs fixed in Firefox 153. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825.
High [CVE-2026-16357] Incorrect boundary conditions in the Graphics component
Incorrect boundary conditions in the Graphics component. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-787. Red Hat lists fixing advisory RHSA-2026:47101 with package firefox-0:140.13.0-1.el10_2, firefox-0:140.13.0-1.el8_10, firefox-0:140.13.0-1.el9_8, thunderbird-0:140.13.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
High [CVE-2026-16356] Sandbox escape due to use-after-free in the Disability Access APIs component
Sandbox escape due to use-after-free in the Disability Access APIs component. Red Hat rates this important (CVSS 7.5). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:47101 with package firefox-0:140.13.0-1.el10_2, firefox-0:140.13.0-1.el8_10, firefox-0:140.13.0-1.el9_8, thunderbird-0:140.13.0-1.el10_2. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.