Red Hat Linux Security Advisories & CVEs
4597 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-88012] Denial of Service via slow HTTP/3 request bodies
Denial of Service via slow HTTP/3 request bodies. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected product named by the advisory: Red Hat OpenShift Dev Spaces.
High [CVE-2026-88009] Authorization bypass and access-log evasion via crafted HTTP/1 request
Authorization bypass and access-log evasion via crafted HTTP/1 request. Red Hat rates this important (CVSS 8.2). Weakness: CWE-551. Affected product named by the advisory: Red Hat OpenShift Dev Spaces.
High [CVE-2026-88889] Remote code execution via command injection in Maven Wrapper manager
Remote code execution via command injection in Maven Wrapper manager. Red Hat rates this important (CVSS 8.8). Weakness: CWE-78.
High [CVE-2026-88888] Command Injection via Mix organization
Command Injection via Mix organization. Red Hat rates this moderate (CVSS 7). Weakness: CWE-78.
High [CVE-2026-88886] Arbitrary Command Execution via crafted Gradle Wrapper distributionUrl
Arbitrary Command Execution via crafted Gradle Wrapper distributionUrl. Red Hat rates this important (CVSS 7.5). Weakness: CWE-78.
High [CVE-2026-88878] Denial of Service via HTTP/3 timeout bypass
Denial of Service via HTTP/3 timeout bypass. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Affected product named by the advisory: Red Hat OpenShift Dev Spaces.
High [CVE-2026-87962] Denial of Service via unvalidated length fields
Denial of Service via unvalidated length fields. Red Hat rates this important (CVSS 7.5). Weakness: CWE-125. Affected product named by the advisory: Red Hat Offline Knowledge Portal.
High [CVE-2026-57967] Apache Artemis — session hijack via missing authentication
Apache Artemis — session hijack via missing authentication. Red Hat rates this important (CVSS 7.4). Weakness: CWE-306. Red Hat lists fixing advisory RHSA-2026:66488 with package eap8-jackson-annotations-0:2.18.9-1.redhat_00003.1.el10eap, eap8-jbossws-cxf-0:7.4.0-1.Final_redhat_00001.1.el8eap, eap8-wildfly-0:8.1.8-9.GA_redhat_00006.1.el9eap, eap7-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el9eap. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8; and 1 more. Affected products named by the advisory: Red Hat JBoss Enterprise Application Platform Expansion Pack.
High [CVE-2026-49364] artemis cluster password leak via jgroups spoof
artemis cluster password leak via jgroups spoof. Red Hat rates this important (CVSS 8). Red Hat lists fixing advisory RHSA-2026:66488 with package eap8-jackson-annotations-0:2.18.9-1.redhat_00003.1.el10eap, eap8-jbossws-cxf-0:7.4.0-1.Final_redhat_00001.1.el8eap, eap8-wildfly-0:8.1.8-9.GA_redhat_00006.1.el9eap, eap7-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el9eap. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-49362] artemis core protocol permits unauthed queue creation
artemis core protocol permits unauthed queue creation. Red Hat rates this important (CVSS 8.2). Red Hat lists fixing advisory RHSA-2026:66488 with package eap8-jackson-annotations-0:2.18.9-1.redhat_00003.1.el10eap, eap8-jbossws-cxf-0:7.4.0-1.Final_redhat_00001.1.el8eap, eap8-wildfly-0:8.1.8-9.GA_redhat_00006.1.el9eap, eap7-jackson-modules-java8-0:2.18.9-1.redhat_00003.1.el9eap. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat JBoss Enterprise Application Platform 7; Red Hat JBoss Enterprise Application Platform 8.
High [CVE-2026-67593] pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo
pre-authentication arbitrary durable queue deletion via OpenWire RemoveSubscriptionInfo. Red Hat rates this important (CVSS 8.2). Weakness: CWE-306. Red Hat lists fixing advisory RHSA-2026:66488 with package artemis-openwire-protocol. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1.
High [CVE-2026-84939] Path traversal via malformed locale identifier
Path traversal via malformed locale identifier. Red Hat rates this important (CVSS 7.5). Weakness: CWE-22. Affected products named by the advisory: Red Hat build of Quarkus; Red Hat Single Sign-On 7.
High [CVE-2026-93560] STOMP codec content-length long-to-int truncation causes infinite decode loop DoS
STOMP codec content-length long-to-int truncation causes infinite decode loop DoS. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1035. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Single Sign-On 7.
High [CVE-2026-93494] ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated
ByteBuf Leak in StompSubframeDecoder When a Frame Body Is Never Terminated. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1035. Affected products named by the advisory: Red Hat build of Apache Camel for Spring Boot 4; Red Hat Fuse 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Single Sign-On 7.
High [CVE-2026-87933] Memory corruption via use after free in cJSONUtils_MergePatch
Memory corruption via use after free in cJSONUtils_MergePatch. Red Hat rates this important (CVSS 8.6). Weakness: CWE-825. Affected product named by the advisory: Red Hat Satellite 6.
High [CVE-2026-84042] rootful krun with passt executes container payload as host root
rootful krun with passt executes container payload as host root. Red Hat rates this important (CVSS 7.8). Weakness: CWE-269.
High [CVE-2026-89060] stolostron/multicluster-observability-addon: Cross-namespace Secret disclosure in multicluster-observability-addon via unvalidated configuration references
stolostron/multicluster-observability-addon: Cross-namespace Secret disclosure in multicluster-observability-addon via unvalidated configuration references. Red Hat rates this important (CVSS 7.7). Weakness: CWE-551. Red Hat lists fixing advisory RHSA-2026:67542 with package rhacm2/acm-multicluster-observability-addon-rhel9:1789126262, rhacm2/acm-multicluster-observability-addon-rhel9:1789126267, rhacm2/acm-multicluster-observability-addon-rhel9:1789126264. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.13; Red Hat Advanced Cluster Management for Kubernetes 2.14; Red Hat Advanced Cluster Management for Kubernetes 2.15; Red Hat Advanced Cluster Management for Kubernetes 2.16; and 1 more. Affected products named by the advisory: Red Hat Advanced Cluster Management for Kubernetes 2.17.
High [CVE-2026-19816] PackageKit dnf5 ignores SIMULATE on RepoRemove
PackageKit dnf5 ignores SIMULATE on RepoRemove. Red Hat rates this important (CVSS 7.1). Weakness: CWE-863.
High [CVE-2026-87877] Use-After-Free vulnerability allows memory corruption and denial of service
Use-After-Free vulnerability allows memory corruption and denial of service. Red Hat rates this important (CVSS 7.7). Weakness: CWE-416. Red Hat lists fixing advisory RHSA-2026:71675 with package zstd-jni. Affected products named by the advisory: Exploit Intelligence; OpenShift Developer Tools and Services; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 9 more. Affected products named by the advisory: Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat build of Quarkus; Red Hat Ceph Storage 9; and 5 more.
High [CVE-2026-87824] Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect
Denial of Service (DoS) via out-of-bounds read in Zstd.trainFromBufferDirect. Red Hat rates this important (CVSS 7.5). Weakness: CWE-125. Red Hat lists fixing advisory RHSA-2026:71675 with package zstd-jni. Affected products named by the advisory: Exploit Intelligence; OpenShift Developer Tools and Services; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; and 9 more. Affected products named by the advisory: Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; Red Hat build of Quarkus; Red Hat Ceph Storage 9; and 5 more.