Red Hat Linux Security Advisories & CVEs
5518 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-93589] Denial of Service via division by zero in FLIF encoder
Denial of Service via division by zero in FLIF encoder. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-369. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat package: imagemagick.
Medium [CVE-2026-93492] HTTP/2 HpackEncoder DoS with large table size
HTTP/2 HpackEncoder DoS with large table size. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1035. Affected products named by the advisory: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; and 3 more. Affected products named by the advisory: Red Hat Build of Keycloak; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform 8.
Medium [CVE-2026-93578] Missing Extended Key Usage (EKU) check in OCSP Client allows certificate revocation bypass
Missing Extended Key Usage (EKU) check in OCSP Client allows certificate revocation bypass. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-1035. Affected product named by the advisory: Red Hat build of Apache Camel for Spring Boot 4.
Medium [CVE-2026-93314] Remote integer overflow vulnerability
Remote integer overflow vulnerability. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-190. Red Hat lists fixing advisory RHSA-2026:58482 with package poppler-main-26.08.0-1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-93313] Remote integer overflow vulnerability
Remote integer overflow vulnerability. Red Hat rates this moderate (CVSS 6.3). Weakness: CWE-190. Red Hat lists fixing advisory RHSA-2026:71625 with package poppler-main-26.08.0-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-93312] Denial of Service via null pointer dereference in JBIG2Stream::rewind function
Denial of Service via null pointer dereference in JBIG2Stream::rewind function. Red Hat rates this moderate (CVSS 4.3). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:58482 with package poppler-main-26.08.0-1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-93311] Denial of service via integer overflow in SampledFunction
Denial of service via integer overflow in SampledFunction. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-190. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-93451] Buffer overflow via malformed compressed input
Buffer overflow via malformed compressed input. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-131. Affected products named by the advisory: Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel for Spring Boot 4; Red Hat build of Apicurio Registry 3; Red Hat build of Debezium 3; and 8 more. Affected products named by the advisory: Red Hat build of Quarkus; Red Hat Ceph Storage 8; Red Hat Ceph Storage 9; Red Hat Fuse 7; and 4 more.
Medium [CVE-2026-93380] Race condition in FileSystem
Race condition in FileSystem. Red Hat rates this moderate (CVSS 4.4). Weakness: CWE-367.
Medium [CVE-2026-93387] Cross-origin data disclosure via improper state validation
Cross-origin data disclosure via improper state validation. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-346. Affected products named by the advisory: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat package: webkitgtk4; Red Hat package: webkit2gtk3.
Medium [CVE-2026-86049] Information disclosure via 5xx request logging
Information disclosure via 5xx request logging. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-117. Affected products named by the advisory: Migration Toolkit for Applications 8; Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-44235] Denial of Service via AMQP frame length underflow
Denial of Service via AMQP frame length underflow. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat package: librabbitmq.
Medium [CVE-2026-44236] Heap buffer overflow leading to denial of service
Heap buffer overflow leading to denial of service. Red Hat rates this important (CVSS 6.5). Weakness: CWE-131. Red Hat lists fixing advisory RHSA-2026:75582 with package librabbitmq-0:0.9.0-6.el8_10. Affected product named by the advisory: Red Hat Enterprise Linux 8.
Medium [CVE-2026-8674] glibc DNS stub resolver: Denial of Service via long search domain in configuration
glibc DNS stub resolver: Denial of Service via long search domain in configuration. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-1025. Red Hat lists fixing advisory RHSA-2026:69276 with package glibc-main-2.43-8.6.hum1. Affected products named by the advisory: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 2 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4; Red Hat package: glibc.
Medium [CVE-2026-85718] Denial of Service via TLS handshake failure
Denial of Service via TLS handshake failure. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-772. Affected product named by the advisory: Red Hat Fuse 7.
Medium [CVE-2026-85999] Denial of Service via crafted CSS selectors
Denial of Service via crafted CSS selectors. Red Hat rates this moderate (CVSS 5.9). Weakness: CWE-1333. Affected products named by the advisory: Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; OpenShift Lightspeed; and 6 more. Affected products named by the advisory: Red Hat Ansible Automation Platform 2; Red Hat OpenShift AI (RHOAI); Red Hat OpenShift Container Platform 4; Red Hat OpenShift Virtualization 4; and 2 more.
Medium [CVE-2026-76781] Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute
A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS). This Moderate flaw in libxml2's XML catalog parsing can lead to a denial of service. The vulnerability requires user interaction, as a specially crafted XML catalog with a missing `catalog` attribute in a `nextCatalog` element must be processed by an application using libxml2, causing it to crash. This limits the attack surface to scenarios where an attacker can provide malicious XML input to a vulnerable application. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Hardened Images as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2026:57604. Affected products named by the advisory: Red Hat package: libxml2; Red Hat package: podman.
Medium [CVE-2026-81829] Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver
Unauthenticated same-origin SSRF via unsanitized JWT kid header in AwsAlbKeyResolver. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-22. Affected products named by the advisory: Exploit Intelligence; Red Hat build of Apicurio Registry 3; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform Expansion Pack.
Medium [CVE-2026-92963] Sensitive information disclosure due to internal state access
Sensitive information disclosure due to internal state access. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-767.
Medium [CVE-2026-92952] Sandbox Symbol Filtering Bypass leading to Host Stream State Corruption
Sandbox Symbol Filtering Bypass leading to Host Stream State Corruption. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-184. Affected products named by the advisory: Red Hat Developer Hub; Self-service automation portal 2.