Red Hat Linux Security Advisories & CVEs
15666 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-10822] Key Record using PRIVATEDNS algorithm may lead to exit
If BIND encounters a particular invalid data structure in a DNS record, it will accept the invalid data, and may subsequently abort and exit. BIND will first need to store a DNS record for a key (KEY, DNSKEY, etc.). That key must specify a PRIVATEDNS algorithm (253), and in the algorithm identifier, improperly give a length longer than the actual identifier data. If BIND later needs to render that record to text, it will use the invalid length during processing, leading to a consistency check failing. This Moderate impact flaw in BIND allows a specially crafted DNS key record with a PRIVATEDNS algorithm and overlong algorithm identifier to cause the named daemon to abort when rendering the record to text. The attack requires prior storage of the malformed record (requiring user interaction), limiting the immediate risk to most Red Hat deployments. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-617. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2026:54071. Affected products named by the advisory: Red Hat package: bind9.16; Red Hat package: bind9.18; Red Hat package: dhcp.
Medium [CVE-2026-16566] jenkins_credential module returns generated API token in plaintext output
A flaw was found in the community.general Ansible collection's jenkins_credential module. When creating a Jenkins API token (credential_type: token), the module correctly protects the input password with no_log=True in the argument specification, but places the generated API token returned by the Jenkins API directly into the Ansible task result dictionary without output suppression. The token is emitted in plaintext via exit_json(), causing it to appear in Ansible task output, AWX/Tower/AAP Controller job logs, callback plugin output, CI/CD pipeline logs, and fact caching backends. An attacker with access to any of these output channels can obtain the Jenkins API token and gain the same privileges as the user who created it. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N). Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
Low [CVE-2026-56444] Denial of Service due to incorrect client reply accounting with specific serve-expired configuration
In NLnet Labs Unbound 1.20.0 up to and including 1.25.1, when Unbound is configured with 'serve-expired: yes' and 'serve-expired-client-timeout > discard-timeout > 0' (contrary to the suggested values), the discard-timeout branch during the serve expired logic drops an aged client reply without performing the correct accounting for the number of reply addresses for the query. Other identical branches outside of serve expired perform the correct decrement. Since the counter is never decremented in such scenario, it can reach the maximum limit and new clients for duplicate in-flight queries are silently dropped resulting in degradation of resolution service. A malicious actor can exploit the vulnerability by querying the resolver for a client-controlled slow-on-demand authoritative zone that can drive the counter past the threshold. A Denial of Service (DoS) flaw exists in Unbound under specific serve-expired and discard-timeout configurations. By sending crafted queries, a remote attacker can exhaust an internal counter, causing the server to drop new legitimate client queries and degrade resolution services. This Low-impact flaw in Unbound can lead to a denial of service. While a remote attacker could exhaust the reply address counter with specially crafted queries, Red Hat products are not affected by default.
Low [CVE-2026-54478] DNS Cookie security bypass via incorrect server cookie calculation
In NLnet Labs Unbound 1.18.0 up to and including 1.25.1, when Unbound listens on a 'proxy-protocol-port' interface with 'answer-cookie: yes', the RFC 9018 server-cookie SipHash is computed over the proxy's wire address instead of the PROXYv2-declared client. One server cookie obtained through a given proxy node therefore validates for every PROXYv2-declared source behind that node. On a UDP+proxy-protocol front, an off-path attacker can harvest one cookie with a single legitimate query, then replay it under any spoofed source and pass DNS Cookie checks that were deployed to defeat this in the first place. A flaw was found in Unbound. When Unbound is configured to listen on a proxy-protocol port with DNS cookies enabled, it incorrectly computes the server cookie using the proxy's network address instead of the actual client's address. This Low impact flaw in Unbound occurs when the DNS resolver is configured to use both `proxy-protocol-port` and `answer-cookie: yes`. The server cookie is incorrectly derived from the proxy's address, enabling an off-path attacker to bypass DNS Cookie security by replaying a harvested cookie. This vulnerability requires a specific, non-default configuration and has high attack complexity, limiting its impact. Red Hat severity: Low — CVSS 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N). Weakness: CWE-303.
Low [CVE-2026-50046] Denial of Service due to freed pointer dereference in DNS-over-TLS handling
In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path. A use-after-free flaw was found in Unbound's DNS-over-TLS (DoT) forwarded query handling.
Low [CVE-2026-46582] Information disclosure via DNSSEC wildcard replay
In NLnet Labs Unbound 1.6.0 up to and including 1.25.1, a replay of a wildcard rrset as another piece of data, could be briefly considered DNSSEC secure based only on the RRSIG validation and stored into cache, before later validation treats it as bogus based on NSEC validation. When the resolving thread puts secure on the rrset, and another thread that is on the serve expired path then picks up the updated rrset contents with the secure status for a reply, it can be used to change a specific record, next to a wildcard that could be covered by the wildcard, into the wildcard. A malicious actor can exploit the possible poisonous effect by having any DNSSEC-singed domain (irrelevant to the victim domain) and a CNAME wrapper record that points to a record next to a wildcard (that could be covered by the wildcard). Then quering Unbound for the wildcard sibling record would seed the secure message. A later (after expiry) query for the CNAME wrapper would need to resolve the target sibling record. If the wildcard replay is injected into the response, the wildcard rrset will update the expired sibling record with a secure status before completing proper wildcard validation with NSEC records and eventually treating the CNAME wrapper answer as bogus.
Low [CVE-2026-42955] DNS cache integrity issue
In NLnet Labs Unbound 1.16.2 up to and including 1.25.1, a similar vulnerability as with CVE-2026-40622 in the 'ghost domain names' family of attacks was found in Unbound that could extend the ghost domain window by up to one cached TTL configured value for A/AAAA glue records. Similar to other 'ghost domain names' attacks, an adversary needs to control a (ghost) zone and be able to query a vulnerable Unbound. A single client A/AAAA query can cause Unbound to overwrite the cached expired parent-side glue rrset and essentially extend the ghost domain window by up to one cached TTL configured value ('cache-max-ttl'). In configurations where 'harden-referral-path: yes' is used (non-default configuration), no client query is required since Unbound implicitly performs that query. This is a variant of CVE-2026-40622 which only addressed the NS query. A "ghost domain names" flaw in Unbound allows a remote attacker controlling a domain to manipulate cached DNS records. By extending the lifetime of outdated DNS information, an attacker can cause clients to receive stale or misleading DNS responses. This Low impact DNS cache integrity issue in Unbound allows an attacker to extend the window for serving outdated DNS information. The risk is elevated if the non-default `harden-referral-path: yes` configuration is enabled, as it removes the need for a client query.
Low [CVE-2026-41637] Denial of Service via terminated DNS-over-QUIC queries
In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, client terminated DNS-over-QUIC (DoQ) queries are not accounted properly by Unbound resulting in low-cost inflation of the waiting number of replies for already in-flight resolution queries. This results in degradation of resolution service for new clients for already in-flight queries. A malicious actor can exploit the vulnerability by issuing DoQ queries for query names that need resolution and proceeding on immediately terminating the query by one of STOP_SENDING/RESET_STREAM/CONNECTION_CLOSE QUIC frames. This vulnerability needs Unbound to be compiled with DoQ support ('--with-libngtcp2') and the 'quic-port' to be configured for the listening interfaces. Additionally, a malicious actor needs access to multiple source IPs to bypass the by-default configured 'wait-limit' option. A flaw was found in Unbound, a Domain Name System (DNS) resolver. This vulnerability is rated as Low impact. Unbound, as distributed in Red Hat products, is not typically configured with DNS-over-QUIC (DoQ) support enabled by default. Exploitation requires Unbound to be explicitly compiled with `--with-libngtcp2` and have `quic-port` configured, in addition to an attacker bypassing default rate limits with multiple source IPs. This makes successful exploitation difficult in standard Red Hat deployments.
Low [CVE-2026-44187] Ansible Lightspeed extension for Visual Studio Code: Information disclosure of Google Gemini API key
A flaw was found in the Ansible Lightspeed extension for Visual Studio Code. This vulnerability allows an attacker with local access to the workstation, or malware running with the user's privileges, to read the Google Gemini API key. The extension insecurely stores the API key in plain text within the user's configuration file and writes it to output log files. This information disclosure can lead to the attacker obtaining the API credential and potentially consuming the user's API quota. Note the VS Code extension is distributed via VS Code Marketplace, not shipped in AAP RPMs or containers. Red Hat severity: Low — CVSS 3.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-256. Red Hat lists Red Hat Ansible Automation Platform 2 as not affected.
High [CVE-2026-56820] Certificate revocation bypass via OCSP response replay attack
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and prior to 4.1.135.Final, `OcspClient` does not validate that the `CertificateID` in an OCSP response matches the requested `CertificateID`, which can lead to replay attack. `OcspClient.validateResponse` accepts a legitimately signed `GOOD` status response for an unrelated certificate issued by the same CA, allowing bypass of revocation checks for another certificate. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A flaw was found in Netty. The `OcspClient` component fails to validate that the Certificate ID in an Online Certificate Status Protocol (OCSP) response matches the requested Certificate ID. This can result in the acceptance of revoked certificates, potentially compromising the integrity and confidentiality of communications. This is an Important flaw in Netty's `OcspClient` that could allow a remote attacker to bypass certificate revocation checks. Exploitation requires high attack complexity, indicating specific conditions or attacker preparation. Red Hat severity: Important — CVSS 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). Weakness: CWE-295. Affected Red Hat products: Red Hat build of Apache Camel 4.18.3 for Spring Boot 3.5.16; Red Hat Data Grid 8.6.3.
High [CVE-2026-56819] Denial of Service via HTTP/2 DATA frame memory leak
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, a remote unauthenticated peer can leak one direct `ByteBuf` per HTTP/2 `DATA` frame in applications that enable HTTP/2 content decompression via `DelegatingDecompressorFrameListener`. When a `DATA` frame is processed for a stream whose decompressor has already been closed, `Http2Decompressor.decompress(...)` calls `decompressor.writeInbound(data.retain())` and does not release the retained buffer on the error path, eventually exhausting direct memory and crashing the JVM. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted HTTP/2 DATA frames to applications that use Netty and have HTTP/2 content decompression enabled. This can lead to memory exhaustion, causing the application to crash and resulting in a Denial of Service (DoS). This is an Important vulnerability in Netty's HTTP/2 codec, which could lead to a denial of service. Red Hat products utilizing netty-codec-http2 with HTTP/2 content decompression enabled are susceptible to memory exhaustion when processing specially crafted HTTP/2 DATA frames.
High [CVE-2026-56817] Information disclosure via XML External Entity (XXE) vulnerability
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, any caller that can deliver bytes to a Netty channel pipeline containing `XmlDecoder` can send XML with a `DOCTYPE` declaration to an `AsyncXMLInputFactory` instantiated with no security configuration, leaving DTD and entity handling active depending on Aalto XML async parser behavior and creating conditional XML external entity risk. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A remote attacker could exploit this vulnerability by sending specially crafted XML data containing a DOCTYPE declaration to a vulnerable XmlDecoder within the Netty channel pipeline. This can lead to an XML External Entity (XXE) vulnerability, potentially allowing the attacker to disclose sensitive information from the system. This Important flaw in Netty's `XmlDecoder` component allows for XML External Entity (XXE) injection. When a Netty channel pipeline processes XML data with a `DOCTYPE` declaration via an `AsyncXMLInputFactory` that lacks proper security configuration, a remote attacker could potentially disclose sensitive information. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-611.
High [CVE-2026-56746] Security control bypass allows unauthorized requests via null origin header
Netty is a network application framework for development of protocol servers and clients. Versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, are vulnerable to security control bypass during the origin evaluation process. CorsHandler provides a shortCircuit() configuration designed to reject unauthorized cross-origin requests immediately, acting as a security control before requests reach the application. However, due to a logical operator error in the origin evaluation process, this protection can be entirely bypassed. An attacker can bypass the short-circuit mechanism by sending a request with an Origin: null header. This failure forwards unauthorized requests to the backend application, bypassing intended access controls. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. This could lead to a compromise of data integrity by allowing unauthorized actions. Red Hat ships Netty's netty-codec-http component in multiple products. Upgrade to Netty 4.1.136.Final or 4.2.16.Final to resolve this issue. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-807. Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Build of Apache Camel 3.33.2.SP3; and 25 more.
High [CVE-2026-56745] Denial of Service via memory exhaustion in SPDY-to-HTTP codec
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final through 4.2.15.Final and 4.1.0.Final through 4.1.135.Final, the `SpdyHttpDecoder` handler in Netty's SPDY-to-HTTP codec allocates a pooled `ByteBuf` when processing a client-initiated `SYN_STREAM` frame with `FLAG_FIN=0` and stores the partially constructed `FullHttpRequest` in `messageMap`; when the remote peer sends `RST_STREAM` for that stream or the accumulated content exceeds `maxContentLength`, the decoder removes the entry but does not release the pooled `ByteBuf`, causing native memory exhaustion. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A flaw was found in Netty. This oversight leads to native memory exhaustion, which can result in a Denial of Service (DoS) for the affected system. This is an Important denial of service vulnerability in Netty's SPDY-to-HTTP codec, affecting Red Hat products that utilize vulnerable versions of Netty. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-772. Affected products named by the advisory: Cryostat 4 on RHEL 9; Red Hat AMQ Broker 7.13.6; Red Hat AMQ Broker 7.14.1; Red Hat Build of Apache Camel 3.33.2.SP3; and 24 more.
High [CVE-2026-55851] Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message
Netty is a network application framework for development of protocol servers and clients. In versions 4.2.0.Final up to (but not including) 4.2.16.Final, and 4.1.0.Final up to (but not including) 4.1.135, the `HAProxyMessageDecoder` in Netty's `codec-haproxy` module performs protocol version detection by reading the 13th byte as a signed Java `byte` and widening it to `int` without masking; a PROXY protocol v2 binary prefix followed by version byte `0xFF` sign-extends to `-1`, collides with the decoder's need-more-data sentinel, and causes `ByteToMessageDecoder` to accumulate inbound bytes in an unbounded `cumulation` buffer until direct memory is exhausted. This issue is fixed in versions 4.1.136.Final and 4.2.16.Final. A remote attacker could exploit a vulnerability in the HAProxyMessageDecoder by sending a specially crafted PROXY protocol v2 message. This leads to unbounded buffer accumulation, causing a denial of service (DoS) due to memory exhaustion. This impact is significant for applications that process PROXY protocol v2 messages using the affected Netty component. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
High [CVE-2026-47063] Enhance Jar handling (Oracle CPU 2026-07)
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). A flaw was found in OpenJDK. There exists a potential existential forgery vulnerability in CMS and protocols which use CMS. In Java, CMS is used to sign JAR files. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-347. Affected products named by the advisory: OPENJDK ELS 11.0.32; Red Hat Build of OpenJDK 17.0.20; Red Hat Build of OpenJDK 21.0.12; Red Hat Build of OpenJDK 25.0.4; and 21 more. Affected products named by the advisory: Red Hat Build of OpenJDK 8u502; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 17 more.
High [CVE-2026-47057] Improve Nashorn index handling (Oracle CPU 2026-07)
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Oracle Java SE. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). A flaw was found in OpenJDK. There is an integer overflow in TypedArray.prototype.set() which can cause a DoS. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-190.
High [CVE-2026-47058] Enhance Dataview Implementation (Oracle CPU 2026-07)
Vulnerability in Oracle Java SE (component: Scripting). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf and 11.0.31. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Oracle Java SE. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle Java SE accessible data as well as unauthorized access to critical data or complete access to all Oracle Java SE accessible data. Note: This vulnerability can be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. This vulnerability also applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets, that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. CVSS 3.1 Base Score 7.4 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N). A flaw was found in OpenJDK. 1) DataView getter/setter methods use absolute ByteBuffer indexing and ignore the offset, allowing read and write to memory outside its intended window. 2) Missing bounds check in the DataView constructor fails to validate the capacity.
High [CVE-2026-56852] Denial of Service via invalid UTF-8 input
Denial of Service via invalid UTF-8 input. Red Hat rates this important (CVSS 7.5). Weakness: CWE-835. Red Hat lists fixing advisory RHSA-2026:49360 with package prometheus3-5-main-3.5.5-0.3.hum1, buildah-main-1.45.0-2.hum1, opentofu1-10-main-1.10.10-0.3.hum1, podman-main-6.0.2-2.1.hum1.
High [CVE-2026-11332 +1] argument injection in ansible-galaxy collection install via git clone (incomplete fix for CVE-2026-11332)
A flaw was found in ansible-core. An attacker who provides a crafted collection source URI containing git argument injection payloads can achieve arbitrary command execution when a user runs 'ansible-galaxy collection install' with the malicious source. This is an incomplete fix for CVE-2026-11332, which hardened the role install path but missed the equivalent collection install code path. Red Hat has assessed this vulnerability as Important because it allows arbitrary command execution when a user installs a collection from a crafted git source. Users who install collections exclusively from Ansible Galaxy or Automation Hub (HTTPS sources) are not exposed to this specific flaw. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-88. Affected Red Hat products: Red Hat Satellite 6.17 for RHEL 9; Red Hat Satellite 6.18 for RHEL 9; Red Hat Satellite 6.19 for RHEL 9; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat fixing advisory: RHSA-2026:63387, RHSA-2026:63386, RHSA-2026:63385. Affected products named by the advisory: Red Hat package: ansible-core.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.