Red Hat Linux Security Advisories & CVEs
4620 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-66835] Erlang/OTP inets httpd: Directory protection bypass allows information disclosure
Path Equivalence vulnerability in Erlang/OTP inets httpd allows a remote unauthenticated attacker to read files inside a mod_auth protected directory by prefixing the request path with an extra slash. httpd_request:validate_uri/1 normalises the request URI with uri_string:normalize/1, which performs RFC 3986 dot-segment removal but does not collapse empty path segments, so a doubled slash survives. mod_alias:real_name/3 concatenates the document root with that URI, and mod_auth:secret_path/3 then decides whether the result lies inside a protected directory block by running the configured directory path as an unanchored regular expression against it. The doubled slash breaks the contiguous substring the regex needs, so the request is treated as unprotected and no authentication challenge is issued, while mod_get opens the same path and the operating system collapses the doubled slash and returns the protected file. The same path mismatch also evades the per-path accounting in mod_security. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-83618] @xmldom/xmldom: xmldom: DocumentType injection bypass via embedded line terminators
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.10 until 0.9.12, the requireWellFormed: true serializer validates DocumentType.publicId and DocumentType.systemId with PubidLiteral_match and SystemLiteral_match expressions produced by reg() in lib/grammar.js, which inherit the multiline flag. A complete valid literal on the first line can therefore satisfy the matcher while U+000A, U+000D, U+2028, or U+2029 and breakout markup remain in the emitted declaration. This bypasses the strict-serialization mitigation for the earlier DocumentType injection advisory; creation and direct property assignment remain unvalidated by design. This issue is fixed in @xmldom/xmldom version 0.9.12. A remote attacker could bypass the `requireWellFormed` strict-serialization mitigation for DocumentType injection by embedding line terminators within the `publicId` or `systemId` of a DocumentType declaration. This allows for the injection of arbitrary markup into the XML output, potentially leading to data manipulation or other security impacts depending on how the XML is processed. A flaw was found in the @xmldom/xmldom JavaScript package. A remote attacker can embed line terminators (U+000A, U+000D, U+2028, U+2029) and breakout markup within DocumentType declarations to bypass strict-serialization checks.
High [CVE-2026-83617] @xmldom/xmldom: xmldom: XML injection via embedded line terminator in element/attribute names
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.11 until 0.9.12, the requireWellFormed: true element and attribute name checks use the anchored QName_exact expression produced by reg() in lib/grammar.js, which inherits the multiline flag. A name with a valid first line followed by U+000A, U+000D, U+2028, or U+2029 and breakout markup therefore passes validation and is emitted verbatim in element start and end tags or attribute names. This bypasses the strict-serialization checks introduced for the earlier element-name and attribute-name injection advisories, while the default serialization path remains outside the strict guarantee. This issue is fixed in @xmldom/xmldom version 0.9.12. A flaw was found in the @xmldom/xmldom library. The requireWellFormed validation for XML element and attribute names can be bypassed by embedding specific line terminator characters. This allows an attacker to inject malformed XML into the document, potentially leading to XML injection vulnerabilities and bypassing security checks designed to prevent such issues. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-91. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Fuse 7; Red Hat OpenShift AI (RHOAI).
High [CVE-2026-83616] XML Structure Injection via Unvalidated Processing Instruction Targets
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, Document.createProcessingInstruction(target, data) in lib/dom.js accepts an unvalidated target, while the requireWellFormed: true serializer checks only for a colon and the reserved case-insensitive xml name on 0.9.x and performs no target check on 0.8.x. Because serialization emits, a target containing >,?, whitespace, or another invalid XML-name character can break the processing-instruction boundary and inject XML structure. A flaw was found in xmldom, a JavaScript module for parsing and serializing XML. An attacker can exploit a vulnerability in how processing instructions are handled to inject arbitrary XML structures. This occurs because the software fails to properly validate input, allowing special characters to bypass security checks. Successful exploitation could lead to data manipulation or other integrity impacts within applications processing the affected XML. The Document.createProcessingInstruction() function in lib/dom.js fails to validate target strings, and XMLSerializer.serializeToString() with requireWellFormed: true performs insufficient target validation.
High [CVE-2026-74835] inets httpd: Denial of Service due to memory exhaustion via unenforced body-size limit
The inets application HTTP server httpd fails to enforce a configured body-size limit on chunked request. This issue affects OTP from OTP 17.0 before OTP 27.3.4.17, from OTP 28.0 before OTP 28.5.0.6, and from OTP 29.0 before OTP 29.0.6, corresponding to inets from 5.10 before 9.3.2.7, from 9.4 before 9.6.2.3, and from 9.7 before 9.7.2. This can lead to memory exhaustion, causing a Denial of Service (DoS) on the affected system. This is an Important denial of service vulnerability in the `inets` HTTP server, which is used in certain Red Hat products. A remote, unauthenticated attacker can exhaust system memory by sending a specially crafted chunked HTTP request. This occurs because the server fails to enforce configured `max_body_size` limits on incomplete chunked requests, leading to unbounded data buffering and resource exhaustion. The vulnerability primarily impacts deployments where `max_body_size` was explicitly configured for hardening. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1284. Affected Red Hat products: Red Hat Hardened Images; Red Hat OpenShift Dev Spaces. Red Hat lists Cryostat 4; Red Hat Advanced Cluster Management for Kubernetes 2 as not affected. Red Hat fixing advisory: RHSA-2026:62531.
High [CVE-2026-83615] @xmldom/xmldom: xmldom: Denial of Service via quadratic memory consumption
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.1.5 through 0.6.0, appendElement in lib/sax.js uses _copy to clone the complete currentNSMap for each nested element that declares a new namespace prefix. Keeping every ancestor map live on the parse stack creates quadratic peak namespace-map storage, so a small highly compressible XML document can exhaust the process heap before application validation. A flaw was found in xmldom, a JavaScript library for parsing XML documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document. When processed, this document would cause the library to consume an excessive amount of memory, leading to the application running out of resources and becoming unavailable, a condition known as Denial of Service (DoS). This is an Important denial of service vulnerability in the `xmldom` library, affecting Red Hat products that process untrusted XML input. Exploitation involves providing a crafted XML document with deeply nested elements and new namespace prefixes, which can lead to quadratic memory consumption and exhaust the process heap, causing service disruption. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770.
High [CVE-2026-73812] HTTP Request Smuggling allows bypassing security controls
HTTP Request Smuggling allows bypassing security controls. Red Hat rates this important (CVSS 8.2). Weakness: CWE-444. Red Hat lists fixing advisory RHSA-2026:62531 with package erlang27-main-27.3.4.17-0.1.hum1. Affected products named by the advisory: Red Hat Hardened Images; Cryostat 4; Red Hat Advanced Cluster Management for Kubernetes 2; Red Hat OpenShift Dev Spaces.
High [CVE-2026-83614] @xmldom/xmldom: xmldom: Denial of Service via quadratic-time XML parsing
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom versions 0.3.0 through 0.6.0, two independent quadratic paths can cause denial of service. In lib/sax.js, parseElementStartPart repeatedly rescans a malformed tag name to the next > during single-character recovery; in lib/dom.js, normalize() repeatedly removes and appends adjacent text nodes, causing quadratic reindexing and string rebuilding. The first path is reachable through default DOMParser.parseFromString() processing, while the second is also reachable through a direct normalize() call on a programmatically constructed DOM, and endDocument invokes that normalization after parsing. This issue is fixed in @xmldom/xmldom versions 0.8.15 and 0.9.12; no fixed version is available for xmldom. A flaw was found in xmldom. A remote attacker could exploit this by providing specially crafted XML input, causing the parser to repeatedly rescan malformed tag names or reindex and rebuild strings during normalization. This excessive processing consumes system resources, making the application unresponsive. Important: A denial of service flaw exists in the xmldom library due to quadratic-time processing of malformed XML input.
High [CVE-2026-83613] @xmldom/xmldom: xmldom: Denial of Service due to quadratic-time attribute processing
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.15 and 0.9.12, and in xmldom version 0.6.0 and earlier, DOMHandler.startElement in lib/dom-parser.js inserts every parsed attribute through setAttributeNode, while NamedNodeMap.setNamedItem in lib/dom.js calls the linear getNamedItem or getNamedItemNS lookup for each insertion. A well-formed element with many distinct attributes therefore requires quadratic comparisons during DOMParser.parseFromString() and can stall a Node.js event loop before application validation. A flaw was found in xmldom, a JavaScript module for parsing XML (Extensible Markup Language) documents. A remote attacker could exploit this vulnerability by providing a specially crafted XML document containing an element with numerous distinct attributes. The way xmldom processes these attributes leads to a significant performance degradation, consuming excessive computational resources. This can cause the application using xmldom to become unresponsive, resulting in a Denial of Service (DoS). This is an Important denial of service vulnerability in the xmldom library, affecting Red Hat products that process untrusted XML input.
High [CVE-2026-83612] Denial of Service via crafted HTML with mixed-case tags
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.1 until 0.9.12, HTML-mode parsing through DOMParser.parseFromString() mishandles a mixed-case closing tag for the script, style, textarea, or title raw-text elements. parseHtmlSpecialContent, selected by isHTMLRawTextElement or isHTMLEscapableRawTextElement, uses a case-sensitive indexOf() and then calls substring() with a missing-close result of negative one, causing unstable parser progression and quadratic output amplification. A small untrusted text/html document can consequently consume disproportionate CPU and memory when parsed and serialized. This issue is fixed in @xmldom/xmldom version 0.9.12. A flaw was found in xmldom, a JavaScript module used for parsing HTML documents. This vulnerability allows a remote attacker to craft a malicious HTML document with specific mixed-case closing tags. When processed, this document can cause the parser to consume excessive CPU and memory, leading to a denial of service for the application. An attacker supplying a crafted HTML document can induce negative index substring slicing, leading to parser progression failure and output amplification. This results in excessive CPU and memory consumption, causing a Denial of Service (DoS) for applications processing untrusted HTML input.
High [CVE-2026-70399] Denial of Service via unenforced connection limit
Allocation of Resources Without Limits or Throttling vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by opening and holding open a large number of connections. The max_clients option is documented to default to 150, and the inets hardening guide presents that limit as the first layer of denial-of-service defence, but a server that does not set it explicitly accepts an unlimited number of simultaneous connections. Establishing the connections is sufficient; no valid request and no authentication are required. The accept gate in httpd_manager:handle_new_connection/4 reads the option with httpd_util:lookup/2, which returns undefined when the key is absent, rather than the three-argument form carrying the 150 default that the neighbouring get_ustate/2 uses. Erlang term ordering places every integer before every atom, so the Count =< Max guard holds for any connection count and the server never returns {reject, busy}. Each accepted connection occupies a worker process and a socket for as long as it is held, driving the node towards process, memory and file descriptor exhaustion. Servers that set max_clients explicitly are unaffected, because a configured value is applied as intended. Affected product named by the advisory: Red Hat Hardened Images.
High [CVE-2026-83609] @xmldom/xmldom: xmldom: Markup injection via embedded line terminators in XML names
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0 until 0.9.12, the shared reg() builder in lib/grammar.js compiles the anchored QName_exact validator with the multiline flag, so ^ and $ validate only one line instead of the complete name. createElementNS, createAttributeNS, createDocumentType, and createAttribute consequently accept a malformed XML name whose first line is valid and whose later text injects markup when serialized through either the default path or requireWellFormed: true. The triggering ECMAScript line terminators are U+000A, U+000D, U+2028, and U+2029. This issue is fixed in @xmldom/xmldom version 0.9.12. A flaw was found in xmldom. The XML DOM (Document Object Model) parser incorrectly validates XML names, allowing embedded line terminators. This vulnerability enables an attacker to inject additional markup into XML documents during serialization, potentially leading to malformed XML output. This is an Important flaw in the xmldom library, affecting Red Hat products that process XML documents using this component. The vulnerability allows for markup injection due to insufficient validation of XML names containing line terminators. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-91.
High [CVE-2026-83607] Cross-site scripting via unvalidated element name injection
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Document.createElement(tagName) stores an unvalidated element name and XMLSerializer.serializeToString() emits that name verbatim. The requireWellFormed: true path did not validate the element qualified name or synthesized xmlns:PREFIX declaration, so attacker-controlled tag names could inject attributes, elements, or processing instructions into serialized XML or HTML and could cause cross-site scripting when browser-consumed. The unchecked values violate the XML QName constraint, and default serialization and creation-time createElement() behavior remain permissive. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom. This occurs because the `Document.createElement()` function does not properly validate element names, and the `XMLSerializer.serializeToString()` function then outputs these unvalidated names directly. When these manipulated documents are processed by a web browser, it can lead to cross-site scripting (XSS), enabling attackers to execute arbitrary scripts in the user's browser. A flaw was found in the xmldom JavaScript package.
High [CVE-2026-83606] @xmldom/xmldom: xmldom: Denial of Service via regular expression backtracking in processing instructions
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. From 0.9.0-beta.9 until 0.9.11, the processing-instruction production in lib/grammar.js lets the greedy S+ separator and lazy Char*? data group repeatedly repartition a long whitespace tail when the required closing?> is absent. Both parsePI and parseProcessingInstruction apply the expression to the entire remaining source, causing quadratic backtracking during DOMParser.parseFromString() under default options and allowing a small unauthenticated XML input to stall the Node.js event loop. This issue is fixed in @xmldom/xmldom version 0.9.11. This vulnerability, a Regular Expression Denial of Service (ReDoS), occurs due to inefficient processing of unterminated processing instructions in XML input. This can lead to a Denial of Service (DoS) for applications using xmldom. Important: A Regular Expression Denial of Service (ReDoS) flaw in the xmldom library allows a remote, unauthenticated attacker to cause a denial of service. By sending specially crafted XML input, an attacker can trigger quadratic backtracking, leading to the Node.js event loop stalling in applications utilizing xmldom, such as OpenShift Container Platform and JupyterLab. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-1333.
High [CVE-2026-83605] @xmldom/xmldom: xmldom: Attribute injection allows client-side script execution
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute() calls the private _createAttribute(name) path without validating the attribute name, while Document.createAttribute(name) validates against QName. XMLSerializer.serializeToString() emits attribute names verbatim, and requireWellFormed: true did not validate them, so a crafted name can terminate the intended attribute and inject additional attributes, including event handlers, into browser-consumed output; synthesized xmlns:PREFIX declarations expose the same unchecked-name boundary. This issue is fixed in @xmldom/xmldom versions 0.8.14 and 0.9.11; no fixed version is available for xmldom. The Element.setAttribute() function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. Consequently, a remote attacker could achieve client-side script execution, such as Cross-Site Scripting (XSS), in the context of the affected application. This is an Important flaw in `xmldom` that allows attribute injection, potentially leading to client-side script execution. Affected products named by the advisory: Red Hat Developer Hub 1.9; Red Hat Build of Podman Desktop; Red Hat Fuse 7.
High [CVE-2026-84233] Command Execution via Macro Expansion in `rpmuncompress -x` for Crafted `.gem` Filenames
A flaw was found in rpm. A local attacker could supply a specially crafted `.gem` filename containing RPM macro syntax. When a user or automated workflow invokes `rpmuncompress -x` on this file, the macro expansion occurs during command construction. This allows the attacker to execute arbitrary commands with the privileges of the invoking account, leading to a compromise of confidentiality, integrity, and availability. The vulnerable code is not exposed as a network service and cannot be triggered remotely without a user or automated workflow invoking rpmuncompress on the attacker-controlled filename. Red Hat severity: Moderate — CVSS 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-78. Affected Red Hat products: Red Hat Hardened Images; Red Hat Enterprise Linux 10. Red Hat lists Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected. Red Hat fixing advisory: RHSA-2026:66637. Affected products named by the advisory: Red Hat package: rpm.
High [CVE-2026-84144] Internally found bugs fixed in Firefox 155 and Firefox ESR 153.2
Internally found bugs present in Thunderbird 154 and Thunderbird ESR 153.1. Some of these bugs showed evidence of memory corruption or another security-relevant defect and we presume that with enough effort some of these could have been exploited. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-787. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
High [CVE-2026-84143] Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15
Internally found bugs fixed in Firefox 155, Firefox ESR 153.2 and Firefox ESR 140.15. Red Hat rates this important (CVSS 7.5). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: firefox; Red Hat package: thunderbird.
High [CVE-2026-84126] Incorrect boundary conditions in the Layout: Grid component
Incorrect boundary conditions in the Layout: Grid component. This vulnerability was fixed in Firefox 155 and Thunderbird 155. Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory. Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-787. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.
High [CVE-2026-84125] Arbitrary code execution via use-after-free in DOM: Core & HTML
Use-after-free in the DOM: Core & HTML component. This vulnerability was fixed in Firefox 155, Firefox ESR 153.2, Thunderbird 155, and Thunderbird 153.2. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-825. Red Hat lists Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9 as not affected.