Red Hat Linux Security Advisories & CVEs
15894 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-53366] account for fraggap on the paged allocation path
In the Linux kernel, the following vulnerability has been resolved: ipv4: account for fraggap on the paged allocation path In __ip_append_data(), when the paged-allocation branch is taken, alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap, but the fraggap bytes carried over from the previous skb are copied into the new skb's linear area at offset transhdrlen by the subsequent skb_copy_and_csum_bits(). The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic. A flaw was found in the Linux kernel's handling of IPv4 network packets. An error in how the kernel accounts for fragmented data during memory allocation can lead to an undersized memory buffer. This memory handling issue could potentially be exploited by a remote attacker to cause a system crash or denial of service. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-131. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 9. Affected products named by the advisory: Red Hat package: kernel.
Medium [CVE-2026-57077] YAML::Syck: YAML::Syck: Information disclosure via out-of-bounds read
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via an unbounded newline scan in newline_len. In the bundled libsyck newline_len and is_newline dereference the scan pointer, and the following byte for a "\r\n" pair, with no NUL-terminator or bounds check. During block-scalar lexing at a document boundary the scan runs one byte past the heap lexer buffer. This is an incomplete fix of CVE-2025-11683, on a lexer path the earlier fix did not cover. Any caller that runs Load or LoadFile on an untrusted document with a block scalar at a document boundary reaches the over-read. An out-of-bounds read vulnerability exists due to an unbounded newline scan during block-scalar lexing. A remote attacker could exploit this by providing a specially crafted YAML document, leading to potential information disclosure. This issue is an incomplete fix for a previously identified vulnerability. Moderate: An out-of-bounds read flaw in `perl-YAML-Syck` can lead to information disclosure when processing specially crafted YAML documents. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Medium [CVE-2026-57076] YAML::Syck: Heap use-after-free via anchor name reuse
YAML::Syck versions before 1.47 for Perl allow a heap use-after-free via an anchor name reused as an anchors-table key in syck_hdlr_add_anchor. In the bundled libsyck an anchor name allocated by syck_strndup is stored both as node->anchor, freed when the node is freed, and as the key in the parser's anchors table. Freeing the node frees the shared key, and a later anchor redefinition makes st_delete compare against the freed key, so st_strcmp reads freed heap memory. Anchors are a standard YAML feature and need no special flags, so this is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document that redefines an anchor reaches the read of freed memory. An attacker could exploit a heap use-after-free vulnerability by providing a specially crafted YAML document that reuses an anchor name as an anchors-table key. This flaw causes the software to read freed heap memory, which may lead to information disclosure or denial of service. This Important heap use-after-free vulnerability in `perl-YAML-Syck` can be triggered by processing a specially crafted YAML document. The flaw, exploitable through the default YAML loading mechanism, may lead to information disclosure or a denial of service in applications handling untrusted YAML input. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H). Weakness: CWE-825.
Medium [CVE-2026-57075] YAML::Syck: YAML::Syck: Information disclosure via out-of-bounds read in base64 decoder
YAML::Syck versions before 1.47 for Perl allow an out-of-bounds read via a signed-char lookup-table index in syck_base64dec. The base64 decoder in the bundled libsyck indexes the 256-entry static table b64_xtable with a signed char, so any!!binary byte >= 0x80 sign-extends to a negative index and reads before the table. The decoder receives the raw bytes of any!!binary node, a standard YAML type not gated by $LoadBlessed or $LoadCode, so it is reached on the default Load path. Any caller that runs Load or LoadFile on an untrusted document containing a!!binary scalar with a high-bit byte triggers the read, and the value read can surface in the decoded result. An out-of-bounds read vulnerability exists in the base64 decoder, specifically in the `syck_base64dec` function. This occurs because the decoder uses a signed character to index a lookup table, allowing specially crafted `!!binary` YAML nodes with high-bit bytes to cause a read beyond the intended memory region. A remote attacker could exploit this by providing a malicious YAML document, potentially leading to information disclosure. This Moderate impact flaw in `perl-YAML-Syck` can lead to information disclosure. Exploitation requires an application to parse a specially crafted YAML file, making the impact dependent on the application's handling of untrusted input.
Medium [CVE-2026-46338] Information disclosure via crafted Markdown snippets
PyMdown Extensions is a set of extensions for the Python-Markdown markdown project. From 10.0.1 until 10.21.3, pymdownx.snippets uses a string-prefix containment check in SnippetPreprocessor.get_snippet_path() in pymdownx/snippets.py when `restrict_base_path: True`, allowing markdown snippet directives to read files from sibling paths that share the same base_path prefix, such as docs and docs_internal. This is a regression of CVE-2023-32309. This issue is fixed in version 10.21.3. A flaw was found in PyMdown Extensions, a tool used for processing Markdown documents. This vulnerability allows an attacker to potentially read sensitive files from unexpected locations on a system. By crafting a special Markdown snippet, an attacker could trick the system into accessing files outside of the intended directory, leading to unauthorized information disclosure. This issue requires user interaction, meaning a user would need to process a malicious Markdown file for the attack to succeed. Red Hat ships pymdown-extensions in several products as a bundled dependency. The vulnerability requires an attacker to control Markdown content processed by the pymdownx.snippets extension and for sibling directories with a matching path prefix to exist. Affected products named by the advisory: Red Hat Developer Hub 1; Red Hat OpenShift Container Platform 4; Self-service automation portal 2.
Medium [CVE-2026-15945] Group hierarchy search discloses hidden parent groups under FGAP v2
A flaw was found in the group search functionality of the Keycloak server's administrative API. When Fine-Grained Admin Permissions (FGAP) v2 is enabled, a delegated administrator can bypass access restrictions to view parent groups they are not authorized to By searching for a child group they have permission to view, the system incorrectly returns the full details of the parent group in the response, leading to the disclosure of sensitive group attributes and configuration. The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, given that it requires an authenticated attacker with specific delegated administrative permissions and the non-default FGAP v2 feature to be enabled. Successful exploitation allows an attacker to disclose sensitive metadata and configuration details of parent groups they are otherwise restricted from viewing. The vulnerability's root cause is a failure to apply fine-grained access control filters to parent groups during hierarchical search result construction. Weakness: CWE-639. Affected Red Hat products: Red Hat build of Keycloak 26.6; Red Hat build of Keycloak 26.6.7; Red Hat Data Grid 8; Red Hat JBoss Enterprise Application Platform Expansion Pack; Red Hat Single Sign-On 7. Red Hat fixing advisory: RHSA-2026:68277, RHSA-2026:68278.
Medium [CVE-2026-45695] Arbitrary code execution via unauthenticated SFTP configuration in HTTP server.
Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob. NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand= can cause exec. CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0. This allows the attacker to forward malicious SFTP storage configurations, which can lead to arbitrary code execution through OpenSSH commands. Red Hat Product Security considers this bug as Moderate as this requires active change of out of box configaration for this bug to be exploitable. There is no common use case under which Kopia HTTP server should be started without a password. The diecrepancy in CVSS scores between Red Hat and NVD comes from the differences in User Interaction, Integrity and Availability. The core bug is merely an unintended information disclosure problem if exploited correctly. There is no way to launch a denial of service or affect the integrity of the service. Therefore the bug is scored lower. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-78.
Medium [CVE-2026-47085] Information disclosure via URLAUTH token forgery
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.) A remote attacker could exploit a vulnerability related to URLAUTH token forgery, caused by a missing mailbox key. The likelihood of exploitation is low due to the obscurity of the URLAUTH feature. Red Hat severity: Moderate — CVSS 4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:N/A:N). Weakness: CWE-341. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47084] Unauthorized mailbox deletion via ACL bypass
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions. This allowed them to delete mailboxes for which they did not have the necessary permissions, leading to unauthorized data integrity compromise. This Moderate flaw in Cyrus IMAP allows an authenticated user to bypass Access Control List (ACL) restrictions, enabling unauthorized mailbox deletion. The impact is considered Moderate as it requires prior authentication and specific command usage, limiting exploitation to existing users. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N). Weakness: CWE-266. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47082] ACL bypass in vacation 'fcc' feature allows unauthorized mailbox writes
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The vacation "fcc" feature skips the destination-mailbox ACL. A user with low privileges can exploit a vulnerability in the vacation "fcc" feature. By crafting a specific Sieve script, the user can bypass access control lists and deliver vacation auto-reply messages into any mailbox, leading to unauthorized modification of mailbox content. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L). Weakness: CWE-279. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47083] Information disclosure via ESEARCH command
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an ESEARCH cross-user content oracle. By using the ESEARCH command, an authenticated IMAP user could enumerate folder names under any account they could name. Search would return UIDs of messages matching the search, creating a content oracle (without allowing arbitrary reads of the target's content). An authenticated user can exploit the ESEARCH command to discover the existence of folder names belonging to other user accounts. This vulnerability leads to information disclosure, allowing an attacker to gain unauthorized knowledge about the structure of other users' mailboxes. While it does not permit arbitrary content reads, this vulnerability could expose the structure of other users' mailboxes, potentially aiding further reconnaissance. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-201. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47089] Information disclosure via LISTRIGHTS
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user can exploit this vulnerability by using the IMAP LISTRIGHTS command. This allows the user to learn the access permissions of any mailbox they can name, which should be restricted to administrators. This leads to unauthorized information disclosure regarding mailbox access controls. While requiring prior authentication, this bypasses intended administrative restrictions, potentially exposing sensitive access control configurations within a Red Hat deployment. The impact is limited to information disclosure and does not grant further privileges or data modification. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-266. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Medium [CVE-2026-47086] Information disclosure via URLAUTH token bypass of Access Control Lists
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. GENURLAUTH-issued tokens can bypass ACLs. Any authenticated user could mint a URLAUTH token (via the GENURLAUTH command) for any mailbox they could name, even without read access on it. This would allow reading mail from mailboxes despite having no granted permissions. This allows bypassing Access Control Lists (ACLs), which are rules that control access to mailboxes. Consequently, an attacker could read mail from any mailbox, even without having been granted explicit read permissions. This flaw in cyrus-imapd allows an authenticated attacker to bypass Access Control Lists (ACLs) by minting a URLAUTH token via the GENURLAUTH command. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-639. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Low [CVE-2026-47081] Information disclosure of mailbox existence via XAPPLEPUSHSERVICE command
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed. While no content is leaked, this constitutes an information disclosure regarding the existence and activity of other users' mailboxes. Red Hat severity: Low — CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-497. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Low [CVE-2026-47088] Information disclosure via heap exposure in MIME comment parsing
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is heap exposure in nested MIME comment parsing. An authenticated IMAP user could craft an email message containing an RFC 822 comment ending with a backslash. When parsing the message, the server would read past the message's end in memory, and read into the heap, returning the read content to the user. By crafting an email message with a specially formed RFC 822 comment, the server could be made to read beyond the message's boundary in memory, potentially disclosing sensitive heap content to the attacker. Red Hat severity: Low — CVSS 3.1 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
Low [CVE-2026-47087] Unauthorized access due to URLAUTH not honoring revoked authorizer access
An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH does not honor revoked authorizer access. This allows a previously authorized user to retain access via a URLAUTH URL, even after their authorization has been revoked, potentially leading to unauthorized information disclosure. Red Hat severity: Low — CVSS 3.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N). Weakness: CWE-613. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: cyrus-imapd.
High [CVE-2026-12382] missing requestHeadersToRemove allows mTLS bypass via Subject header spoofing
A flaw was found in the AAP Gateway Envoy proxy configuration. The non-mTLS route to EDA event streams does not remove the Subject HTTP header from client requests, despite the source code defining requestHeadersToRemove for this header. An unauthenticated remote attacker can inject a spoofed Subject header matching a legitimate client certificate DN to bypass mTLS authentication and inject arbitrary events into protected EDA event streams. This flaw affects AAP deployments that use mTLS-protected EDA external event streams. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N). Weakness: CWE-290. Affected Red Hat products: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Ansible Automation Platform 2.6; Red Hat Ansible Automation Platform 2.7. Red Hat fixing advisory: RHSA-2026:42078, RHSA-2026:13508, RHSA-2026:13545, RHSA-2026:42142.
High [CVE-2026-58659] Remote code execution via malicious checkpoint files
PyTorch Lightning through 2.6.5, fixed in commit d710d68, contains a remote code execution vulnerability in the _load_state function that imports and executes attacker-controlled module names from checkpoint _instantiator hyperparameters. Attackers can craft malicious checkpoint files that bypass weights_only=True protections to execute arbitrary code when LightningModule.load_from_checkpoint is called. This vulnerability allows attackers to achieve remote code execution by crafting malicious checkpoint files. The vulnerability arises from the _load_state function's ability to import and execute attacker-controlled module names from maliciously crafted checkpoint files, even when weights_only=True is enabled. Exploitation requires a local attacker to trick a user into loading a specially crafted checkpoint file. Red Hat severity: Important — CVSS 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-502. Affected Red Hat products: Red Hat AI Inference Server 3.3; Red Hat AI Inference Server 3.4; Red Hat AI Inference Server 3.5; Red Hat Enterprise Linux AI 3.3; Red Hat Enterprise Linux AI 3.4; Red Hat Enterprise Linux AI 3.5; Red Hat OpenShift AI 3.4; Red Hat AI Inference Server. Red Hat lists Red Hat OpenShift AI (RHOAI) as not affected. Will not fix / out of support: Red Hat AI Inference Server.
High [CVE-2026-45804] Arbitrary code execution due to trust_remote_code guard bypass
Diffusers is the a library for pretrained diffusion models. Prior to 0.38.0, Diffusers' DiffusionPipeline.from_pretrained flow can bypass the trust_remote_code guard because download() validates model_index.json and custom pipeline code before later loading from a cached folder that can change, allowing a Hub repository with custom.py pipeline code to execute through the custom pipeline flow without passing custom_pipeline or trust_remote_code=True. This issue is fixed in version 0.38.0. A remote attacker could exploit this vulnerability by crafting a malicious Hub repository with custom Python pipeline code. The `DiffusionPipeline.from_pretrained` flow can bypass the `trust_remote_code` security mechanism, allowing the execution of arbitrary code on the system when a user interacts with the malicious repository. This could lead to high impact on confidentiality, integrity, and availability of the affected system. This Important flaw in Diffusers, as used in Red Hat AI Inference Server, Red Hat OpenShift AI, and Red Hat Enterprise Linux AI, allows for arbitrary code execution. A remote attacker could exploit this by convincing a user to load a specially crafted model from a malicious Hub repository, bypassing the `trust_remote_code` safeguard. This could lead to a complete compromise of the system where the model is loaded.
High [CVE-2026-60005] Memory disclosure and denial of service in ngx_http_slice_module
NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_slice_module module. When the slice directive and unnamed regex captures are configured or when a background cache update happens, unauthenticated attackers can send requests that may cause uninitialized memory access in the NGINX worker process, leading to limited disclosure of memory or a restart. There is no control plane exposure; this is a data plane issue only. Note: The ngx_http_slice_module module is not enabled by default; it's enabled with the --with-http_slice_module configuration parameter. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. Important: This vulnerability in NGINX's `ngx_http_slice_module` could lead to memory disclosure or denial of service. The impact on Red Hat products is reduced because the `ngx_http_slice_module` is not enabled by default. Exploitation requires explicit configuration of the module with the `slice` directive and unnamed regex captures, or during a background cache update, limiting exposure in typical deployments. Red Hat severity: Important — CVSS 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H). Weakness: CWE-824.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.