Red Hat Linux Security Advisories & CVEs
3067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-46592] Remote attacker can execute unintended operations via header manipulation
Remote attacker can execute unintended operations via header manipulation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-639.
High [CVE-2026-46584] Credential exposure and information disclosure via improper input validation of mail headers
Credential exposure and information disclosure via improper input validation of mail headers. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-918.
High [CVE-2026-40859] Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data
Apache Camel (camel-vertx-http): Remote Code Execution via Deserialization of Untrusted Data. Red Hat rates this important (CVSS 8.1). Weakness: CWE-502.
High [CVE-2026-14570] Crypt::DSA: Crypt::DSA: Private key recovery due to biased random number generation
Crypt::DSA: Crypt::DSA: Private key recovery due to biased random number generation. Red Hat rates this important (CVSS 7.5). Weakness: CWE-338.
High [CVE-2026-14535] Arbitrary code execution via pickle deserialization bypass
Arbitrary code execution via pickle deserialization bypass. Red Hat rates this important (CVSS 8.8). Weakness: CWE-693.
High [CVE-2026-14534] Arbitrary code execution due to incomplete denylist in deserialization
Arbitrary code execution due to incomplete denylist in deserialization. Red Hat rates this important (CVSS 8.8). Weakness: CWE-184.
High [CVE-2026-12252] Arbitrary Code Execution via Untrusted JAR File Loading
Arbitrary Code Execution via Untrusted JAR File Loading. Red Hat rates this important (CVSS 7.8). Weakness: CWE-347.
High [CVE-2026-53362] account for fraggap on the paged allocation path
In the Linux kernel, the following vulnerability has been resolved: ipv6: account for fraggap on the paged allocation path In __ip6_append_data(), when the paged-allocation branch is taken (MSG_MORE / NETIF_F_SG / large fraglen), alloclen and pagedlen are computed as alloclen = fragheaderlen + transhdrlen; pagedlen = datalen - transhdrlen; datalen already includes fraggap (datalen = length + fraggap). When fraggap is non-zero, this is not the first skb and transhdrlen is zero. The fraggap bytes carried over from the previous skb are copied just past the fragment headers in the new skb's linear area. The linear area is therefore undersized by fraggap bytes while pagedlen is overstated by the same amount, and the copy writes past skb->end into the trailing skb_shared_info. An unprivileged user can trigger this via a UDPv6 socket using MSG_MORE together with MSG_SPLICE_PAGES. The bad accounting was introduced by commit 773ba4fe9104 ("ipv6: avoid partial copy for zc"). Before commit ce650a166335 ("udp6: Fix __ip6_append_data()'s handling of MSG_SPLICE_PAGES"), the negative copy value caused -EINVAL to be returned. That later commit allowed MSG_SPLICE_PAGES to proceed in this case, making the corruption triggerable. After this adjustment, copy no longer collapses to -fraggap on the paged path, so remove the stale comment describing that old arithmetic.
High [CVE-2026-53359] Fix shadow paging use-after-free due to unexpected role
Fix shadow paging use-after-free due to unexpected role. Red Hat rates this important (CVSS 7.8). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:36957 with package rhcos-4.22.9.8.202607152026-0, kernel-0:5.14.0-570.127.1.el9_6, kernel-0:4.18.0-477.154.1.el8_8, kernel-0:5.14.0-427.137.1.el9_4. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 1.
High [CVE-2026-53360] Require in-GHCB scratch area if GHCB v2+ is in use
Require in-GHCB scratch area if GHCB v2+ is in use. Red Hat rates this important (CVSS 7). Weakness: CWE-787.
High [CVE-2026-53361] Set gc_in_progress to true in unix_gc
Set gc_in_progress to true in unix_gc(). Red Hat rates this moderate (CVSS 7). Weakness: CWE-366.
High [CVE-2026-12481] Arbitrary code execution via deserialization vulnerability
Arbitrary code execution via deserialization vulnerability. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502.
High [CVE-2026-9547] Man-in-the-middle attack via SSH host key bypass
Man-in-the-middle attack via SSH host key bypass. Red Hat rates this important (CVSS 7.4). Weakness: CWE-347. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
High [CVE-2026-9546] Information disclosure due to persistent Referer header
Information disclosure due to persistent Referer header. Red Hat rates this important (CVSS 7.5). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
High [CVE-2026-9545] Information disclosure via cached SSL session and early data
Information disclosure via cached SSL session and early data. Red Hat rates this important (CVSS 7.5). Weakness: CWE-295.
High [CVE-2026-9080] Use-after-free via curl_easy_pause in CURLMOPT_SOCKETFUNCTION callback
Use-after-free via curl_easy_pause() in CURLMOPT_SOCKETFUNCTION callback. Red Hat rates this important (CVSS 7.3). Weakness: CWE-825. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
High [CVE-2026-9079] Information disclosure due to failure to clear proxy authentication credentials
Information disclosure due to failure to clear proxy authentication credentials. Red Hat rates this important (CVSS 7.5). Weakness: CWE-212. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
High [CVE-2026-8932] Security feature bypass due to improper mTLS connection reuse
Security feature bypass due to improper mTLS connection reuse. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1025. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
High [CVE-2026-8927] Information disclosure due to uncleared proxy authentication state
Information disclosure due to uncleared proxy authentication state. Red Hat rates this important (CVSS 7.5). Weakness: CWE-201. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.
High [CVE-2026-8925] Double-free vulnerability in SASL authentication
Double-free vulnerability in SASL authentication. Red Hat rates this important (CVSS 8.1). Weakness: CWE-1341. Red Hat lists fixing advisory RHSA-2026:29017 with package rust-main-1.96.1-1.hum1, curl-main-8.21.0-0.1.hum1.