Red Hat Linux Security Advisories & Vulnerabilities
16004 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-42570] Excessive memory consumption via deserialization of sparse arrays
Excessive memory consumption via deserialization of sparse arrays. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Trusted Artifact Signer 1.4; Red Hat Enterprise Linux 10; Red Hat Build of Podman Desktop.
High [CVE-2025-10263] Privilege escalation or information disclosure via writes to higher exception level resources
Privilege escalation or information disclosure via writes to higher exception level resources. Red Hat rates this important (CVSS 8.4). Weakness: CWE-266. Affected package(s): kernel. Resolved in Red Hat advisory RHSA-2026:34911 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux for NVIDIA 26; Red Hat OpenShift Container Platform 4.22; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; and 18 more.
High [CVE-2026-52903] YAML safe_load production fallback to unsafe_load enables RCE via deserialization
YAML safe_load production fallback to unsafe_load enables RCE via deserialization. Red Hat rates this important (CVSS 8.8). Weakness: CWE-502. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected product named by the advisory: Red Hat CloudForms.
High [CVE-2026-9698] Buffer overflow in error handling can lead to arbitrary code execution
Buffer overflow in error handling can lead to arbitrary code execution. Red Hat rates this important (CVSS 8.2). Weakness: CWE-120. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream (v. 8); Red Hat Enterprise Linux AppStream (v. 9); Red Hat Enterprise Linux 6; and 5 more.
High [CVE-2026-40984] Denial of Service via specially crafted HTTP requests
Denial of Service via specially crafted HTTP requests. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel - HawtIO 4; and 10 more.
High [CVE-2026-40983] Denial of Service via specially crafted gRPC requests
Denial of Service via specially crafted gRPC requests. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. No fix erratum has been published yet; monitor the Red Hat CVE page and apply the RHSA when released. Affected products named by the advisory: Red Hat AMQ Broker 7; Red Hat AMQ Clients; Red Hat build of Apache Camel 4 for Quarkus 3; Red Hat build of Apache Camel - HawtIO 4; and 7 more.
High [CVE-2026-34182] CMS AuthEnvelopedData Processing May Accept Forged Messages
CMS AuthEnvelopedData Processing May Accept Forged Messages. Red Hat rates this moderate (CVSS 7.4). Weakness: CWE-130. Affected package(s): insights-proxy/insights-proxy-container-rhel9:1782890503, rhui5/haproxy-rhel9:1781525671, openssl, rhui5/installer-rhel9:1781525693, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952. Resolved in Red Hat advisory RHSA-2026:29197 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
High [CVE-2026-34183] Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler
Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler. Red Hat rates this moderate (CVSS 7.5). Weakness: CWE-770. Affected package(s): insights-proxy/insights-proxy-container-rhel9:1782890503, rhui5/haproxy-rhel9:1781525671, openssl, rhui5/installer-rhel9:1781525693, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952. Resolved in Red Hat advisory RHSA-2026:29197 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
High [CVE-2026-45447] Heap Use-After-Free in OpenSSL PKCS7_verify()
Heap Use-After-Free in OpenSSL PKCS7_verify(). Red Hat rates this important (CVSS 8.1). Weakness: CWE-825. Affected package(s): insights-proxy/insights-proxy-container-rhel9:1782890503, rhui5/haproxy-rhel9:1781525671, openssl, compat-openssl11, rhui5/installer-rhel9:1781525693, rhui5/cds-rhel9:1781525684. Resolved in Red Hat advisory RHSA-2026:26275 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream (v. 8); Red Hat Enterprise Linux AppStream E4S (v.8.8); Red Hat Enterprise Linux AppStream TUS (v.8.8); and 25 more.
High [CVE-2026-46316] Drop the translation cache reference only for the erased entry
Drop the translation cache reference only for the erased entry. Red Hat rates this important (CVSS 7). Weakness: CWE-911. Affected package(s): kernel. Resolved in Red Hat advisory RHSA-2026:34911 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux AppStream (v. 10); Red Hat Enterprise Linux AppStream EUS (v.9.6); Red Hat Enterprise Linux AppStream (v. 9); Red Hat Enterprise Linux BaseOS (v. 10); and 18 more.
Medium [CVE-2026-45491] .NET: Local file tampering via link following vulnerability
.NET: Local file tampering via link following vulnerability. Red Hat rates this moderate (CVSS 6.2). Weakness: CWE-59. Affected package(s): dotnet8, dotnet8.0, dotnet9.0, dotnet9, dotnet10.0, dotnet10. Resolved in Red Hat advisory RHSA-2026:25110 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9.
Medium [CVE-2026-11793] stack buffer overflow in checkprefix algorithm id parsing
A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only. Red Hat severity: Low — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-121. Affected Red Hat products: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-11790] 389-ds-base: 389-ds-base: pbkdf2 password storage plugin unbounded iteration count denial of service
A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password storage plugin does not enforce an upper bound on the iteration count extracted from stored password hashes. A privileged attacker who can modify a user's password hash can cause excessive CPU consumption during authentication, resulting in denial of service. Red Hat rates this issue as Moderate impact. An attacker with Directory Manager access can plant a hash with extreme iterations; subsequent BIND operations hang worker threads for hours, enabling persistent denial of service. The poisoned hash persists in the database and re-triggers on every bind, so recovery requires Directory Manager access to replace the hash. This is distinct from CVE-2024-5953, which added hash length checks but not an iteration cap. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-400. Affected Red Hat products: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat lists Red Hat Enterprise Linux 6 as not affected. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: 389-ds-base.
Medium [CVE-2026-11789] 389-ds-base: 389-ds-base: smd5 password storage plugin salt length integer underflow crash
A flaw was found in 389 Directory Server. The SMD5 password storage plugin performs unsigned integer underflow when computing salt length from a crafted password hash shorter than 16 bytes, causing a buffer over-read that crashes the LDAP server during authentication. Red Hat rates this issue as Moderate impact. Once planted, the crash re-triggers on every bind to the poisoned account until the hash is removed offline. This is a missed variant of CVE-2024-5953, which patched md5_pwd.c and pbkdf2_pwd.c but not smd5_pwd.c. Red Hat severity: Moderate — CVSS 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-191. Affected Red Hat products: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: 389-ds-base.
Medium [CVE-2026-11788] 389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser
A flaw was found in 389 Directory Server. The dereference control plugin does not check for allocation failure before using a BER structure, allowing an unauthenticated remote attacker to crash the LDAP server when the system is under memory pressure. Red Hat rates this issue as Moderate impact. If allocation fails, an LDAP search carrying the deref control can crash ns-slapd. The deref plugin is enabled by default, and anonymous clients can send the control when anonymous access is allowed. Natural OOM was not demonstrated end-to-end without fault injection. Disabling the deref plugin removes the vulnerable code path entirely. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected products named by the advisory: Red Hat Directory Server 11.5 E4S for RHEL 8; Red Hat Directory Server 11.7 E4S for RHEL 8; Red Hat Directory Server 11.9 for RHEL 8; Red Hat Directory Server 12.2 E4S for RHEL 9; and 15 more. Affected products named by the advisory: Red Hat Directory Server 12.4 E4S for RHEL 9; Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; and 11 more.
Medium [CVE-2026-11787] 389-ds-base: 389-ds-base: heap buffer over-read in ldap_utf8prev via str2simple filter parsing
A flaw was found in 389 Directory Server. The ldap_utf8prev() function reads bytes before the start of a buffer without bounds checking, causing a heap buffer over-read in string filter parsing that may influence internal filter processing behavior. Red Hat rates this issue as Moderate impact. In 389-ds-base, internal text-based LDAP filter parsing can read up to six bytes before a heap buffer when a filter string has = at or near the start. Production builds do not crash; the practical effect is silent filter misparse—search results may be wrong, including where ACIs use targetfilter. This path is not reached by normal LDAP search filters on the wire (BER-encoded filters use a separate parser). An attacker must influence internal filter strings—for example plugin configuration (originFilter, nsUniqueAttribute), ACI definitions, or replication-delivered config. Red Hat severity: Moderate — CVSS 5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-126. Affected Red Hat products: Red Hat Directory Server 11; Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-11785] 389-ds-base: 389-ds-base: partial stack address information leak via ber_printf type confusion in sso token handler
A flaw was found in 389 Directory Server. A type confusion in the SSO token extended operation handler causes partial stack address information to be disclosed in LDAP responses to authenticated users. The SSO token feature, which is enabled by default in Red Hat Directory Server, leaks the lower 32 bits of a stack address in LDAP extended operation responses, reducing Address Space Layout Randomization (ASLR) entropy but not leading to a full bypass. Red Hat severity: Moderate — CVSS 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N). Weakness: CWE-843. Affected Red Hat products: Red Hat Directory Server 12; Red Hat Directory Server 13; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: 389-ds-base.
Medium [CVE-2026-52902] Awxkit: path traversal via yaml !include directive
A path traversal vulnerability was found in awxkit, the CLI tool for AWX. The YAML!include directive does not sanitize file paths, allowing an attacker to craft a malicious YAML file that reads arbitrary YAML-formatted files from the local filesystem when a user imports it using "awx --conf.format yaml import". This is a client-side vulnerability requiring user interaction. awxkit as a bundled Python dependency found in ee-supported and platform-resource-runner containers for ansible-automation-platform and as part of the automation-controller RPM. Red Hat severity: Moderate — CVSS 4.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N). Weakness: CWE-22. Affected Red Hat products: Red Hat Ansible Automation Platform 2.5 for RHEL 8; Red Hat Ansible Automation Platform 2.5 for RHEL 9; Red Hat Ansible Automation Platform 2.6 for RHEL 9; Red Hat Ansible Automation Platform 2.7 for RHEL 10; Red Hat Ansible Automation Platform 2.7 for RHEL 9; Red Hat Ansible Automation Platform 2. Red Hat fixing advisory: RHSA-2026:59135, RHSA-2026:59136, RHSA-2026:59137.
Medium [CVE-2026-7383] Heap buffer overflow due to signed integer overflow in Unicode output sizing
Heap buffer overflow due to signed integer overflow in Unicode output sizing. Red Hat rates this low (CVSS 5.5). Weakness: CWE-190. Affected package(s): insights-proxy/insights-proxy-container-rhel9:1782890503, rhui5/haproxy-rhel9:1781525671, openssl, rhui5/installer-rhel9:1781525693, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952. Resolved in Red Hat advisory RHSA-2026:29197 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
Medium [CVE-2026-9076] Denial of Service due to heap out-of-bounds read in CMS password-based decryption
Denial of Service due to heap out-of-bounds read in CMS password-based decryption. Red Hat rates this low (CVSS 5.9). Weakness: CWE-131. Affected package(s): insights-proxy/insights-proxy-container-rhel9:1782890503, rhui5/haproxy-rhel9:1781525671, openssl, rhui5/installer-rhel9:1781525693, rhui5/cds-rhel9:1781525684, discovery/discovery-ui-rhel9:1782166952. Resolved in Red Hat advisory RHSA-2026:29197 — update the affected packages (`sudo dnf update`). Affected products named by the advisory: Red Hat Enterprise Linux 1; Red Hat Enterprise Linux 9.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.