Red Hat Linux Security Advisories & CVEs
3067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
High [CVE-2026-12413] IKEv2 Denial of Service via malformed fragmentation
An invalidly formatted IKEv2 fragment causes the Libreswan pluto daemon to crash and restart. Continued exploitation would cause a denial of service. The function reassemble_v2_incoming_fragments() would ignore unknown outer payloads but still store these in a fixed size array msg_digest.digest[PAYLIMIT]. An off-by-one error in the assertion PASSERT(logger, md->digest_roof digest)) causes the daemon to abort. No remote code execution is possible. Any configuration that allows IKEv2 connections that do not set fragmentation=no are vulnerable. IKEv1 is not affected. A flaw was found in Libreswan's IKEv2 fragment reassembly mechanism. When a VPN gateway processes incoming split network packets (fragments) containing unexpected data, an off-by-one boundary validation error triggers an internal program safety check (assertion failure). While this flaw does not allow data theft or unauthorized system access, a continuous stream of these packets will lead to a persistent Denial of Service (DoS) for legitimate VPN users. Red Hat Product Security rates this vulnerability as having an Important impact, primarily because it can be exploited remotely without authentication. However, the actual exposure depends entirely on your specific VPN configuration: ``` Affected Configurations: This vulnerability only impacts IKEv2 connections.
High [CVE-2026-50193] Denial of Service via deeply nested JSON processing
Denial of Service via deeply nested JSON processing. Red Hat rates this important (CVSS 7.5). Weakness: CWE-1050.
High [CVE-2026-54512] Arbitrary code execution via PolymorphicTypeValidator bypass
Arbitrary code execution via PolymorphicTypeValidator bypass. Red Hat rates this important (CVSS 8.1). Weakness: CWE-502. Red Hat lists fixing advisory RHSA-2026:36839 with package jackson-databind.
High [CVE-2026-54513] Security bypass allows arbitrary code execution
Security bypass allows arbitrary code execution. Red Hat rates this important (CVSS 8.1). Weakness: CWE-184. Red Hat lists fixing advisory RHSA-2026:36839 with package jackson-databind.
High [CVE-2026-52845] Remote client can inject or override identity headers via header normalization
Remote client can inject or override identity headers via header normalization. Red Hat rates this important (CVSS 8.1). Weakness: CWE-444.
High [CVE-2026-54257] Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow
Buffer performs incorrect byte length calculations resulting in heap buffer under/overflow. Red Hat rates this important (CVSS 7.1). Weakness: CWE-131.
High [CVE-2026-12112] Active Session Hijacking via Insecure Session State Reuse
Active Session Hijacking via Insecure Session State Reuse. Red Hat rates this important (CVSS 7.8). Weakness: CWE-287. Red Hat lists fixing advisory RHSA-2026:28438 with package satellite/foreman-mcp-server-rhel9:1782228692.
High [CVE-2026-56379] Arbitrary code execution via SVG decoder command injection
Arbitrary code execution via SVG decoder command injection. Red Hat rates this important (CVSS 8.1). Weakness: CWE-78. Red Hat lists fixing advisory RHSA-2026:32961 with package ImageMagick-0:6.9.10.68-17.el7_9. Affected product named by the advisory: Red Hat Enterprise Linux 7.
High [CVE-2023-54365] Denial of Service via HTTP/2 Rapid Reset technique
Denial of Service via HTTP/2 Rapid Reset technique. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770.
High [CVE-2025-61018] Denial of Service via crafted SQL statements in sqlo_place_dt_set
Denial of Service via crafted SQL statements in sqlo_place_dt_set. Red Hat rates this important (CVSS 7.5). Weakness: CWE-89.
High [CVE-2025-61020] openlink virtuoso-opensource: Denial of Service via crafted SQL statements
openlink virtuoso-opensource: Denial of Service via crafted SQL statements. Red Hat rates this important (CVSS 7.5). Weakness: CWE-89.
High [CVE-2025-61023] Denial of Service in st_compare component via crafted SQL statements
Denial of Service in st_compare component via crafted SQL statements. Red Hat rates this important (CVSS 7.5). Weakness: CWE-89.
High [CVE-2025-61028] Denial of Service via crafted SQL statements
Denial of Service via crafted SQL statements. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770.
High [CVE-2026-41523] Arbitrary code execution via malicious HuggingFace model
Arbitrary code execution via malicious HuggingFace model. Red Hat rates this important (CVSS 7.5). Weakness: CWE-617. Red Hat lists fixing advisory RHSA-2026:36006 with package rhaiis/vllm-cuda-rhel9:1782951012, rhaiis/vllm-rocm-rhel9:1782951244.
High [CVE-2026-49468] Authentication Bypass via Host Header Injection
Authentication Bypass via Host Header Injection. Red Hat rates this important (CVSS 8.1). Weakness: CWE-290.
High [CVE-2026-55603] Data integrity compromise via CR/LF injection
http-proxy-middleware is node.js http-proxy middleware. From 3.0.4 until 3.0.7 and 4.1.1, fixRequestBody() is the library's documented helper for re-emitting a request body that was already consumed by a body parser. When the outgoing Content-Type is multipart/form-data, it rebuilds the body with handlerFormDataBodyData(), which interpolates each req.body key and value directly into the multipart wire format without neutralizing CR/LF. A \r\n inside a value (or key) lets an attacker close the current part and inject an entirely new form part. Because the proxy's own body parser saw a single opaque value, any gateway-side policy or validation performed on req.body is evaluated against a different set of fields than the upstream backend ultimately parses a request/parameter desynchronization across the trust boundary. This vulnerability is fixed in 3.0.7 and 4.1.1. A remote attacker could exploit a vulnerability in the fixRequestBody() function, which is used to re-emit a request body. By injecting carriage return and line feed characters (\r\n) into a request body key or value, an attacker can bypass security policies and validation performed by the proxy. This desynchronization between the proxy and the backend server can lead to a compromise of data integrity. Other Red Hat AI products are not affected or do not expose the vulnerable code path in normal operation.
High [CVE-2026-54293] Information Disclosure via Path Traversal in `nltk.data.load `
Information Disclosure via Path Traversal in `nltk.data.load()`. Red Hat rates this important (CVSS 7.5). Weakness: CWE-22.
High [CVE-2026-55388] Arbitrary code execution via prototype pollution of filename option
Arbitrary code execution via prototype pollution of filename option. Red Hat rates this important (CVSS 8.1). Weakness: CWE-915.
High [CVE-2026-54283] request.form limits silently ignored for application/x-www-form-urlencoded enable DoS
request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS. Red Hat rates this important (CVSS 7.5). Weakness: CWE-770. Red Hat lists fixing advisory RHSA-2026:36006 with package rhaiis/vllm-cuda-rhel9:1782951012, jaeger-main-2.19.0-1.hum1, rhaiis/vllm-rocm-rhel9:1782951244.
High [CVE-2026-48712] Denial of Service via uncontrolled recursion with crafted protobuf payload
protobufjs compiles protobuf definitions into JavaScript (JS) functions. Prior to 7.6.1 and 8.4.1, protobufjs could recurse without a depth limit while converting decoded messages to plain objects or JSON. This affected generated toObject() conversion and the custom google.protobuf. Any JSON conversion path. This vulnerability is fixed in 7.6.1 and 8.4.1. A flaw was found in protobufjs. This uncontrolled recursion could exhaust the JavaScript call stack during conversion to JSON, leading to a Denial of Service (DoS). Red Hat rates this issue as having Low impact for Red Hat Enterprise Linux AI bootc images. Although protobufjs is present as a transitive dependency, the vulnerable parsing path is not exercised in normal product operation. Red Hat severity: Moderate — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-606. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI).