Red Hat Linux Security Advisories & Vulnerabilities
16067 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited sources checked less often
Get an email when Red Hat publishes the next one.
See Red Hat's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata, so keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2025-0690] Grub2: read: integer overflow may lead to out-of-bounds write
The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence. Red Hat Product Security has rated this vulnerability with Moderate severity as it requires physical access and high privileges to exploit it. Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
High [CVE-2025-0624] Grub2: net: out-of-bounds write in grub_net_search_config_file
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to consider the environment variable length when allocating the internal buffer, resulting in an out-of-bounds write. If correctly exploited, this issue may result in remote code execution through the same network segment grub is searching for the boot information, which can be used to by-pass secure boot protections. Red Hat Product Security team has rated this vulnerability as Important, as an attacker that has access to the same network segment is able to exploit it once netboot is enabled in grub2. Red Hat severity: Important — CVSS 7.6 (CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H). Weakness: CWE-787. Affected products named by the advisory: Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Telecommunications Update Service; and 16 more.
Medium [CVE-2025-0677] Grub2: ufs: integer overflow may lead to heap based out-of-bounds write when handling symlinks
A flaw was found in grub2. When performing a symlink lookup, the grub's UFS module checks the inode's data size to allocate the internal buffer to read the file content, however, it fails to check if the symlink data size has overflown. When this occurs, grub_malloc() may be called with a smaller value than needed. When further reading the data from the disk into the buffer, the grub_ufs_lookup_symlink() function will write past the end of the allocated size. An attack can leverage this by crafting a malicious filesystem, and as a result, it will corrupt data stored in the heap, allowing for arbitrary code execution used to by-pass secure boot mechanisms. Red Hat Product Security has rated this vulnerability with Moderate severity, as it requires high privileges to exploit. Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:16154, RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-1118] Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled
A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory. Red Hat Product Security has rated this vulnerability with Moderate severity as it requires high privileges to exploit it. Weakness: CWE-501. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:16154. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2024-45777] Grub2: grub-core/gettext: integer overflow leads to heap oob write.
A flaw was found in grub2. The calculation of the translation buffer when reading a language.mo file in grub_gettext_getstr_from_position() may overflow, leading to a Out-of-bound write. This issue can be leveraged by an attacker to overwrite grub2's sensitive heap data, eventually leading to the circumvention of secure boot protections. The Red Hat Product Security team has rated this vulnerability with a Moderate severity due to the high privileges required to exploit this flaw. Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:20532. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-0622] Grub2: command/gpg: use-after-free due to hooks not being removed on module unload
A flaw was found in command/gpg. In some scenarios, hooks created by loaded modules are not removed when the related module is unloaded. This flaw allows an attacker to force grub2 to call the hooks once the module that registered it was unloaded, leading to a use-after-free vulnerability. If correctly exploited, this vulnerability may result in arbitrary code execution, eventually allowing the attacker to bypass secure boot protections. Red Hat Product Security has rated the security impact for this flaw as Moderate due to the high privileges needed and the complexity involved to exploit this vulnerability. Red Hat severity: Moderate — CVSS 6.4 (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-416. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:16154, RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2024-45783] Grub2: fs/hfs+: refcount can be decremented twice
A flaw was found in grub2. When failing to mount an HFS+ grub, the hfsplus filesystem driver doesn't properly set an ERRNO value. This issue may lead to a NULL pointer access. Red Hat severity: Moderate — CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-911. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2024-45781] Grub2: fs/ufs: oob write in the heap
A flaw was found in grub2. When reading a symbolic link's name from a UFS filesystem, grub2 fails to validate the string length taken as an input. The lack of validation may lead to a heap out-of-bounds write, causing data integrity issues and eventually allowing an attacker to circumvent secure boot protections. Red Hat severity: Moderate — CVSS 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8. Red Hat fixing advisory: RHSA-2025:16154, RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2024-45776] Grub2: grub-core/gettext: integer overflow leads to heap oob write and read.
When reading the language.mo file in grub_mofile_open(), grub2 fails to verify an integer overflow when allocating its internal buffer. A crafted.mo file may lead the buffer size calculation to overflow, leading to out-of-bound reads and writes. This flaw allows an attacker to leak sensitive data or overwrite critical data, possibly circumventing secure boot protections. Red Hat severity: Moderate — CVSS 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H). Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8 as not affected. Red Hat fixing advisory: RHSA-2025:16154, RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2024-45775] missing check for failed allocation
A flaw was found in grub2 where the grub_extcmd_dispatcher() function calls grub_arg_list_alloc() to allocate memory for the grub's argument list. However, it fails to check in case the memory allocation fails. Once the allocation fails, a NULL point will be processed by the parse_option() function, leading grub to crash or, in some rare scenarios, corrupt the IVT data. Red Hat has classified this vulnerability with a Moderate severity due to the high privileges needed to exploit this flaw. Additionally, the attack vector is considered local, further limiting exploitation of this issue. Weakness: CWE-252. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Red Hat fixing advisory: RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-26465] machine-in-the-middle attack if verifyhostkeydns is enabled
A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high. This issue is rated as a moderate severity vulnerability instead of important because it requires specific conditions to be exploitable. Second, the attacker must be able to exhaust SSH client memory and trigger out-of-memory condition. Additionally, while the attack allows a machine-in-the-middle (MITM) adversary to trick the client into accepting an incorrect host key, it does not directly lead to code execution or immediate system compromise. Instead, the attack requires additional steps, such as credential interception or session hijacking to fully exploit the breach. Red Hat severity: Moderate — CVSS 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N). Weakness: CWE-390. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Discovery 1.14; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4.
Medium [CVE-2024-45774] Grub2: reader/jpeg: heap oob write during jpeg parsing
A flaw was found in grub2. A specially crafted JPEG file can cause the JPEG parser of grub2 to incorrectly check the bounds of its internal buffers, resulting in an out-of-bounds write. The possibility of overwriting sensitive information to bypass secure boot protections is not discarded. Red Hat has classified this vulnerability with a Moderate severity due to the high privileges needed to exploit this flaw. Additionally, the attack vector is considered local, further limiting exploitation of this issue. Weakness: CWE-787. Affected Red Hat products: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2025:6990. Affected products named by the advisory: Red Hat package: grub2.
Medium [CVE-2025-1391] Keycloak-services: improper authorization in keycloak organization mapper allows unauthorized organization claims
A flaw was found in the Keycloak organization feature, which allows the incorrect assignment of an organization to a user if their username or email matches the organization’s domain pattern. This issue occurs at the mapper level, leading to misrepresentation in tokens. If an application relies on these claims for authorization, it may incorrectly assume a user belongs to an organization they are not a member of, potentially granting unauthorized access or privileges. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-284. Affected Red Hat products: Red Hat Build of Keycloak; Red Hat build of Keycloak 26.0. Red Hat fixing advisory: RHSA-2025:2545, RHSA-2025:2544.
High [CVE-2025-1244] shell injection vulnerability in gnu emacs via custom "man" uri scheme
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or an HTTP URL with a redirect. In order to exploit this vulnerability a user action is required, limiting the possibility of this issue to be exploited. Red Hat severity: Important — CVSS 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Weakness: CWE-78. Affected Red Hat products: Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.2 Advanced Update Support; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Telecommunications Update Service; Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.8 Extended Update Support; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.2 Extended Update Support; Red Hat Enterprise Linux 9.4 Extended Update Support; Builds for Red Hat OpenShift 1.3.2; Red Hat Enterprise Linux 6.
Medium [CVE-2024-12243] gnutls impacted by inefficient der decoding in libtasn1 leading to remote dos
A flaw was found in GnuTLS, which relies on libtasn1 for ASN.1 data processing. Due to an inefficient algorithm in libtasn1, decoding certain DER-encoded certificate data can take excessive time, leading to increased resource consumption. This flaw allows a remote attacker to send a specially crafted certificate, causing GnuTLS to become unresponsive or slow, resulting in a denial-of-service condition. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-407. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Discovery 1.14; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat fixing advisory: RHSA-2025:4051, RHSA-2025:7076, RHSA-2025:17361, RHSA-2025:8020, RHSA-2025:8385. Affected products named by the advisory: Red Hat package: gnutls.
Medium [CVE-2024-12133] inefficient der decoding in libtasn1 leading to potential remote dos
A flaw in libtasn1 causes inefficient handling of specific certificate data. When processing a large number of elements in a certificate, libtasn1 takes much longer than expected, which can slow down or even crash the system. This flaw allows an attacker to send a specially crafted certificate, causing a denial of service attack. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-407. Affected Red Hat products: Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On; Red Hat Enterprise Linux 8.8 Telecommunications Update Service; Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions; Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions; Red Hat Enterprise Linux 9.4 Extended Update Support; Red Hat Discovery 1.14; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Red Hat lists Red Hat Enterprise Linux 10 as not affected. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7.
Medium [CVE-2024-11831] cross-site scripting (xss) in serialize-javascript
A flaw was found in npm-serialize-javascript. The vulnerability occurs because the serialize-javascript module does not properly sanitize certain inputs, such as regex or other JavaScript object types, allowing an attacker to inject malicious code. This code could be executed when deserialized by a web browser, causing Cross-site scripting (XSS) attacks. This issue is critical in environments where serialized data is sent to web clients, potentially compromising the security of the website or web application using this package. Red Hat severity: Moderate — CVSS 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). Weakness: CWE-79. Affected products named by the advisory: Red Hat Advanced Cluster Security 4.4; Red Hat Advanced Cluster Security 4.5; Red Hat Ceph Storage 7.1; Red Hat Ceph Storage 8.1; and 39 more. Affected products named by the advisory: Red Hat Ceph Storage 9.0; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; RHODF-4.14-RHEL-9; and 35 more.
Medium [CVE-2025-23367] Org.wildfly.core:wildfly-server: wildfly improper rbac permission
A flaw was found in the Wildfly Server Role Based Access Control (RBAC) provider. A user with a Monitor or Auditor role is supposed to have only read access permissions and should not be able to suspend the server. The vulnerability is caused by the Suspend and Resume handlers not performing authorization checks to validate whether the current user has the required permissions to proceed with the action. Red Hat has evaluated this issue and the attacker must be authenticated as a user that belongs to the "Monitor" or "Auditor" management groups. It requires previous privileges to jeopardize an environment. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-284. Affected Red Hat products: Red Hat JBoss Enterprise Application Platform; Red Hat JBoss Enterprise Application Platform 7.4.22; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 8; Red Hat JBoss Enterprise Application Platform 7.4 for RHEL 9; Red Hat JBoss Enterprise Application Platform 7.4 on RHEL 7; Red Hat JBoss Enterprise Application Platform 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 8; Red Hat JBoss Enterprise Application Platform 8.0 for RHEL 9; Red Hat Data Grid 8; Red Hat Fuse 7; Red Hat JBoss Data Grid 7; Red Hat JBoss Enterprise Application Platform 7; Red Hat Process Automation 7; Red Hat Single Sign-On 7.
Medium [CVE-2025-0750] Cri-o: cri-o path traversal in log handling functions allows arbitrary unmounting
A vulnerability was found in CRI-O. A path traversal issue in the log management functions (UnMountPodLogs and LinkContainerLogs) may allow an attacker with permissions to create and delete Pods to unmount arbitrary host paths, leading to node-level denial of service by unmounting critical system directories. Red Hat severity: Moderate — CVSS 6.6 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H). Weakness: CWE-22. Affected Red Hat products: Red Hat OpenShift Container Platform 4.17; Red Hat OpenShift Container Platform 4. Red Hat fixing advisory: RHSA-2025:1122.
High [CVE-2024-11218] Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile
A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of files and directories on the host. This vulnerability marked as important severity rather than moderate because it allows a malicious Containerfile to exploit the `--mount` flag in `RUN` instructions to directly interact with the build host's filesystem. By leveraging this, an attacker can gain unauthorized access to sensitive files or inject malicious content using the privileges of the build process. In environments where the build process is executed by a root-owned Podman system service exposed to unprivileged users, this vulnerability escalates to a high level, as it enables unauthorized read/write access to high-privilege files, such as setuid executables. Red Hat severity: Important — CVSS 8.6 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Weakness: CWE-269. Affected products named by the advisory: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support; Red Hat Enterprise Linux 8.6 Telecommunications Update Service; Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions; Red Hat Enterprise Linux 8.8 Extended Update Support; and 13 more.
Free weekly CVE digest
Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.