Red Hat Vulnerabilities and Affected Products

Products

Red Hat Enterprise Linux 91,515 vulnerabilities
Red Hat Enterprise Linux 81,496 vulnerabilities
Red Hat Enterprise Linux 71,145 vulnerabilities
Red Hat Enterprise Linux 101,132 vulnerabilities
Red Hat Enterprise Linux 61,113 vulnerabilities
Red Hat OpenShift Container Platform 4430 vulnerabilities
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
Red Hat OpenShift AI (RHOAI)302 vulnerabilities
Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
Red Hat Hardened Images277 vulnerabilities
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
Red Hat Single Sign-On 7177 vulnerabilities
Red Hat Fuse 7175 vulnerabilities

Red Hat vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-19730MEDIUM	Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE\|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no w… CWE-459Aug 13, 2026	CVSS4.2v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-73584MEDIUM	Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in the `/tmp` directory. By repeatedly recreating a symbolic link, the attacker can redirect privileged output to an arbitrary file. This can lead to privileged file corruption or a denial of service (DoS) on the system. CWE-377Aug 13, 2026	CVSS6.3v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-73583MEDIUM	Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication (IPC) message parsing. By sending a specially crafted message, the attacker can cause out-of-bounds memory access, leading to the termination of the provider-manager process and a denial of service. This could also potentially result in limited unintended information disclosure. CWE-125Aug 13, 2026	CVSS6.6v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-73585MEDIUM	Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. By creating a symlink in a world-writable directory, an attacker can redirect privileged writes to an arbitrary file during script execution in a privileged context. This can lead to the overwrite of root-owned files, potentially disrupting system services or operation. Exploitation is conditional on the script running with eleva… CWE-377Aug 13, 2026	CVSS6.3v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19654HIGH	Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd A unauthenticated remote peer may lead rsyslogd to crash due to a flaw in the optional imptcp module. A crafted input sequence during oversize-frame recovery can cause an invalid internal message length and terminate rsyslogd. No confidentiality or integrity impact, privilege escalation, or code execution has been identified. imtcp and the default imptcp framing modes are not affected. CWE-125Aug 12, 2026	CVSS7.5v3.1	EPSS0.402%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-73433MEDIUM	Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write A flaw was found in GStreamer gst-plugins-good (avidemux). When parsing FUJIFILM metadata in an AVI strd chunk, gst_avi_demux_parse_strd() decrements a remaining-length counter by fixed offsets (98 and 10 bytes) without verifying sufficient data remains. For crafted strd payloads of exactly 106 or 107 bytes, the counter underflows to a very large unsigned value, causing subsequent null-terminated string scanning to read far beyond the allocated heap buffer. Date-format normalization may also wri… CWE-191Aug 12, 2026	CVSS6.6v3.1	EPSS0.127%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-73434MEDIUM	Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing A flaw was found in GStreamer gst-plugins-good (avidemux). In gst_avi_demux_riff_parse_vprp(), the number of available gst_riff_vprp_video_field_desc entries is calculated by dividing the remaining buffer size by the attacker-controlled vprp->fields value, rather than by sizeof(gst_riff_vprp_video_field_desc). This can cause the parser to treat more field descriptors as available than fit in the input buffer, resulting in out-of-bounds reads. Processing a crafted AVI via playbin/decodebin can cr… CWE-125Aug 12, 2026	CVSS6.1v3.1	EPSS0.127%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19548MEDIUM	Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct… CWE-416Aug 12, 2026	CVSS5.5v3.1	EPSS0.122%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18663MEDIUM	389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function frees the parsed controls array on the Session Tracking critical-control rejection path without clearing the SLAPI_REQCONTROLS pblock slot. Operation teardown then frees the same pointer again, causing a double-free. An unauthenticated remote attacker can trigger this with a single BIND request carrying a critical Session Tracking control, resulting in heap corruption and potential denial of service. CWE-415Aug 12, 2026	CVSS5.9v3.1	EPSS0.397%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19550MEDIUM	Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes A flaw was found in FreeIPA. The trust-fetch-domains command is gated by a read-only permission on the trust object rather than a trust-administration permission, allowing an authenticated, non-privileged IPA user to trigger a privileged Active Directory trust refresh using an attacker-supplied server and credentials, resulting in unauthorized, attacker-controlled modification of trusted-domain and ID-range identity data in the IPA LDAP directory. CWE-863Aug 11, 2026	CVSS4.3v3.1	EPSS0.193%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-14180MEDIUM	Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggle… CWE-444Aug 11, 2026	CVSS5.3v3.1	EPSS0.413%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19546HIGH	Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z. For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546. CWE-94Aug 11, 2026	CVSS8.8v3.1	EPSS0.306%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-71218MEDIUM	Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion A flaw was found in iperf3. A remote unauthenticated attacker can exploit a vulnerability in the `JSON_read()` function, which accepts a peer-controlled message length and allocates memory without an upper bound. This allows the attacker to trigger excessive memory consumption, leading to a Denial of Service (DoS) through memory exhaustion, severe slowdown, or termination of the iperf3 service. CWE-789Aug 11, 2026	CVSS5.3v3.1	EPSS0.383%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-71217HIGH	Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion A flaw was found in iperf3. A remote attacker can exploit this vulnerability by sending crafted control-channel JSON with oversized numeric parameters, such as `parallel` and `len`, which are not properly validated by the server. This improper input validation can lead to excessive stream and thread creation, as well as large buffer allocations, causing resource exhaustion. Consequently, this can result in a Denial of Service (DoS) on the affected iperf3 server. CWE-20Aug 11, 2026	CVSS7.5v3.1	EPSS0.417%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-72693HIGH	Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root`… CWE-284Aug 11, 2026	CVSS7.8v3.1	EPSS0.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-72694HIGH	Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation A flaw was found in MRTG. When the MRTG daemon is started as a root user and subsequently drops privileges, a local, low-privileged attacker can exploit a symbolic link (symlink) following vulnerability. By influencing or pre-placing a symlink in the process ID (PID) file path, the attacker can trick the root process into changing the ownership of an arbitrary existing file to the daemon user. This can lead to local privilege escalation, allowing unauthorized access to or modification of sensiti… CWE-59Aug 11, 2026	CVSS7.1v3.1	EPSS0.127%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6426MEDIUM	Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can … CWE-681Aug 10, 2026	CVSS4.4v3.1	EPSS0.239%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19411LOW	Shim/dp.c library: null-pointer dereference in is_removable_media_path() when devicepathtostr() returns null A NULL pointer vulnerability has been found in the the shim application of dp.c library. A missing NULL pointer could allow attackers to perform a denial of service attack on a system that uses shim application for UEFI bootloader. CWE-476Aug 10, 2026	CVSS3.9v3.1	EPSS0.098%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-63622HIGH	Libvirt: swtpm privilege escalation via symlink following A flaw was found in libvirt. A local attacker, specifically a process running as the confined `swtpm` user, could exploit a symlink-following vulnerability in the `virFileChownFiles()` function. By planting a symbolic link within the `swtpm` state directory, the attacker could trick the root-level libvirt daemon into changing the ownership of an arbitrary file to the `swtpm` user. This allows for privilege escalation from the `swtpm` sandbox to root-level file ownership control. CWE-59Aug 10, 2026	CVSS7.8v3.1	EPSS0.13%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59091HIGH	Gimp: gimp: multiple vulnerabilities in file format plugins via crafted image file A flaw was found in GIMP's file format plugins, including those for PSD and PAA files. A remote attacker could exploit these vulnerabilities by tricking a user into opening a specially crafted image file. This could lead to unexpected application behavior or other potential security impacts without requiring further user interaction. CWE-787Aug 10, 2026	CVSS7.3v3.1	EPSS0.167%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-63623MEDIUM	Libvirt: information disclosure via world-readable storage volume images during clone/convert A flaw was found in libvirt. During storage volume clone or convert operations, newly created volume images were temporarily world-readable. This was caused by the `qemu-img` utility running with overly permissive file creation settings, allowing any local user to read the full guest disk contents. This vulnerability could lead to sensitive information disclosure from guest virtual machines. CWE-732Aug 10, 2026	CVSS5.5v3.1	EPSS0.095%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59090HIGH	Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the `block_rem` variable, occurs when a user opens a specially crafted `.psd` image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource blocks. This can ultimately result in arbitrary code execution, allowing the attacker to run malicious code on the victim's system. CWE-191Aug 10, 2026	CVSS8.4v3.1	EPSS0.308%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59088MEDIUM	Gimp: gimp: denial of service via signed integer overflow in fli file processing A flaw was found in GIMP. A signed integer overflow vulnerability exists in the `file-fli` plugin when processing FLI image files. This occurs due to an incorrect calculation during memory allocation for image buffers, where the multiplication of image width and height can exceed the maximum integer value. A remote attacker could exploit this by tricking a user into opening a specially crafted FLI file, leading to the application crashing and resulting in a denial of service. CWE-190Aug 10, 2026	CVSS5.5v3.1	EPSS0.16%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-59087HIGH	Gimp: heap buffer overflow in `file-seattle-filmworks` load — `fread` writes attacker-controlled length into undersized allocation A flaw was found in the GIMP image manipulation program, specifically within its Seattle Filmworks file loader. A remote attacker could exploit this vulnerability by tricking a user into opening a specially crafted Seattle Filmworks file. This could lead to a heap overflow, allowing the attacker to write several kilobytes of controlled data beyond the intended memory buffer. Such an overflow can result in memory corruption, potentially leading to arbitrary code execution or a denial of service. CWE-787Aug 10, 2026	CVSS7.8v3.1	EPSS0.227%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19404MEDIUM	389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, allowing an unauthenticated remote attacker to invoke them when nsslapd-allow-anonymous-access is enabled (the default), or any authenticated low-privilege user to invoke them otherwise. This allows removal of a replica ID from replication metadata, purging of changelog records, and interruption of administrator-initiated cleanup, which can l… CWE-862Aug 10, 2026	CVSS6.5v3.1	EPSS0.416%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX