Red Hat Vulnerabilities and Affected Products

Products

Red Hat Enterprise Linux 91,515 vulnerabilities
Red Hat Enterprise Linux 81,496 vulnerabilities
Red Hat Enterprise Linux 71,145 vulnerabilities
Red Hat Enterprise Linux 101,132 vulnerabilities
Red Hat Enterprise Linux 61,113 vulnerabilities
Red Hat OpenShift Container Platform 4430 vulnerabilities
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
Red Hat OpenShift AI (RHOAI)302 vulnerabilities
Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
Red Hat Hardened Images277 vulnerabilities
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
Red Hat Single Sign-On 7177 vulnerabilities
Red Hat Fuse 7175 vulnerabilities

Red Hat vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-13676HIGH	fast-uri vulnerable to host confusion via failed IDN canonicalization fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs. The IDN conversion path calls a helper that does not exist on the global URL constructor, silently leaving the host in its original Unicode form while normalize() and equal() still return values that differ from a WHATWG-compatible URL parser. Applications that use fast-uri to enforce host-based policy (denylists, loopback filtering, redirect validation, outbound proxy routing) befo… CWE-436 CWE-551Jun 29, 2026	CVSS7.5v3.1	EPSS0.384%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-58049HIGH	FFmpeg - Out-of-Bounds Write in RASC Decoder decode_dlta() FFmpeg's RASC video decoder (decode_dlta in libavcodec/rasc.c) performs 32-bit reads and writes at the row cursor before the NEXT_LINE row-boundary check and validates the DLTA region in pixel rather than byte units, so a DLTA run on a PAL8 frame can access several bytes past the row allocation. A crafted media stream using the RASC FourCC, decoded by libavcodec, triggers a bitstream-controlled out-of-bounds heap write and adjacent out-of-bounds read, leading to memory corruption. CWE-787Jun 28, 2026	CVSS8.8v4.0	EPSS0.275%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-54513HIGH	jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though E… CWE-184Jun 23, 2026	CVSS8.1v3.1	EPSS0.712%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-41523HIGH	vLLM: Security Check Bypass via assert Statement in Activation Function Loading Allows Arbitrary Code Execution vLLM is an inference and serving engine for large language models (LLMs). Prior to 0.22.0, an assert-based security check in vLLM's activation function loading allows any unauthenticated attacker to achieve arbitrary code execution on the server by publishing a malicious HuggingFace model, when vLLM runs in Python optimized mode (python -O or PYTHONOPTIMIZE=1). This vulnerability is fixed in 0.22.0. CWE-617 CWE-94Jun 22, 2026	CVSS7.5v3.1	EPSS0.746%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-48746CRITICAL	vLLM: OpenAI auth bypass vLLM is an inference and serving engine for large language models (LLMs). From 0.3.0 until 0.22.0, a vulnerability in ASGI web servers and starlette's trust on those web servers enables an authentication bypass of the OpenAI API AuthenticationMiddleware. It allows to use the API without providing the configured VLLM_API_KEY or --api-key. This vulnerability is fixed in 0.22.0. CWE-444 CWE-501Jun 22, 2026	CVSS9.1v3.1	EPSS1.15%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-56340HIGH	vLLM - Denial of Service via Unvalidated Multimodal Embeddings vLLM versions >= 0.10.2 and < 0.13.0 are missing sparse tensor validation in multimodal embeddings processing. Because PyTorch disables sparse tensor invariant checks by default, an attacker can submit crafted embedding requests with malformed (negative or out-of-bounds) tensor indices, when the prompt-embeds feature is enabled, to trigger crashes or resource exhaustion (denial of service), with potential for out-of-bounds/write-what-where memory corruption. This continues CVE-2025-62164, whose … CWE-20 CWE-787Jun 20, 2026	CVSS8.7v4.0	EPSS0.352%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-12706MEDIUM	Ffmpeg: ffmpeg: heap use-after-free read in rasc decoder decode_move() A use-after-free vulnerability was found in FFmpeg's RASC video decoder. The decode_move() function initializes a read pointer into a decompressed buffer, but a subsequent reallocation of that same buffer during move-table processing leaves the pointer dangling. An attacker could exploit this by providing a specially crafted AVI file containing a malicious RASC video stream. When a user opens or plays the file, the decoder reads from freed heap memory, which could lead to a denial of service (cr… CWE-416Jun 19, 2026	CVSS6.5v3.1	EPSS0.245%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-8461HIGH	Heap out-of-bounds write via odd slice_height in FFmpeg MagicYUV decoder An out-of-bounds write vulnerability in FFmpeg's libavcodec library, specifically in the MagicYUV decoder, allows denial-of-service and, in some cases, can be exploited for remote code execution. This vulnerability is associated with the file libavcodec/magicyuv.C. This issue affects FFmpeg before version 8.1.2. CWE-787Jun 18, 2026	CVSS8.8v3.1	EPSS1.57%	PoCs5	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-48818HIGH	Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows Starlette is a lightweight ASGI framework/toolkit. In versions 1.0.1 and earlier, StaticFiles on Windows is vulnerable to SSRF. An UNC path such as \\attacker.com\share can cause os.path.realpath to initiate an outbound SMB connection before the path is rejected, exposing the service account’s NTLMv2 credentials for offline cracking or relay even though the HTTP response is only a 404. The issue affects default follow_symlink=False deployments, including frameworks built on Starlette such as Fas… CWE-918Jun 17, 2026	CVSS7.5v3.1	EPSS0.368%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-12491MEDIUM	Vllm: vllm: image exif rotation & png trns transparency not normalized, causing mismatch between model input and expectations A flaw was found in vLLM, an open-source library for large language model inference. This vulnerability arises from improper handling of image metadata, specifically EXIF orientation and PNG transparency (tRNS) data, during image processing. When images are converted to RGB, transparency information may be implicitly discarded or remapped, leading to unexpected rendering of transparent pixels and distortion of input content. This can result in the model misinterpreting image content, potentially… CWE-115 CWE-436Jun 17, 2026	CVSS4.8v3.1	EPSS0.239%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-48779HIGH	ws: Memory exhaustion DoS from tiny fragments and data chunks ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-si… CWE-1050 CWE-400 CWE-770Jun 16, 2026	CVSS7.5v3.1	EPSS0.782%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-12143HIGH	form-data does not escape CR/LF/quote in multipart field names and filenames (CRLF injection) form-data is a library for creating readable multipart/form-data streams. In versions through 4.0.5, the `field` argument to `FormData#append` and the `filename` option are concatenated verbatim into the `Content-Disposition` header without escaping carriage return (CR), line feed (LF), or double-quote (") characters. An application that passes attacker-controlled data as a field name or filename (for example, an API gateway that turns JSON object keys into multipart field names) allows the atta… CWE-93Jun 12, 2026	CVSS8.7v4.0	EPSS0.535%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-45833CRITICAL	Generated title:ChromaDB Code Injection via Malicious Model Repository A code injection vulnerability in version 0.4.17 or later of the ChromaDB Python project allows an authenticated attacker to run arbitrary code on the server by sending a malicious model repository and trust_remote_code set to true in the /api/v2/tenants/default_tenant/databases/default_database/collections/{collection_id} if they have the UPDATE_COLLECTION permission. CWE-94Jun 12, 2026	CVSS9.4v4.0	EPSS0.342%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-45832HIGH	Generated title:ChromaDB V1 Collection-Level Endpoint Authorization Bypass All V1 collection-level endpoints in ChromaDB's Python project pass None for the tenant and database to the authorization layer, allowing attackers to bypass authorization controls by using the V1 endpoints. CWE-551 CWE-639Jun 12, 2026	CVSS8.8v4.0	EPSS0.284%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-50010HIGH	Netty's wrapping plain trust manager silently disables hostname verification Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SimpleTrustManagerFactory.engineGetTrustManagers() and related paths wrap any user-supplied plain X509TrustManager in X509TrustManagerWrapper, which extends X509ExtendedTrustManager but implements the 3-arg checkServerTrusted(chain, authType, SSLEngine) by discarding the SSLEngine and calling the 2-arg delegate. Because the object now IS an X509ExtendedTrust… CWE-347Jun 12, 2026	CVSS7.5v3.1	EPSS0.456%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-45830HIGH	Generated title:ChromaDB Authorization Bypass Allowing Cross-Tenant Data Access and Modification A lack of authorization validation in version 0.4.17 or later of the ChromaDB Python project allows any authenticated users to arbitrarily read, write, update, or delete data in any tenant's collection regardless of which tenant they belong to. CWE-266 CWE-639Jun 12, 2026	CVSS8.8v4.0	EPSS0.345%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-48043MEDIUM	netty-codec-http2: ByteBuf Reference-Count Leak in DelegatingDecompressorFrameListener Leads to Memory Exhaustion Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and 4.2.15.Final, the `DelegatingDecompressorFrameListener` class orchestrates HTTP/2 decompression by embedding a per-stream `EmbeddedChannel` that runs the appropriate decompression codec (gzip, deflate, zstd) and forwards decompressed chunks to a wrapped listener. Each decompressed chunk is a pooled `ByteBuf` handed to an anonymous `ChannelInboundHandl… CWE-400 CWE-401 CWE-772Jun 12, 2026	CVSS5.3v3.1	EPSS0.617%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-47691HIGH	Netty has Insufficient Bailiwick Validation for NS Records Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORI… CWE-345 CWE-346Jun 12, 2026	CVSS8.7v3.1	EPSS0.318%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-46340HIGH	Netty: SCTP reassembly nests buffers without bound Netty is a network application framework for development of protocol servers and clients. In versions of netty-transport-sctp prior to 4.1.135.Final and 4.2.15.Final, for each non-complete SctpMessage fragment the handler does `fragments.put(streamId, Unpooled.wrappedBuffer(frag, byteBuf))`, wrapping the previous accumulator and the new slice into a new CompositeByteBuf every time. After N fragments the accumulator is an N-deep chain of composites, each holding references and component arrays;… CWE-770Jun 12, 2026	CVSS7.5v3.1	EPSS0.461%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-45674HIGH	Netty Vulnerable to DNS Cache Poisoning via Missing Bailiwick Checks in CNAME Records Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's DnsResolveContext fails to validate the origin (bailiwick) of CNAME records in DNS responses. Versions 4.1.135.Final and 4.2.15.Final patch the issue. CWE-345 CWE-346Jun 12, 2026	CVSS8.7v3.1	EPSS0.248%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-45416HIGH	Netty: SNI handler pre-allocates up to 16 MiB from nine attacker bytes Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, SslClientHelloHandler.decode() reads the 24-bit TLS handshake length and, when the ClientHello does not fit in the first record, eagerly allocates `ctx.alloc().buffer(handshakeLength)` (line 161). The guard at line 140 is `handshakeLength > maxClientHelloLength && maxClientHelloLength != 0`, and the commonly-used SniHandler/AbstractSniHandler constructors (S… CWE-770Jun 12, 2026	CVSS7.5v3.1	EPSS0.856%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-44249HIGH	Netty has an IPv6 Subnet Filter Bypass via Incorrect Comparator Masking Netty is a network application framework for development of protocol servers and clients. In netty-handler prior to versions 4.1.135.Final and 4.2.15.Final, an attacker can bypass IPv6 subnet rules due to an incorrect masking operation in IpSubnetFilterRule.compareTo(). Valid public IP addresses can bypass the restrictions. Versions 4.1.135.Final and 4.2.15.Final patch the issue. CWE-1287 CWE-284 CWE-697Jun 11, 2026	CVSS8.1v3.1	EPSS1.03%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-44486HIGH	Axios: Proxy-Authorization header leaks to redirect target when proxy is re-evaluated to direct connection Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’ Node.js HTTP adapter can leak proxy credentials to a redirect target in affected versions. When a request is sent through an authenticated proxy, Axios may add a Proxy-Authorization header. If Axios then follows a redirect and the redirected request is no longer sent through that proxy, the stale Proxy-Authorization header can remain on the redirected request and be sent to the redirect target. T… CWE-200 CWE-201Jun 11, 2026	CVSS7.5v3.1	EPSS0.66%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-44487HIGH	Axios: Proxy-Authorization Credential Leak to Origin Server Across HTTP-to-HTTPS Redirect in Axios Node.js HTTP Adapter Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios’s Node.js HTTP adapter may forward a Proxy-Authorization header to a redirected origin during specific proxy-to-direct redirect flows. This affects Node.js usage, where an initial HTTP request is sent through an authenticated HTTP proxy, redirects are followed, and the redirected URL is no longer proxied. Under affected redirect shapes, the final origin can receive the proxy credential that was in… CWE-201Jun 11, 2026	CVSS8.2v4.0	EPSS0.664%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-44488HIGH	Axios: Allocation of Resources Without Limits or Throttling in axios Axios is a promise based HTTP client for the browser and Node.js. Axios versions 1.7.0 through 1.15.x did not enforce configured request and response size limits when requests were sent with the fetch adapter. Applications that selected adapter: 'fetch', or ran in environments where axios resolved to the fetch adapter, could receive or send bodies larger than maxContentLength or maxBodyLength despite those limits being explicitly configured. This can cause resource exhaustion in server-side usag… CWE-770Jun 11, 2026	CVSS7.5v3.1	EPSS0.622%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX