Red Hat Vulnerabilities and Affected Products

Products

Red Hat Enterprise Linux 91,515 vulnerabilities
Red Hat Enterprise Linux 81,496 vulnerabilities
Red Hat Enterprise Linux 71,145 vulnerabilities
Red Hat Enterprise Linux 101,132 vulnerabilities
Red Hat Enterprise Linux 61,113 vulnerabilities
Red Hat OpenShift Container Platform 4430 vulnerabilities
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
Red Hat OpenShift AI (RHOAI)302 vulnerabilities
Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
Red Hat Hardened Images277 vulnerabilities
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
Red Hat Single Sign-On 7177 vulnerabilities
Red Hat Fuse 7175 vulnerabilities

Red Hat vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-14180MEDIUM	Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggle… CWE-444Aug 11, 2026	CVSS5.3v3.1	EPSS0.413%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15567HIGH	Wildfly: wildfly-iiop: wildfly-jacorb: wildfly: pre-auth denial of service on the iiop listener A flaw was found in Wildfly. A remote unauthenticated attacker can trigger OutOfMemoryError as CSIv2Util's GSS token decoder reads an attacker-controlled length field without bounds checking and attempts to allocate a byte array of that size. CWE-789Aug 11, 2026	CVSS7.5v3.1	EPSS0.436%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15565HIGH	Undertow: undertow-websockets: undertow: pre-auth dos on websocket endpoint with @serverendpoint class with any @onmessage method A flaw was found in Undertow. A remote attacker can cause Out of Memory on websockets endpoint without authentication on any @ServerEndpoint class that has any @OnMessage method. This allows an attacker to cause Denial of Service attack without authentication and using only a standard WebSocket handshake. CWE-120Aug 11, 2026	CVSS7.5v3.1	EPSS0.476%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15563HIGH	Wildfly-iiop-openjdk: missing authentication on eap's iiop nameservice leads to mitm or dos A flaw was found in EAP's IIOP. The listener's NameService would accept bind operations without authentication, allowing an attacker to hijack JNDI lookups and binding them to a malicious ORB, achieving MITM or DoS on further invocations. CWE-306Aug 11, 2026	CVSS7.4v3.1	EPSS0.29%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15562HIGH	Jboss-remoting: jboss-remoting: integer overflow in messagereader leads to pre-authentication denial of service A flaw was found in EAP's jboss-remoting. A remote unauthenticated attacker who can reach :8080 (or :9990, or :4447) and complete an Upgrade: jboss-remoting handshake can cause OOM errors that degrade requests server-wide, leading to denial of service. CWE-190Aug 11, 2026	CVSS7.5v3.1	EPSS0.441%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15561HIGH	Undertow-core: oom via missing limits in chunked trailer in eap's undertow A flaw was found in EAP's undertow http/1.1 chunked-transfer decoder. missing limits on size and count would allow an attacker to use an unauthenticated connection to drive the JVM to an OutOfMemory error, stopping all deployments on the listener, and achieving Denial of Service. CWE-770Aug 11, 2026	CVSS7.5v3.1	EPSS0.35%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15560HIGH	Openjdk-orb: unauthed class loading via iiop in eap when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object unmarshalling on :3528, allowing an unauthenticated attacker to load and instantiate arbitrary classes from a remote URL in the server JVM before EJB security interceptors run. CWE-829Aug 11, 2026	CVSS8.1v3.1	EPSS0.439%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15556HIGH	Picketlink-federation: picketlink saml 2.0 auth bypass via missing assertions A flaw was found in Picketlink's SP signature validation; a SAML response containing zero assertion elements matching the signature check can allow an attacker to forge a SAML response and auth as any principal with any roles on the protected application. CWE-347Aug 11, 2026	CVSS8.1v3.1	EPSS0.218%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15555HIGH	Jboss-marshalling-river: wildfly-clustering-infinispan-marshalling: jboss deserialization rce via unfiltered river unmarshaller A flaw was found in JBoss marshalling. The Infinispan session replication path deserializes replicated session data via the JBoss Marshalling River unmarshaller with no class filtering — enabling RCE via deserialization gadget chains on every cluster node. CWE-502Aug 11, 2026	CVSS8.8v3.1	EPSS0.263%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15554HIGH	Undertow-core: undertow: authentication bypass via ajp ssl_cert/is_ssl forgery the Undertow AJP listener honours forged ssl_cert and is_ssl AJP attributes without requiring any shared-secret authentication. This enables an unauthenticated attacker with direct TCP access to port 8009 to bypass CLIENT-CERT authentication by injecting a forged X.509 certificate via the AJP protocol. CWE-295Aug 11, 2026	CVSS7.4v3.1	EPSS0.222%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-24330MEDIUM	Wildfly-core: wildfly: arbitrary file read via malicious archive deployment A flaw was found in wildfly-core. A remote attacker, authenticated as a 'deployer' account, can import and deploy a malicious archive file from an untrusted source. This is achieved by leveraging WildFly libraries to craft a Java project that allows an HTTP POST request to upload and deploy the malicious archive. This could lead to further exploitation, such as arbitrary file read vulnerabilities. CWE-434Aug 11, 2026	CVSS6.5v3.1	EPSS0.297%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-24329MEDIUM	Wildfly-core: wildfly core: denial of service via malformed payload injection by an authenticated administrative user. A flaw was found in wildfly-core. A remote user authenticated as an administrative user can inject a malformed payload into the Inet Address field through the Management Model. This injection causes the server to crash and become unrecoverable, as the payload is written into the standalone.xml configuration file. Manual intervention is required to restore server operation, leading to a denial of service. CWE-91Aug 11, 2026	CVSS4.9v3.1	EPSS0.344%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18967MEDIUM	Keycloak-services: keycloak-services: saml onetimeuse assertion replay in idp-initiated broker flow A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker using the IdP-Initiated flow, Keycloak fails to enforce the OneTimeUse condition in SAML assertions. This allows an attacker who captures a valid, unused assertion to replay it multiple times. Successful exploitation could allow an attacker to hijack a user's session and gain unauthorized access to the system as that user. CWE-294Aug 6, 2026	CVSS6.4v3.1	EPSS0.144%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16442HIGH	Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction A flaw was found in the SAML broker component of Keycloak, which is used to manage identity federation and user authentication. The issue occurs because the IdP-initiated Single Sign-On endpoint fails to check if a provider is restricted to account linking only. This allows an attacker with control over a linked upstream identity to bypass login restrictions and gain full access to a local user account. CWE-346Aug 5, 2026	CVSS7.4v3.1	EPSS0.202%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16100MEDIUM	Keycloak-services: keycloak-services: unbounded metric cardinality in user event metrics via request-controlled error text A flaw was found in the user-event metrics recording of Keycloak. When metrics are enabled, the system records raw error messages from failed account operations as Prometheus metric labels. Because these error messages can include user-supplied input like nonexistent client IDs, an authenticated user can create a massive number of unique metric entries, eventually exhausting system memory and causing the service to crash or become unavailable. CWE-770Aug 5, 2026	CVSS6.5v3.1	EPSS0.307%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16071MEDIUM	Keycloak-services: keycloak-services: ldap entry-dn user search bypasses configured users dn boundary A flaw was found in the LDAP storage provider of Keycloak, which is used to federate user identities from external directories. The issue occurs when a delegated administrator performs a search using a specific LDAP entry Distinguished Name (DN). Due to missing validation, the system allows lookups for users located outside the configured search boundary, leading to the disclosure of account information from unauthorized parts of the directory and unintended importing of those users into local s… CWE-269Aug 5, 2026	CVSS5.4v3.1	EPSS0.181%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16102HIGH	Keycloak-services: keycloak-services: default dcr policy allows role forgery via user property mappers A flaw was found in the Dynamic Client Registration (DCR) component of Keycloak, an identity and access management solution. The default DCR policy fails to properly validate the claim path for User Property mappers, allowing them to write values to sensitive internal claim locations. An attacker with a standard user account and a limited Initial Access Token can exploit this to forge administrative roles in their access token. This allows the attacker to take over other clients, steal confident… CWE-284Aug 5, 2026	CVSS8.1v3.1	EPSS0.253%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15573HIGH	Keycloak-services: keycloak-services: authorization bypass via unnormalized uri matching in pathmatcher A flaw was found in Keycloak's Authorization Services. The component responsible for matching request paths to security policies (PathMatcher) does not properly normalize URIs before comparison. By adding extra characters like a trailing slash or matrix parameters to a URL, an attacker can trick the system into applying a less restrictive security policy than intended. This allows an authenticated user to access administrative or restricted areas they should not have permission to see. CWE-178Aug 5, 2026	CVSS8.1v3.1	EPSS0.29%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16443HIGH	Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation A flaw was found in the SAML metadata import functionality of the keycloak-services component, which is the core engine for identity brokering in Red Hat Build of Keycloak. When importing identity provider metadata that lacks specific usage attributes for keys, the system incorrectly disables signature validation for SAML responses even if a signing certificate is provided. This issue allows an unauthenticated attacker to forge a SAML response and gain unauthorized access to a user account by kn… CWE-347Aug 5, 2026	CVSS7.4v3.1	EPSS0.154%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18569LOW	Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logout tokens A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This component handles authentication and session management for applications. The issue occurs when an OIDC identity provider is configured to skip signature validation. In this specific setup, the system incorrectly accepts logout requests that have no cryptographic signature. An attacker who knows certain technical details about a user's session can use this … CWE-347Aug 4, 2026	CVSS3.7v3.1	EPSS0.16%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-17614MEDIUM	Wildfly-core: path traversal on wildfly domain controller A path traversal flaw was found in WildFly's domain mode implementation. The LocalFileRepository.getFile() and getConfigurationFile() methods in wildfly-core/deployment-repository do not validate that the resolved file path remains within the configured repository or configuration root directories. A remote attacker who has obtained the slave host controller secret or compromised a slave host controller can supply a crafted relative path containing directory traversal sequences (… CWE-22Aug 4, 2026	CVSS4.4v3.1	EPSS0.85%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18573MEDIUM	Keycloak-services: keycloak-services: client access-type policy condition bypass during client update A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a realm administrator configures client policies to enforce specific authentication requirements on confidential clients. Due to improper evaluation of the client state during an update operation, an attacker with client management permissions can bypass these security policies by first creating a public client and then updating it to a confide… CWE-862Aug 2, 2026	CVSS6.5v3.1	EPSS0.221%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18572MEDIUM	Keycloak-services: keycloak-services: uma claim token can override authorization time-policy evaluation attributes Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only allowing access during business hours). A flaw was discovered where a user can include a fake time value in their authorization request that overrides the actual server time. This allows the user to bypass these time-based restrictions and access protected resources at unauthorized times. CWE-863Aug 2, 2026	CVSS6.5v3.1	EPSS0.182%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18571MEDIUM	Keycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator with permission to create users to add those users to any group, even groups the sub-administrator is not authorized to manage. This could lead to unauthorized access to sensitive information or elevated privileges for the newly created users. CWE-862Aug 2, 2026	CVSS6.6v3.1	EPSS0.245%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18570MEDIUM	Keycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security policies during client registration and configuration in Red Hat Build of Keycloak. The issue occurs because the executor only validates the fullScopeAllowed field when it is explicitly provided in a request. By omitting this field, a delegated user can bypass the policy, resulting in a client created with full scope access. This allows t… CWE-862Aug 2, 2026	CVSS5.4v3.1	EPSS0.141%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX