Red Hat Vulnerabilities and Affected Products

Products

Red Hat Enterprise Linux 91,515 vulnerabilities
Red Hat Enterprise Linux 81,496 vulnerabilities
Red Hat Enterprise Linux 71,145 vulnerabilities
Red Hat Enterprise Linux 101,132 vulnerabilities
Red Hat Enterprise Linux 61,113 vulnerabilities
Red Hat OpenShift Container Platform 4430 vulnerabilities
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support402 vulnerabilities
Red Hat Enterprise Linux 9.6 Extended Update Support386 vulnerabilities
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support377 vulnerabilities
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions367 vulnerabilities
Red Hat Enterprise Linux 10.0 Extended Update Support361 vulnerabilities
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions356 vulnerabilities
Red Hat Enterprise Linux 8.8 Telecommunications Update Service353 vulnerabilities
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On325 vulnerabilities
Red Hat Enterprise Linux 7 Extended Lifecycle Support319 vulnerabilities
Red Hat OpenShift AI (RHOAI)302 vulnerabilities
Red Hat Enterprise Linux 9.4 Extended Update Support297 vulnerabilities
Red Hat Hardened Images277 vulnerabilities
Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions270 vulnerabilities
Red Hat Enterprise Linux 8.6 Telecommunications Update Service253 vulnerabilities
Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions253 vulnerabilities
Red Hat JBoss Enterprise Application Platform Expansion Pack236 vulnerabilities
Red Hat Enterprise Linux 8.2 Advanced Update Support213 vulnerabilities
Red Hat Single Sign-On 7177 vulnerabilities
Red Hat Fuse 7175 vulnerabilities

Red Hat vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2026-19730MEDIUM	Podman: podman: quadlet install --replace non-truncating write retains removed host-access directives The 'podman quadlet install --replace' command opens the existing destination file with O_CREATE\|O_WRONLY but omits O_TRUNC. When the initial reflink copy attempt fails (common on non-reflink-capable filesystems including many RHEL default XFS configurations), the fallback in ReflinkOrCopy uses io.Copy which performs a non-truncating write. If the original Quadlet is larger than the new Quadlet, the file is not truncated and content from the original is preserved. The command completes with no w… CWE-459Aug 13, 2026	CVSS4.2v3.1	EPSS-	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19548MEDIUM	Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing Multiple Use-After-Free vulnerabilities were found in the add_archive_element function in ld/ldmain.c of the GNU linker (ld), a component of binutils. The root cause is that plugin_maybe_claim() in ld/plugin.c frees the original BFD object via bfd_close/_bfd_delete_bfd when entry->the_bfd->my_archive == NULL, but the caller retains both the original abfd parameter and a shallow copy (orig_input.the_bfd) as dangling pointers. These dangling pointers are subsequently dereferenced at three distinct… CWE-416Aug 12, 2026	CVSS5.5v3.1	EPSS0.122%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19078MEDIUM	Ose-oauth-server: oauth-server: open redirect vulnerability enables phishing via unvalidated parameter. A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website. This could enable phishing attacks, potentially tricking users into revealing sensitive information. CWE-601Aug 11, 2026	CVSS4.3v3.1	EPSS0.26%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-50236HIGH	Openshift/console: authenticated ssrf with full response reflection and path neutralization via dev console webhook helpers in openshift console An authenticated SSRF flaw was found in the OpenShift Console Dev Console webhook helpers. User-supplied target URLs are fetched server-side without validation, with path neutralization enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position. CWE-918Aug 11, 2026	CVSS7.4v3.1	EPSS0.215%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-50237HIGH	Openshift/console: namespace tenant ssrf with egress bypass, catalog poisoning, and admin-mediated supply chain escalation via projecthelmchartrepository in openshift console A Server-Side Request Forgery and supply chain flaw was found in the OpenShift Console Helm catalog proxy. A namespace tenant can plant a ProjectHelmChartRepository with an arbitrary URL that the console pod fetches server-side, bypassing tenant egress restrictions. Combined with catalog metadata poisoning and admin-mediated chart installation, this enables privilege escalation. CWE-918Aug 11, 2026	CVSS7.4v3.1	EPSS0.169%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-72693HIGH	Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login `openvt -u` is intended to identify the owner of the current VT and then execute `login` as that user from a privileged context. In the documented `kbrequest`/init usage, the ownership test in `authenticate_user()` relies on `stat("/proc/<pid>/fd/0")`. `stat()` on `/proc/<pid>/fd/0` follows the symlink to the underlying TTY device node. As a result, `buf.st_uid` reflects the owner of the TTY node rather than the owner of the process holding the file descriptor. If the TTY owner returns to `root`… CWE-284Aug 11, 2026	CVSS7.8v3.1	EPSS0.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-6426MEDIUM	Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access A type mismatch vulnerability was found in QEMU's vhost inflight migration VMState handling. The destination buffer size is stored as a uint64_t but read by the VMS_VBUFFER load path as a signed int32_t. On little-endian hosts, a crafted incoming migration state with bit 31 set causes the value to be interpreted as negative and then implicitly converted to a very large size_t, leading qemu_get_buffer() to copy migration-stream data beyond the bounds of the mmap-backed inflight region. This can … CWE-681Aug 10, 2026	CVSS4.4v3.1	EPSS0.239%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-15816HIGH	Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() A flaw was found in dracut. The die() error-handling function writes its message into a shell script under the initramfs emergency-hook directory without properly shell-quoting it. When the message contains data derived from the DHCP ROOT_PATH option, an attacker on the adjacent network who controls a rogue DHCP server can inject a command-substitution sequence that executes as root the next time dracut sources its emergency hook scripts during standard boot-failure handling. CWE-78Aug 7, 2026	CVSS7.5v3.1	EPSS0.25%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18938MEDIUM	P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to a memory corruption issue, specifically a heap out-of-bounds write, which can crash the p11-kit RPC parsing process, resulting in a Denial of Service (DoS). This vulnerability is only exploitable on 32 … CWE-122Aug 7, 2026	CVSS6.2v3.1	EPSS0.107%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-19079MEDIUM	Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation A TOCTOU (Time-of-Check-Time-of-Use) race condition vulnerability was found in the fixfiles script in policycoreutils. When running fixfiles relabel or fixfiles restore, the script used find and chcon commands to locate and relabel unlabeled files under /tmp and other directories. A local attacker could exploit a race window between the file discovery and the label change operation by swapping directory components with symlinks, causing chcon to follow the symlink and modify SELinux labels on ar… CWE-367Aug 7, 2026	CVSS4.4v3.1	EPSS0.082%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18839LOW	Popt-devel: popt-static: size_t underflow in singleoptionhelp An integer underflow was found in the popt library when formatting help text for option tables that exceed the terminal width. A local user who can cause an application to print help under those conditions may cause that application to crash or fail to display help, resulting in a denial of service of the affected application. CWE-191Aug 5, 2026	CVSS2.2v3.1	EPSS0.084%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-49331MEDIUM	Openshift/oauth-proxy: openshift/oauth-proxy: unauthenticated identity header injection on whitelisted paths A flaw was found in openshift/oauth-proxy. On paths configured to bypass authentication (skip-auth-regex), the proxy forwards client-supplied identity headers (X-Forwarded-User, X-Forwarded-Email, X-Forwarded-Access-Token) to the upstream application without stripping them. An unauthenticated attacker can inject forged identity headers on whitelisted paths. CWE-345Aug 5, 2026	CVSS6.5v3.1	EPSS0.13%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-71227MEDIUM	Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return A flaw was found in libkcapi. A local attacker can influence an application that uses the Asynchronous Input/Output (AIO) interface. By reusing an AIO-enabled handle after a prior completion error, the _kcapi_aio_read_all() function can enter a non-terminating wait loop. This can lead to a persistent denial of service, making the affected application or thread unresponsive. CWE-835Aug 5, 2026	CVSS5.1v3.1	EPSS0.112%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-71226HIGH	Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path Memory Corruption via Uncanceled AIO Requests on Error: libkcapi's one-shot AIO path can return an error before all submitted IOCBs are drained, allowing later kernel writes into caller-owned output buffers. CWE-416Aug 5, 2026	CVSS7.3v3.1	EPSS0.116%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-71225MEDIUM	Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries A flaw was found in libkcapi. When performing one-shot symmetric cipher operations on large inputs (over 64 KiB) in stateful modes such as Counter (CTR) or Cipher Block Chaining (CBC), the library improperly reuses the Initialization Vector (IV) for each internal data chunk. A remote attacker could potentially exploit this by making an application that uses libkcapi process specially crafted large inputs. This can lead to a significant weakening of data confidentiality, as the repeated IV use ca… CWE-330Aug 5, 2026	CVSS6.5v3.1	EPSS0.24%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-68743MEDIUM	Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1 A flaw was found in SSSD. The extract_authtok_v1() function in the PAM responder does not validate the auth_token_length field against the remaining buffer size before processing. A local attacker can exploit this via a crafted protocol v1 request to the PAM responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. CWE-125Aug 4, 2026	CVSS5.5v3.1	EPSS0.136%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18739LOW	Popt-devel: popt-static: off-by-one in poptstuffargs A flaw was found in popt, a command-line option parsing library. An off-by-one error in the poptStuffArgs function, when repeatedly called by a host application or through deep alias nesting, can lead to corruption of internal program data. This corruption could potentially enable a local attacker to execute arbitrary code if the host application then unsafely processes the altered data. CWE-787Aug 4, 2026	CVSS2.5v3.1	EPSS0.095%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-68744LOW	Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process. CWE-908Aug 4, 2026	CVSS3.3v3.1	EPSS0.097%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18477MEDIUM	Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape A TOCTOU (Time-of-Check Time-of-Use) vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During restoration, files or directories may be created, renamed or overwritten outside the intended extraction directory. This could lead to unauthorized file modification or, in some cases, privilege escalatio… CWE-367Aug 3, 2026	CVSS4.4v3.1	EPSS0.105%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-18508MEDIUM	Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite A flaw was found in GNU tar. When extracting an archive with the --one-top-level option, hardlink targets are not confined to the designated top-level directory and may resolve relative to the extraction working directory. A crafted archive can create hardlinks that escape the intended boundary and, when combined with a preexisting symbolic link under the working directory, may allow writing outside that boundary during a single extraction. CWE-59Aug 3, 2026	CVSS4.4v3.1	EPSS0.137%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-68742MEDIUM	Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr A flaw was found in SSSD. The sss_nss_protocol_parse_addr() function in the NSS responder does not validate the addrlen field against the remaining packet body size. A local attacker can exploit this via a crafted GETHOSTBYADDR request to the NSS responder socket, causing an out-of-bounds read and process crash, resulting in a denial of service. CWE-125Aug 3, 2026	CVSS5.5v3.1	EPSS0.136%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-58216MEDIUM	Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash An out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker c… CWE-125Jul 30, 2026	CVSS5.3v3.1	EPSS0.515%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-58222HIGH	Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes A security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes tha… CWE-90Jul 30, 2026	CVSS8.8v3.1	EPSS0.839%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-58218MEDIUM	Samba: dns signing dos via tkey name cache exhaustion A flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service. CWE-410Jul 30, 2026	CVSS5.3v3.1	EPSS1.1%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2026-16531MEDIUM	Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet An unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service. CWE-22Jul 30, 2026	CVSS5.3v3.1	EPSS0.357%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX