Red Hat Security Advisory: OpenShift Container Platform 4.18.55 bug fix and security update

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.55. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:66385 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * bind: BIND: Denial of Service via maliciously crafted DNSSEC-validated zone (CVE-2026-1519) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * dracut: dracut: Root code execution via DHCP options command injection (CVE-2026-6893) * bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) * sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data (CVE-2026-11822) * sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5 (CVE-2026-11824) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() (CVE-2026-15816) * sg3_utils: sg3_utils: arbitrary command execution via udev property injection in sg_inq --export (CVE-2026-16313) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) * libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack() (CVE-2026-14164) * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

• CWE-770Allocation of Resources Without Limits or Throttling (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #25

  The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

  How to prevent and test

  1. Requirements

     Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.

  2. Architecture and Design

     Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

  3. Architecture and Design

     Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)

  OWASP ASVS 4.0.3

  • V8.1.4 (opens in a new tab)
  • V13.4.1 (opens in a new tab)
  • V11.1.4 (opens in a new tab)

  Attack patterns

  • XML Ping of the Death (opens in a new tab)
  • Exponential Data Expansion (opens in a new tab)
  • Serialized Data Parameter Blowup (opens in a new tab)
  • Serialized Data with Nested Payloads (opens in a new tab)
  • Oversized Serialized Data Payloads (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-284Improper Access Control (opens in a new tab)

  Pillar weaknessCWE Top 25 (2025): #19OWASP Top 10 A01:2025: Broken Access Control (opens in a new tab)

  The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

  MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.

  How to prevent and test

  1. Architecture and Design · Operation

     Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.

  2. Architecture and Design · Separation of Privilege

     Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

  OWASP Cheat Sheets

  • Docker Security (opens in a new tab)
  • Third Party Javascript Management (opens in a new tab)
  • Virtual Patching (opens in a new tab)
  • Authorization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V1.4.4 (opens in a new tab)
  • V1.4.5 (opens in a new tab)
  • V1.10.1 (opens in a new tab)

  Attack patterns

  • Embedding Scripts within Scripts (opens in a new tab)
  • Modification of Windows Service Configuration (opens in a new tab)
  • Malicious Root Certificate (opens in a new tab)
  • Intent Spoof (opens in a new tab)
  • WebView Exposure (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-280Improper Handling of Insufficient Permissions or Privileges (opens in a new tab)

  Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)

  The product does not handle or incorrectly handles when it has insufficient privileges to access resources or functionality as specified by their permissions. This may cause it to follow unexpected code paths that may leave the product in an invalid state.

  How to prevent and test

  1. Architecture and Design · Separation of Privilege

     Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area.

  2. Implementation

     Always check to see if you have successfully accessed a resource or system functionality, and use proper error handling if it is unsuccessful. Do this even when you are operating in a highly privileged mode, because errors or environmental conditions might still cause a failure.

  OWASP Cheat Sheets

  • Logging (opens in a new tab)
  • Error Handling (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-345Insufficient Verification of Data Authenticity (opens in a new tab)

  Class weaknessOWASP Top 10 A08:2025: Software or Data Integrity Failures (opens in a new tab)

  The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

  MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • REST Security (opens in a new tab)
  • JSON Web Token for Java (opens in a new tab)
  • REST Assessment (opens in a new tab)
  • Cross-Site Request Forgery Prevention (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.2 (opens in a new tab)
  • V3.5.3 (opens in a new tab)
  • V13.2.6 (opens in a new tab)

  Attack patterns

  • JSON Hijacking (aka JavaScript Hijacking) (opens in a new tab)
  • Cache Poisoning (opens in a new tab)
  • DNS Cache Poisoning (opens in a new tab)
  • Spoofing of UDDI/ebXML Messages (opens in a new tab)
  • Application API Message Manipulation via Man-in-the-Middle (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-78Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #9OWASP Top 10 A05:2025: Injection (opens in a new tab)

  The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

  How to prevent and test

  1. Architecture and Design

     If at all possible, use library calls rather than external processes to recreate the desired functionality.

  2. Architecture and Design · Operation · Sandbox or Jail

     Run the code in a "jail" or similar sandbox environment that enforces strict boundaries between the process and the operating system. This may effectively restrict which files can be accessed in a particular directory or which commands can be executed by the software.

  3. Architecture and Design · Attack Surface Reduction

     For any data that will be used to generate a command to be executed, keep as much of that data out of external control as possible. For example, in web applications, this may require storing the data locally in the session's state instead of sending it out to the client in a hidden form field.

  OWASP Cheat Sheets

  • Injection Prevention (opens in a new tab)
  • Injection Prevention in Java (opens in a new tab)
  • OS Command Injection Defense (opens in a new tab)
  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)

  OWASP ASVS 4.0.3

  • V12.3.5 (opens in a new tab)
  • V5.3.8 (opens in a new tab)
  • V1.5.1 (opens in a new tab)

  Attack patterns

  • Command Line Execution through SQL Injection (opens in a new tab)
  • Command Delimiters (opens in a new tab)
  • Exploiting Multiple Input Interpretation Layers (opens in a new tab)
  • Argument Injection (opens in a new tab)
  • OS Command Injection (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-787Out-of-bounds Write (opens in a new tab)

  Base weaknessLikelihood of exploit: HighCWE Top 25 (2025): #5

  The product writes data past the end, or before the beginning, of the intended buffer.

  How to prevent and test

  1. Requirements · Language Selection

     Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  2. Architecture and Design · Libraries or Frameworks

     Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

  3. Operation · Build and Compilation · Environment Hardening

     Use automatic buffer overflow detection mechanisms that are offered by certain compilers or compiler extensions. Examples include: the Microsoft Visual Studio /GS flag, Fedora/Red Hat FORTIFY_SOURCE GCC flag, StackGuard, and ProPolice, which provide various mechanisms including canary-based detection and range/index…

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-131Incorrect Calculation of Buffer Size (opens in a new tab)

  Base weaknessLikelihood of exploit: High

  The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

  How to prevent and test

  1. Implementation

     When allocating a buffer for the purpose of transforming, converting, or encoding an input, allocate enough memory to handle the largest possible encoding. For example, in a routine that converts "&" characters to "&" for HTML entity encoding, the output buffer needs to be at least 5 times as large as the input…

  2. Implementation

     Understand the programming language's underlying representation and how it interacts with numeric calculation (CWE-681). Pay close attention to byte size discrepancies, precision, signed/unsigned distinctions, truncation, conversion and casting between types, "not-a-number" calculations, and how the language handles…

  3. Implementation · Input Validation

     Perform input validation on any numeric input by ensuring that it is within the expected range. Enforce that the input meets both the minimum and maximum requirements for the expected range.

  Attack patterns

  • Overflow Buffers (opens in a new tab)
  • Buffer Overflow via Parameter Expansion (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-825Expired Pointer Dereference (opens in a new tab)

  Base weakness

  The product dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid.

  How to prevent and test

  1. Architecture and Design

     Choose a language that provides automatic memory management.

  2. Implementation

     When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-606Unchecked Input for Loop Condition (opens in a new tab)

  Base weakness

  The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

  How to prevent and test

  1. Implementation

     Do not use user-controlled data for loop conditions.

  2. Implementation

     Perform input validation.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-824Access of Uninitialized Pointer (opens in a new tab)

  Base weakness

  The product accesses or uses a pointer that has not been initialized.

  How to prevent and test

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-178Improper Handling of Case Sensitivity (opens in a new tab)

  Base weakness

  The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.

  How to prevent and test

  1. Architecture and Design · Input Validation

     Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.

  2. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  3. Implementation · Input Validation

     Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174).

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1287Improper Validation of Specified Type of Input (opens in a new tab)

  Base weakness

  The product receives input that is expected to be of a certain type, but it does not validate or incorrectly validates that the input is actually of the expected type.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-20Improper Input Validation (opens in a new tab)

  Class weaknessLikelihood of exploit: HighCWE Top 25 (2025): #18OWASP Top 10 A05:2025: Injection (opens in a new tab)

  The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

  MITRE discourages mapping vulnerabilities to this broad entry; the root cause is usually a more specific weakness.

  How to prevent and test

  1. Architecture and Design · Attack Surface Reduction

     Consider using language-theoretic security (LangSec) techniques that characterize inputs using a formal language and build "recognizers" for that language. This effectively requires parsing to be a distinct layer that effectively enforces a boundary between raw input and internal data representations, instead of…

  2. Architecture and Design · Libraries or Frameworks

     Use an input validation framework such as Struts or the OWASP ESAPI Validation API. Note that using a framework does not automatically address all input validation problems; be mindful of weaknesses that could arise from misusing the framework itself (CWE-1173).

  3. Architecture and Design · Implementation · Attack Surface Reduction

     Understand all the potential areas where untrusted inputs can enter the product, including but not limited to: parameters or arguments, cookies, anything read from the network, environment variables, reverse DNS lookups, query results, request headers, URL components, e-mail, files, filenames, databases, and any…

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)
  • Injection Prevention (opens in a new tab)
  • SQL Injection Prevention (opens in a new tab)
  • Injection Prevention in Java (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  Attack patterns

  • Buffer Overflow via Environment Variables (opens in a new tab)
  • Server Side Include (SSI) Injection (opens in a new tab)
  • Cross Zone Scripting (opens in a new tab)
  • Command Line Execution through SQL Injection (opens in a new tab)
  • Object Relational Mapping Injection (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-125Out-of-bounds Read (opens in a new tab)

  Base weaknessCWE Top 25 (2025): #8

  The product reads data past the end, or before the beginning, of the intended buffer.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  2. Architecture and Design · Language Selection

     Use a language that provides appropriate memory abstractions.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  Attack patterns

  • Overread Buffers (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-191Integer Underflow (Wrap or Wraparound) (opens in a new tab)

  Base weakness

  The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

• CWE-415Double Free (opens in a new tab)

  Variant weaknessLikelihood of exploit: High

  The product calls free() twice on the same memory address.

  How to prevent and test

  1. Architecture and Design

     Choose a language that provides automatic memory management.

  2. Implementation

     Ensure that each allocation is freed only once. After freeing a chunk, set the pointer to NULL to ensure the pointer cannot be freed again. In complicated error conditions, be sure that clean-up routines respect the state of allocation properly.

  3. Implementation

     Use a static analysis tool to find double free instances.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-93Improper Neutralization of CRLF Sequences ('CRLF Injection') (opens in a new tab)

  Base weaknessOWASP Top 10 A05:2025: Injection (opens in a new tab)

  The product uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

  How to prevent and test

  1. Implementation

     Avoid using CRLF as a special sequence.

  2. Implementation

     Appropriately filter or quote CRLF sequences in user-controlled input.

  OWASP Cheat Sheets

  • Abuse Case (opens in a new tab)
  • Deserialization (opens in a new tab)
  • Injection Prevention (opens in a new tab)
  • SQL Injection Prevention (opens in a new tab)
  • Injection Prevention in Java (opens in a new tab)

  OWASP ASVS 4.0.3

  • V1.5.1 (opens in a new tab)

  Attack patterns

  • Command Delimiters (opens in a new tab)
  • Web Server Logs Tampering (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-1289Improper Validation of Unsafe Equivalence in Input (opens in a new tab)

  Base weakness

  The product receives an input value that is used as a resource identifier or other type of reference, but it does not validate or incorrectly validates that the input is equivalent to a potentially-unsafe value.

  How to prevent and test

  1. Implementation · Input Validation

     Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

  OWASP Cheat Sheets

  • XML Security (opens in a new tab)
  • Mass Assignment (opens in a new tab)

  OWASP ASVS 4.0.3

  • V13.3.1 (opens in a new tab)
  • V5.1.4 (opens in a new tab)
  • V5.1.3 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• CWE-394Unexpected Status Code or Return Value (opens in a new tab)

  Base weaknessOWASP Top 10 A10:2025: Mishandling of Exceptional Conditions (opens in a new tab)

  The product does not properly check when a function or operation returns a value that is legitimate for the function, but is not expected by the product.

  How to prevent and test

  OWASP Cheat Sheets

  • Logging (opens in a new tab)
  • Error Handling (opens in a new tab)

  OWASP ASVS 4.0.3

  • V11.1.7 (opens in a new tab)

  From MITRE CWE, MITRE CAPEC and OWASP (Top 10, OpenCRE).

• access.redhat.com/errata/RHSA-2026:7915 (opens in a new tab)
• access.redhat.com/security/updates/classification/ (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2451305 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_7915.json (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:11371 (opens in a new tab)
• issues.redhat.com/browse/RHEL-65081 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11371.json (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:40021 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2459853 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2479492 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2481486 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_40021.json (opens in a new tab)
• kb.isc.org/docs/cve-2026-1519 (opens in a new tab)
• downloads.isc.org/isc/bind9/9.18.47 (opens in a new tab)
• downloads.isc.org/isc/bind9/9.20.21 (opens in a new tab)
• downloads.isc.org/isc/bind9/9.21.20 (opens in a new tab)
• lists.debian.org/debian-lts-announce/2026/04/msg00008.html (opens in a new tab)
• access.redhat.com/security/cve/CVE-2026-1519 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1519.json (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:11372 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:34048 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:36610 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:43226 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:29863 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:24851 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:8312 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:8352 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:8155 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:16064 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:16060 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:25171 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:15890 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:25083 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:29110 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:25214 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:24500 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:24934 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:8075 (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:6935 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_34048.json (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2451094 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_43226.json (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2447317 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2447318 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2447319 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2479762 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_29863.json (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_11372.json (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25083.json (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:60019 (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_15890.json (opens in a new tab)
• security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_16064.json (opens in a new tab)
• suse.com/support/security/rating/ (opens in a new tab)
• ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_20550-1.json (opens in a new tab)
• bugzilla.suse.com/1259202 (opens in a new tab)
• bugzilla.suse.com/1260567 (opens in a new tab)
• bugzilla.suse.com/1260568 (opens in a new tab)
• bugzilla.suse.com/1260569 (opens in a new tab)
• bugzilla.suse.com/1260805 (opens in a new tab)
• suse.com/security/cve/CVE-2026-1519/ (opens in a new tab)
• suse.com/security/cve/CVE-2026-3104/ (opens in a new tab)
• suse.com/security/cve/CVE-2026-3119/ (opens in a new tab)
• suse.com/security/cve/CVE-2026-3591/ (opens in a new tab)
• access.redhat.com/errata/RHSA-2026:65851 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2445763 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2450505 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2459963 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2467015 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2479767 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2479771 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2480756 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2487258 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2487269 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2493411 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2500889 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2502845 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2503721 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2504166 (opens in a new tab)
• bugzilla.redhat.com/show_bug.cgi?id=2504560 (opens in a new tab)
• ftp.suse.com/pub/projects/security/csaf/rhsa-2026_24934.json (opens in a new tab)
• lists.suse.com/pipermail/suse-liberty-linux-updates/2026-July/007073.html (opens in a new tab)

• CVE-2026-1519: CWE-606 Unchecked Input for Loop Condition in ISC BIND 9HighVulnerability03/25/2026
• Red Hat Security Advisory: Red Hat Enterprise Linux AI 3.3.7 security updateHighVulnerability10/05/2026
• Red Hat Security Advisory: bind9.16 security, bug fix, and enhancement updateHighVulnerability10/12/2026
• Red Hat Security Advisory: samba security updateHighVulnerability06/03/2026
• Red Hat Security Advisory: dracut security, bug fix, and enhancement updateHighVulnerability10/08/2026