A security update for the Rust programming language addresses a denial of service vulnerability in the libgit2 library. The flaw (CVE-2026-53587) involves a heap out-of-bounds read triggered by a malicious Git server. This vulnerability could cause the Rust compiler or related tools to crash or behave unexpectedly when interacting with crafted Git repositories. Red Hat has released an update for Rust in Red Hat Enterprise Linux 9.4 to fix this issue.
A security vulnerability in the libtiff library used for manipulating TIFF files allows arbitrary code execution via the process_command_opts() function. This issue is identified as CVE-2026-52490 and affects Red Hat Enterprise Linux 8 and related products. Red Hat has issued a security advisory and released updated libtiff packages to address this vulnerability.
CVE-2026-93450 is a vulnerability in go-openapi/swag jsonutils before version 0.27.1 involving uncontrolled recursion in ordered JSON marshal and unmarshal operations. The flaw relates to improper handling of recursive data structures during JSON processing.
A denial of service vulnerability exists in the perl-Net-DNS package due to unbounded recursion triggered by misplaced TSIG records. This flaw can cause the DNS resolver modules to consume excessive resources, potentially leading to service disruption. The issue is tracked as CVE-2026-81928 and affects Red Hat Enterprise Linux 9 and related variants. Red Hat has issued a security update to address this vulnerability.
A security vulnerability (CVE-2026-18297) affecting the gstreamer1-plugins-base package in Red Hat Enterprise Linux 10.0 Extended Update Support allows arbitrary code execution via a buffer overflow in OGG file parsing. Red Hat has issued an important security advisory and released updated packages to address this issue.
Valkey, an advanced key-value store used in Red Hat Enterprise Linux 10.0 Extended Update Support, contains multiple remote code execution vulnerabilities due to use-after-free issues in stream deserialization and TLS pending-data processing. These vulnerabilities allow an attacker to execute arbitrary code remotely. Red Hat has issued security updates addressing these flaws in valkey version 8.0.11-1.el10_0. The advisory also references a related Redis vulnerability. The update is rated as important by Red Hat Product Security.
A security update for Red Hat Hardened Images addresses a vulnerability in Python 3.10's tarfile module (CVE-2026-82049). The flaw allows crafted tar archives containing hard links to symbolic links to bypass directory confinement, potentially leading to unauthorized modification of file metadata or disclosure of sensitive files outside the intended extraction directory. Exploitation requires unpacking untrusted archives, so environments not processing such archives or operating in isolated containers are less exposed. The update includes multiple python3.10 RPMs with the fix.
Multiple critical security vulnerabilities have been identified in PostgreSQL and related components, including SQL injection, arbitrary code execution, privilege escalation, buffer overflows, and information disclosure. These flaws affect various PostgreSQL functions and extensions such as pg_createsubscriber, pg_dump, psql COPY FROM STDIN, logical decoding plugins, and PostGIS. The vulnerabilities allow attackers to execute arbitrary SQL or code, escalate privileges, or cause denial of service. Red Hat has issued a security advisory with updates for Red Hat Enterprise Linux 9 to address these issues.
A denial of service (DoS) vulnerability exists in gRPC-Go version 3.0 related to xDS servers crashing when both the ':authority' and 'Host' headers are missing in requests. This flaw can cause the server to crash, disrupting service availability.
A security vulnerability in PostGIS, an extension that adds geographic object support to PostgreSQL, allows memory disclosure and denial of service via a malformed FlatGeobuf buffer. This issue is tracked as CVE-2026-73515 and affects Red Hat Enterprise Linux 10 packages of postgresql18-postgis. Red Hat has issued a security advisory with an update to address this vulnerability.
A security vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), allows remote code execution or client crash via a malicious TS Gateway. This issue is identified as CVE-2026-55193 and affects Red Hat Enterprise Linux 9 and related variants. Red Hat has issued an important security update to address this vulnerability.