A vulnerability in Apache Thrift's handling of highly compressed data allows remote attackers to cause a denial of service (DoS) by sending specially crafted compressed data. This leads to resource exhaustion and system unavailability in Red Hat AI Base Images 3.3.3 (TPU) used in Red Hat OpenShift AI. The issue is categorized as improper handling of highly compressed data (data amplification). No fix has been released yet.
Valkey, an advanced key-value store used in Red Hat Enterprise Linux 10.0 Extended Update Support, contains multiple remote code execution vulnerabilities due to use-after-free issues in stream deserialization and TLS pending-data processing. These vulnerabilities allow an attacker to execute arbitrary code remotely. Red Hat has issued security updates addressing these flaws in valkey version 8.0.11-1.el10_0. The advisory also references a related Redis vulnerability. The update is rated as important by Red Hat Product Security.
A security vulnerability in the GStreamer streaming media framework's gstreamer1-plugins-base package allows arbitrary code execution via a buffer overflow in OGG file parsing. This issue is identified as CVE-2026-18297 and affects Red Hat Enterprise Linux 8.8 variants. Red Hat has issued an important security update to address this flaw.
A security update for Red Hat Hardened Images addresses a vulnerability in Python 3.10's tarfile module (CVE-2026-82049). The flaw allows crafted tar archives containing hard links to symbolic links to bypass directory confinement, potentially leading to unauthorized modification of file metadata or disclosure of sensitive files outside the intended extraction directory. Exploitation requires unpacking untrusted archives, so environments not processing such archives or operating in isolated containers are less exposed. The update includes multiple python3.10 RPMs with the fix.
Multiple critical security vulnerabilities have been identified in PostgreSQL and related components, including SQL injection, arbitrary code execution, privilege escalation, buffer overflows, and information disclosure. These flaws affect various PostgreSQL functions and extensions such as pg_createsubscriber, pg_dump, psql COPY FROM STDIN, logical decoding plugins, and PostGIS. The vulnerabilities allow attackers to execute arbitrary SQL or code, escalate privileges, or cause denial of service. Red Hat has issued a security advisory with updates for Red Hat Enterprise Linux 9 to address these issues.
A denial of service (DoS) vulnerability exists in gRPC-Go version 3.0 related to xDS servers crashing when both the ':authority' and 'Host' headers are missing in requests. This flaw can cause the server to crash, disrupting service availability.
A security vulnerability (CVE-2026-11332) in ansible-core's ansible-galaxy role install allows argument injection leading to arbitrary code execution. This issue affects Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Red Hat has issued an important security advisory and released updated packages to address this flaw.
A security update for Rust addresses a denial of service vulnerability in the libgit2 library caused by a heap out-of-bounds read triggered by a malicious Git server (CVE-2026-53587). This vulnerability affects Red Hat Enterprise Linux 9 and related variants. The issue is rated as having an important security impact by Red Hat. The update includes patched packages to remediate this flaw.
A security vulnerability in PostGIS, an extension that adds geographic object support to PostgreSQL, allows memory disclosure and denial of service via a malformed FlatGeobuf buffer. This issue is tracked as CVE-2026-73515 and affects Red Hat Enterprise Linux 10 packages of postgresql18-postgis. Red Hat has issued a security advisory with an update to address this vulnerability.