A security vulnerability (CVE-2026-16313) exists in the sg3_utils package used in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The flaw allows arbitrary command execution via udev property injection in the sg_inq --export utility. Red Hat has issued an important security update to address this issue along with other bug fixes and enhancements.
A security vulnerability in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP), allows remote code execution or client crash via a malicious TS Gateway. This issue is identified as CVE-2026-55193 and affects Red Hat Enterprise Linux 9 and related variants. Red Hat has issued an important security update to address this vulnerability.
A security vulnerability in ansible-core's ansible-galaxy role install allows argument injection that can lead to arbitrary code execution. This issue affects Red Hat Enterprise Linux 8 versions of ansible-core. Red Hat has issued an important security update to address this flaw.
CVE-2026-13622 is a vulnerability in Kubevirt's virt-handler component (version 3.0) where the migration proxy follows symbolic links, potentially allowing a container to escape to the host system.
A security vulnerability (CVE-2026-73515) in PostGIS, an extension that adds geographic object support to PostgreSQL, allows memory disclosure and denial of service via a malformed FlatGeobuf buffer. This issue affects Red Hat Enterprise Linux 10 with postgresql16-postgis. Red Hat has issued a security update to address this vulnerability.
Red Hat has released version 3.11.0 of its build of OpenTelemetry, which includes new features, security improvements, and bug fixes. This update removes the add_metric_suffixes field from the Prometheus Exporter configuration and introduces several technology preview features such as the OBI eBPF Receiver, Redaction Processor, Headers Setter Extension, and Kubernetes Leader Elector Extension. It also adds high availability support for Operator webhooks and fixes issues related to Instrumentation CR status updates and RBAC permissions for PersistentVolume resources.
Red Hat OpenShift Container Platform 4.20.37 includes multiple security fixes addressing vulnerabilities in components such as librenswan, sg3_utils, libarchive, and libreswan. These vulnerabilities include denial of service via malformed fragmentation and RSA-SHA1 authentication payloads, arbitrary command execution via udev property injection, double-free memory corruption, and assertion failures causing daemon crashes. Users of OpenShift Container Platform 4.20 are advised to upgrade to the updated packages and container images to mitigate these issues.
CVE-2026-56855 is a vulnerability in golang.org/x/crypto/ssh that can cause a denial of service (DoS) due to a deadlocked established channel. It affects versions 3.0 and 4.0 of the Microsoft product using this library. No CVSS score or detailed impact information is provided.
CVE-2026-78662 is a vulnerability in golang.org/x/crypto/ssh version 3.0 that can lead to a denial of service (DoS) condition caused by a deadlocked undecided channel. The issue relates to resource exhaustion or blocking behavior in the SSH library implementation.
CVE-2026-84304 is a vulnerability in gRPC-Go version 3.0 involving heap memory exhaustion caused by HTTP/2 DATA frame fragmentation. This can lead to out-of-memory (OOM) conditions. The vulnerability is categorized under CWE-400, indicating a resource exhaustion issue. There is no CVSS score or detailed impact description available. No patch or remediation information is provided.
A security advisory from Red Hat addresses vulnerabilities in the Composer package manager included in Red Hat Hardened Images RPMs. The key issue involves a flaw in how Composer handles Perforce source URLs, which could allow an attacker to execute arbitrary commands if certain conditions are met. Exploitation requires the Perforce p4 client to be installed and processing of untrusted package metadata or lock files. The advisory rates the severity as important due to the potential for arbitrary code execution within the user or CI context running Composer. The update includes Composer version 2.10.3-1.hum1 and its source RPM. No direct fix versions are explicitly stated for Red Hat products, but the advisory references the updated Composer release that addresses the issue.
A security vulnerability in the Generic Graphics Library (GEGL) used by GIMP allows remote code execution via an integer overflow in HDR file parsing. This issue is tracked as CVE-2026-18300 and affects Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued an important security update to address this vulnerability.
A security advisory from Red Hat addresses multiple vulnerabilities in the Red Hat Hardened Images RPMs, specifically in the Valkey component. One notable flaw (CVE-2026-85522) involves an out-of-bounds read in the Slot Migration component's createSlotImportJob function, which can be triggered remotely by manipulating the job_name argument. This vulnerability can cause the Valkey daemon to crash, resulting in a denial of service. The attack surface is limited by the unprivileged service account and SELinux policies, preventing further compromise. Red Hat has released updated RPM packages to fix these issues.
A use-after-free vulnerability exists in the Linux kernel's IPv6 networking code due to a stale pointer in fib6_rule_suppress. This flaw affects Red Hat Enterprise Linux 8.6 kernel packages. Red Hat has released a security update to address this issue and recommends applying the update and rebooting the system. The vulnerability is rated as having an important security impact.