Threat database

CVE-2026-40898 is a denial-of-service vulnerability in quic-go, an implementation of the QUIC protocol in Go, used by Red Hat OpenShift Virtualization v4.21 images. A remote attacker can send specially crafted HTTP/3 trailer fields to cause excessive memory allocation, potentially crashing the affected server or client or exhausting system resources. No mitigation is currently available that meets Red Hat's criteria for ease of use and stability. Red Hat has released updated OpenShift Virtualization v4.21 images that address various bugs and enhancements, but no specific fix for this vulnerability is indicated in the advisory.

A double-free vulnerability (CVE-2026-14164) exists in the libarchive library's RAR5 decompression logic due to a dangling filtered_buf pointer in the init_unpack() function. Libarchive is widely used for handling various archive formats, including GNU tar and ISO 9660 images, and is integrated into utilities like bsdtar and python-libarchive bindings. Red Hat has issued a security advisory rating this vulnerability as moderate impact and has released updates for Red Hat Enterprise Linux 9 to address the issue.

Multiple denial of service and memory corruption vulnerabilities have been identified in the python-pillow library, affecting image and font file processing. These include denial of service via crafted BDF font files, GD 2.x image files, PCF font data, and excessive memory allocation when processing font files. Additionally, there is a native heap out-of-bounds write and memory disclosure or denial of service via crafted McIdas AREA images. Red Hat has issued a security update for python-pillow in Red Hat Enterprise Linux 8.4 to address these issues.

CVE-2026-17527 is a vulnerability related to the Virt-cdi-operator component of Microsoft software, specifically version 3.0. The vulnerability involves an aggregated cluster role granting create permissions, potentially related to the containerized-data-importer (CDI) in the Kubernetes environment. No CVSS score or detailed impact information is provided.

A security update for the fence-agents packages in Red Hat Enterprise Linux addresses a denial of service vulnerability (CVE-2026-59939) in the httplib2 library. The flaw involves unbounded decompression of HTTP response bodies, which can cause a denial of service. The fence-agents scripts manage remote power control for cluster nodes, allowing failed or unreachable nodes to be forcibly restarted or removed. Red Hat has released patches for affected versions, particularly in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions.

A security vulnerability (CVE-2026-16313) in the sg3_utils package allows arbitrary command execution via udev property injection in the sg_inq --export command. This issue affects Red Hat Enterprise Linux 9 and related distributions. Red Hat has released an update to address this vulnerability along with other bug fixes and enhancements.

Red Hat Ansible Automation Platform 2.5 Container Release Update addresses a security issue identified as CVE-2026-11332. The platform provides an enterprise framework for IT automation, enabling teams to share and manage automation content. This update is important to maintain security and stability of the platform. No specific details about the vulnerability's nature or impact are provided in the advisory. No known exploits are reported in the wild. Users are advised to apply this update after ensuring all previous errata are applied.

Multiple denial of service vulnerabilities have been identified in the python-pillow library, specifically involving crafted font and image files. These include issues with BDF font files, GD 2.x image files, PCF font data, and excessive memory allocation during font file processing. Red Hat has issued an important security advisory providing updates to address these vulnerabilities in Red Hat Enterprise Linux 8.8 variants.