Threat database

CVE-2026-48586 is a vulnerability in Apache Thrift affecting Red Hat Hardened Images RPMs. It involves improper handling of highly compressed data, allowing remote attackers to cause a denial of service (DoS) by sending specially crafted compressed data that leads to resource exhaustion. Red Hat has released updated RPM packages to address this issue.

An infinite loop vulnerability exists in golang.org/x/text when processing invalid input, potentially causing the affected software to become unresponsive. This issue affects versions 3.0 and 4.0 of the product. No CVSS score or detailed impact information is provided, and there is no indication of active exploitation or available patches.

Multiple security vulnerabilities have been identified in the GNU C Library (glibc) packages used by Red Hat Enterprise Linux 9. These include an information disclosure or denial of service issue via the ungetwc function with specific wide character encodings (CVE-2026-5928), an out-of-bounds write via TSIG record processing (CVE-2026-5435), and an application crash or uninitialized memory read via crafted DNS response (CVE-2026-6238). These vulnerabilities affect core system libraries essential for Linux system functionality.

Multiple security vulnerabilities were discovered affecting AMD processors and the Linux kernel subsystems. These include speculative execution data leakage on AMD processors, privilege escalation on AMD Zen 2 processors due to shared resource isolation flaws, and entropy issues in AMD Zen 5 processors affecting the RDSEED instruction. Additionally, numerous flaws across a wide range of Linux kernel subsystems and drivers were identified that could allow attackers to compromise the system. Fixes for these issues have been released in updated Linux kernel versions.

A denial-of-service vulnerability exists in quic-go, a Go implementation of the QUIC protocol, affecting Red Hat Hardened Images using this component. An attacker can send specially crafted HTTP/3 trailer fields to cause excessive memory allocation, potentially crashing the server or client or exhausting system resources. No mitigation is currently available that meets Red Hat's criteria for ease of use, deployment, and stability. A fixed update for the caddy RPM (version 2.11.4-0.2.hum1) is included in the Red Hat Hardened Images update.

The Tempo Operator's gateway component in Red Hat OpenShift Tempo 3.10.1 failed to consistently apply namespace-scoped redaction on some query API responses when query RBAC was enabled. This allowed authenticated users to read span attributes belonging to other tenants' namespaces. The issue has been fixed in the 3.10.1 release, which correctly redacts all Tempo API responses according to namespace access rights.

This is a security update for Ruby provided by the SUSE Product Security Team, functionally equivalent to Red Hat's advisory RHSA-2026:37238. The update addresses a high-severity vulnerability identified as CVE-2026-41316. No specific affected versions or detailed technical information are provided in the available data.

A security update for the fence-agents packages in Red Hat Enterprise Linux addresses an authentication bypass vulnerability in the python-pyjwt library (CVE-2026-48526). The fence-agents scripts manage remote power control for cluster devices, allowing failed or unreachable nodes to be forcibly restarted and removed from the cluster. The vulnerability involves forged JSON Web Tokens allowing authentication bypass. Red Hat has released an update for Red Hat Enterprise Linux 9.2 and related variants to fix this issue.

CVE-2026-13218 is a vulnerability in Kubevirt version 3.0 where symlink following in the writetocachedfile function allows a process in virt-launcher to overwrite files on the host system.

CVE-2026-13318 is a server-side request forgery (SSRF) vulnerability in the kubevirt virt-api port-forward functionality. It arises from unvalidated IP addresses reported by the guest agent, potentially allowing an attacker to induce the server to make unauthorized requests.

CVE-2026-13322 is a vulnerability in Kubevirt's virt-handler component on RHEL9 where an unbounded virtio-serial readline can cause an out-of-memory (OOM) denial of service condition. This flaw could allow an attacker to exhaust system memory, leading to service disruption.

SQLite contains a vulnerability in the FTS5 full-text search extension where certain memory operations are incorrectly handled. This flaw can be exploited by an attacker to cause SQLite to crash, leading to a denial of service, or potentially to execute arbitrary code. Multiple Ubuntu package versions are affected, and fixed versions have been released.

A heap buffer under-read vulnerability (CVE-2025-5278) exists in the GNU Coreutils sort utility as packaged in Red Hat Enterprise Linux 10. This flaw involves improper handling of key specifications during sorting operations. Red Hat has issued a security update to address this moderate severity issue. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 10, including Extended Update Support and Extended Life Cycle versions.

A denial of service vulnerability exists in the python-pyasn1 library used by Red Hat OpenStack Platform 17.1. The flaw is due to memory exhaustion caused by processing a malformed RELATIVE-OID. This issue is addressed in a security update provided by Red Hat.

This security update for libyang addresses two vulnerabilities: a use-after-free in the function lyd_parser_set_data_flags when processing crafted YANG XML documents with specific metadata attributes, and an integer overflow in lyb_read_string() that leads to a heap buffer overflow when parsing maliciously crafted LYB binary blobs.