A heap use-after-free vulnerability exists in the libblkid library of util-linux during nested partition probing. This flaw occurs because certain partition probers cache raw pointers that become stale after array reallocations, leading to potential memory corruption. An attacker can exploit this by presenting a crafted block device image, triggering the flaw automatically via udev/udisks without user interaction. The impact includes limited information disclosure or denial of service. Red Hat has released patches to address this issue in their util-linux packages.
A security vulnerability (CVE-2026-9256) affecting the ngx_http_rewrite_module of nginx in Red Hat Enterprise Linux 10 allows for potential code execution and denial of service. Red Hat has issued an important security advisory with an update to address this issue. The vulnerability impacts multiple architectures and product variants of Red Hat Enterprise Linux 10 and related CodeReady Linux Builder packages. The advisory references a fix available in updated nginx packages.
A heap-use-after-free vulnerability exists in libxslt's handling of attribute metadata during processing of result tree fragments. This flaw can cause memory corruption and application crashes due to improper cleanup of ID attributes. It affects Red Hat Hardened Images RPMs including libxml2 packages. No patch or mitigation meeting Red Hat's criteria is currently available.
A vulnerability in MariaDB's mariadb-dump utility allows remote attackers to execute arbitrary code due to improper validation of user-supplied paths. Exploitation requires user interaction with the mariadb-dump utility. Successful exploitation could lead to arbitrary code execution with the privileges of the current user. No patch or mitigation meeting Red Hat's criteria is currently available.
A high-severity heap buffer overflow vulnerability (CVE-2026-4177) exists in the perl-YAML-Syck module versions through 1.36. This module provides a Perl interface to the libsyck data serialization library, enabling conversion between Perl data structures and YAML strings. The vulnerability affects the YAML emitter component and could lead to memory corruption.
A security advisory from Red Hat addresses vulnerabilities in Red Hat Hardened Images RPMs, specifically in curl and libcurl packages. One notable issue (CVE-2026-3783) involves the potential leakage of OAuth2 bearer tokens during HTTP(S) redirects when curl follows redirects and .netrc files contain entries for the redirected host. This could lead to unauthorized disclosure of sensitive tokens. The advisory provides updated RPM packages to fix these issues.
A moderate severity vulnerability (CVE-2026-27456) exists in util-linux's mount program related to a Time-of-Check-Time-of-Use (TOCTOU) race condition when mounting loop devices with user and loop options in /etc/fstab. This flaw allows a local unprivileged user to gain full read access to root-owned files or block devices containing valid filesystems by exploiting a brief window where the mount program checks file paths with user permissions but opens them with root privileges. There is no memory corruption or code execution involved. The vulnerability is only exploitable if an /etc/fstab entry uses user,loop options and the source path is writable by the attacker. The Red Hat Hardened Images RPMs update advisory references this and other CVEs but does not list specific fixes for this issue. Mitigation involves removing the 'user' option from loop mounts or ensuring source paths are root-owned and not writable by unprivileged users.
An out-of-bounds read vulnerability exists in the curl project used by Red Hat products. The flaw occurs in the path comparison logic, causing curl to read outside a heap buffer boundary. This can lead to a crash or potentially allow a clear-text site to override the contents of a secure cookie, depending on adjacent memory contents. No effective mitigation is currently available that meets Red Hat's criteria for ease of use, deployment, and stability.
A server-side include (SSI) handling flaw exists in the Apache HTTP Server when SSI is enabled and mod_cgid passes the shell-escaped query string to #exec cmd="..." directives. This may allow an attacker to inject commands executed by the server. Red Hat has not provided a mitigation that meets their criteria for ease of use, deployment, or stability. No fix is currently available for affected Red Hat Hardened Images.
A stack overflow vulnerability in the xfig component of the transfig utility allows possible code execution via local input manipulation. Transfig is used to translate FIG or PIC figures into LaTeX graphics languages. This security issue has been rated as moderate severity by Red Hat and affects Red Hat CodeReady Linux Builder 9.4 Extended Update Support. An update fixing this vulnerability is available.