This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel 4.18.0-477.107.1.el8_8 via live patch modules. The fixes include limiting IPC next_id allocation to valid ID ranges (CVE-2026-52923), correcting a potential use-after-free in UDP tunnel segmentation (CVE-2026-74705), and bounding receive headroom in the tun network driver (CVE-2026-81000). These patches are delivered as kpatch live patch modules for Red Hat Enterprise Linux 8.8. The advisory rates the update as important and provides links for applying the updates.
A Red Hat security advisory addresses multiple vulnerabilities in Mozilla Thunderbird and Firefox components, including denial of service, privilege escalation, information disclosure, use-after-free, sandbox escapes, mitigation bypasses, and other security issues. These vulnerabilities affect various components such as XML parsing, application update, DOM, JavaScript engine, networking, graphics, and security policies. The advisory provides an update for Thunderbird on Red Hat Enterprise Linux 9.6 Extended Update Support to fix these issues.
Two denial of service vulnerabilities have been identified in the Qt software toolkit's XML handling components. These issues involve uncontrolled recursion in XML serialization (CVE-2026-11573) and a denial of service vulnerability in XML parsing (CVE-2026-19248). The vulnerabilities affect the qt5-qtbase and qt6-qtbase packages used in Red Hat Enterprise Linux 9.4 and related distributions. Red Hat has issued security updates to address these issues.
Red Hat issued a critical security advisory for webkit2gtk3 addressing multiple vulnerabilities in the ANGLE component used by Chromium-based browsers. These include arbitrary code execution, information disclosure, buffer overflow, use-after-free, improper input validation, and uninitialized resource issues. The update also fixes a regression affecting Eclipse IDE WebKit-based views on CentOS Stream 8.
Red Hat has released a security update for the java-11-openjdk packages with Extended Lifecycle Support for Red Hat Enterprise Linux versions 7, 8, and 9. This update addresses multiple security vulnerabilities in OpenJDK 11, including enhancements to SASL authentication, PKCS5 padding, TLS certificate handling, LDAP logins, HTTP client and server handling, XML processing, and various other components. The update is important and addresses a broad range of security issues to improve the security posture of the Java runtime environment and development kit.
Cluster Observability Operator 1.5 for Red Hat OpenShift provides observability capabilities for cloud-native applications. A security advisory has been issued addressing multiple vulnerabilities including CVE-2026-19534. The advisory references a set of fixes and instructs users to apply updates according to Red Hat's documentation. No specific affected versions are detailed in the advisory. There are no known exploits in the wild for this CVE at the time of publication.
A security update for the python36:3.6 module in Red Hat Enterprise Linux addresses a vulnerability in the pymongo MongoDB Python driver. The flaw, identified as CVE-2026-88029, involves query-operator injection that can lead to data disclosure and denial of service. Red Hat has rated this update as having an important security impact and has released patches for affected versions. The advisory references Red Hat Enterprise Linux 8.4 Extended Life Cycle Long Life and related packages. Users are advised to apply the update as detailed in the Red Hat advisory.
Red Hat has issued a security update for its Hardened Images RPM packages, specifically updating multiple GCC-related packages to version 16.2.1-3.2.hum1. This update addresses the vulnerability identified as CVE-2026-102010. The advisory does not provide detailed technical information about the nature of the vulnerability but classifies it with medium severity.
A vulnerability (CVE-2026-84445) in gRPC-Go affects Red Hat OpenShift Container Platform 5.0, specifically in xDS-managed gRPC servers. Malformed RPC requests missing required :authority or Host headers can cause an index-out-of-bounds panic, crashing the server process and causing denial of service. This issue can be exploited by unauthenticated remote clients in some deployments. The vulnerability does not affect standard gRPC servers without xDS routing. Red Hat has released updated ibu container images for OpenShift Container Platform 5.0 to address this issue.
A flaw in the ca-certificates package caused the Java KeyStore (JKS) integration to malfunction, where CA certificates removed from the system bundle were not removed from the JKS keystore. This update fixes the issue by properly syncing the keystore with the system CA certificates list.
Multiple security vulnerabilities have been identified in Flatpak, a system for sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary write access as root via extra-data extraction, a buffer overflow on 32-bit systems, and local privilege escalation via symlink traversal. Red Hat has issued an important security update addressing these issues in Flatpak for Red Hat Enterprise Linux 8.6. Users are advised to apply the update to mitigate these vulnerabilities.
Red Hat OpenStack Services on OpenShift (RHOSO) 18.0.22 containers include multiple security fixes addressing vulnerabilities in the Go programming language libraries used by the platform. These vulnerabilities include denial of service issues, man-in-the-middle attacks via untrusted intermediate certificates, and cross-site scripting via pathological input. The update mitigates these issues by releasing patched container images.
Multiple vulnerabilities in nginx as packaged for various Ubuntu LTS releases allow remote attackers to cause denial of service or potentially execute arbitrary code. These include improper handling of alias directives with rewrite rules, map directives using regex matching, HTTP/3 requests with proxy_request_buffering enabled, asynchronous file I/O with Server Side Includes, and SSL session ticket key management. The issues affect Ubuntu 14.04 LTS through 20.04 LTS and have been fixed in updated package versions.
Two security vulnerabilities have been identified in the rsyslog packages used in Red Hat Enterprise Linux 8.4. The first is a configuration-dependent issue in the optional imptcp input module that can allow an unauthenticated remote peer to crash the rsyslog daemon (CVE-2026-19654). The second is a denial of service vulnerability caused by a heap buffer overflow in the RainerScript replace() function (CVE-2026-78002). Red Hat has released security updates addressing these issues.