Threat database

Red Hat has issued a security advisory for dogtag-pki, an enterprise Public Key Infrastructure (PKI) management system. The update addresses multiple vulnerabilities including a decompression bomb denial-of-service (DoS) in RESTEasy's IIOImageProvider, a Cross-Origin Resource Sharing (CORS) filter misconfiguration allowing reflection of arbitrary origins with credentials, and a DoS via regular expression backtracking in Jackson-core. These vulnerabilities affect components of the IdM PKI system and are rated with an important security impact by Red Hat. The advisory applies to Red Hat Enterprise Linux 10.0 Extended Update Support and related architectures. Users are advised to apply the update as detailed in the Red Hat advisory.

Multiple security vulnerabilities have been identified and fixed in the Berkeley Internet Name Domain (BIND) software used in Red Hat Enterprise Linux 8.6. These include memory exhaustion, denial of service, DNSSEC validation bypass, cache poisoning, unexpected server exits, and arbitrary code execution via GSS-TSIG UDP message replay. The update also includes bug fixes and enhancements such as a new root trust anchor key for DNSSEC. Red Hat has issued an important security advisory with patches to address these issues.

A denial of service vulnerability exists in the Go encoding/asn1 package used by LVMS 4.20. An attacker can supply a specially crafted, deeply nested ASN.1 structure that causes excessive recursion during unmarshalling, leading to stack exhaustion and service unavailability. Red Hat has released an update for LVMS 4.20 in OpenShift Container Platform that includes a golang bump addressing this and related vulnerabilities. Users are advised to upgrade to the latest version to remediate these issues.

A vulnerability (CVE-2026-116591) in the klauspost compress library's Zstandard (zstd) decompression implementation allows a remote attacker to cause a denial of service (DoS) by submitting a specially crafted compressed stream. The flaw is due to an integer handling error that leads to an out-of-bounds read and an unhandled panic, crashing the application. This affects applications decompressing untrusted zstd input using the vulnerable library. The impact is isolated by container boundaries and non-root execution. Mitigations include rejecting or filtering untrusted zstd payloads or restricting decompression to trusted clients. A fixed version of the library (klauspost/compress 1.20.2+) is available and included in updated Red Hat Hardened Images RPMs.

This advisory addresses multiple security vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 9. The issues include use-after-free bugs, validation errors, race conditions, and memory leaks across various kernel subsystems such as net/smc, sctp, s390/zcrypt, sunrpc, fs/resctrl, openvswitch, and others. These vulnerabilities have been rated as important by Red Hat and require a kernel update and system reboot to mitigate.

A security vulnerability (CVE-2026-103111) in the pcre2 library used by Red Hat Enterprise Linux 7 Extended Lifecycle Support allows an out-of-bounds write via a crafted regular expression. This flaw could potentially lead to memory corruption. Red Hat has issued an important security update to address this issue.

Multiple security issues were addressed in the tpm2.0-tools-5.8-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes improve the security posture of the TPM 2.0 tools but specific vulnerability details are not provided.

Multiple security issues were addressed in the scribus-1.6.7-1.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities present in the Scribus software distributed with this version. No specific details about the nature of the vulnerabilities or affected versions beyond this package are provided.

Multiple security issues were addressed in the rsync-3.5.2-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes improve the security posture of the rsync utility in this distribution.

Multiple security issues were addressed in the libQt6Core5Compat6-6.12.0-2.1 package included in the GA media of openSUSE Tumbleweed. The vulnerabilities were fixed in this package version, improving the security posture of affected systems.

Multiple security issues have been addressed in the libQt6HttpServer6-6.12.0-2.1 package included in the GA media of openSUSE Tumbleweed. The specific vulnerabilities fixed are not detailed in the provided information.

The python313-tornado6-6.6-1.1 package on the GA media of openSUSE Tumbleweed addresses multiple security issues. These vulnerabilities have been fixed in this package version. No specific details about the nature of the vulnerabilities or their impact are provided.

Multiple security issues were addressed in the python313-autobahn-26.11.1-1.1 package on the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities affecting this package version.

Multiple security issues were addressed in the proftpd-1.3.9e-1.1 package included in the GA media of openSUSE Tumbleweed. The update fixes vulnerabilities present in this version of ProFTPD. No specific details about the nature of the vulnerabilities or their impact are provided.

Multiple security issues were fixed in the bson-devel-2.5.8-1.1 package on the GA media of openSUSE Tumbleweed. These fixes address vulnerabilities present in prior versions of the package.

Multiple security issues were addressed in the java-25-openj9-25.0.5.0-1.1 package for the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities affecting the SUSE product. No specific details about the individual vulnerabilities or their impacts are provided.

Multiple security issues have been addressed in the java-21-openj9-21.0.13.0-1.1 package for openSUSE Tumbleweed. These fixes resolve vulnerabilities identified by various CVE identifiers. No specific details about the nature or impact of these vulnerabilities are provided.

Multiple security issues have been addressed in the libinih-devel-63-1.1 package included in the GA media of openSUSE Tumbleweed. These fixes resolve vulnerabilities present in earlier versions of the package. No specific details about the nature of the vulnerabilities or their impact are provided.