Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.1.16 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.15, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.1.16 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* mchange-commons-java: mchange-commons-java: Arbitrary code execution via
JNDI dereferencing of crafted objects [eap-7.1.z] (CVE-2026-27727)
* com.mchange/c3p0: c3p0: Arbitrary Code Execution via deserialization of
crafted objects [eap-7.1.z] (CVE-2026-27830)
* netty-codec: Netty: Denial of Service via excessive memory allocation in
LZ4FrameDecoder [eap-7.1.z] (CVE-2026-42583)
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [eap-7.1.z] (CVE-2026-42578)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling
of conflicting HTTP/1.0 headers [eap-7.1.z] (CVE-2026-42581)
* netty-codec-http: Netty: Request smuggling via malformed
Transfer-Encoding parsing [eap-7.1.z] (CVE-2026-42585)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data
confusion [eap-7.1.z] (CVE-2026-42584)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for a vulnerability identified as CVE-2026-102278 affecting the Red Hat Hardened Images RPMs, specifically multiple nodejs26 packages. The update addresses a CWE-770 weakness and updates nodejs26 and related components to version 26.10.0-0.2.hum1 across various architectures. No detailed technical information or exploitation methods are provided. Users are advised to apply the update through official Red Hat channels.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing vulnerabilities in the hdf5 packages. The update includes multiple hdf5-related RPMs for aarch64 and x86_64 architectures. The advisory addresses three CVEs: CVE-2026-19026, CVE-2026-19027, and CVE-2026-19028. No explicit patch version ranges are provided, but updated package versions are listed. The severity is assessed as medium.
The gawk packages contain the GNU version of awk, a text processing utility. Awk interprets a special-purpose programming language to do quick and easy text pattern matching and reformatting jobs.
Security Fix(es):
* gawk: gawk: Memory corruption via integer overflow (CVE-2026-40468)
* gawk: gawk: Denial of Service due to Use After Free vulnerability in io.c (CVE-2026-40467)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Advanced Cluster Management for Kubernetes has a security advisory addressing multiple vulnerabilities including CVE-2026-41178. This update includes new features, bug fixes, and updated container images to improve security and functionality. The advisory highlights fixes for issues such as image override regressions and other security concerns. The update is rated as important by Red Hat Product Security and affects specific versions of the product. A patch is available to remediate these vulnerabilities.
CVE-2026-88841 is a medium severity vulnerability affecting multiple specific versions of BusyBox distributed in various Ubuntu releases. The exact nature and technical details of the vulnerability are unknown based on the provided data. There is no CVSS score or detailed description available, and no known exploits in the wild have been reported. The affected versions are explicitly listed and correspond to various Ubuntu package versions of BusyBox.
Red Hat has released a security advisory for a bug fix and enhancement update to the Red Hat Hardened Images RPMs, specifically addressing the chunkah package version 0.7.0-1.1.hum1. This update addresses the vulnerability identified as CVE-2026-84782. The advisory does not provide detailed technical information about the vulnerability but classifies it as high severity. The update is available for affected versions including chunkah 0.7.0-1.1.hum1 on aarch64 and x86_64 architectures.
Red Hat JBoss Core Services is a set of supplementary software for Red Hat JBoss middleware products. This software, such as Apache HTTP Server, is common to multiple JBoss middleware products and packaged under Red Hat JBoss Core Services, to allow for faster distribution of updates and for a more consistent update experience.
This release of Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 6 serves as a replacement for Red Hat JBoss Core Services Apache HTTP Server 2.4.62 Service Pack 5, and includes bug fixes and enhancements, which are documented in the Release Notes linked to in the References section.
Security Fix(es):
* jbcs-httpd24-httpd: HTTP response splitting forwarding malicious status line (CVE-2026-33523)
* mod_auth_digest.so: timing attack allows a bypass of digest authentication (CVE-2026-33006)
A Red Hat Security Bulletin which addresses further details about this flaw is available in the References section.
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This is a kernel live patch module which can be loaded by the kpatch command line utility to modify the code of a running kernel. This patch module is targeted for kernel-5.14.0-687.10.1.el9_8.
Security Fix(es):
* kernel: RDMA/rxe: Fix double free in rxe_srq_from_init (CVE-2026-45852)
* kernel: RDMA/mana: Validate rx_hash_key_len (CVE-2026-46145)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
GStreamer is a streaming media framework based on graphs of filters which operate on media data. The gstreamer1-plugins-good packages contain a collection of well-supported plug-ins of good quality and under the LGPL license.
Security Fix(es):
* gstreamer: GStreamer: Remote Code Execution via MRF file parsing heap-based buffer overflow (CVE-2026-18296)
* gstreamer: GStreamer: Remote code execution via heap-based buffer overflow in PNG file parsing (CVE-2026-18298)
* gstreamer: GStreamer: Remote Code Execution via Use-After-Free in rtpsbcdepay (CVE-2026-18299)
* GStreamer: GStreamer: Remote code execution via MRF file parsing (CVE-2026-18295)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The IBM Semeru Runtime Certified Edition 21 runtime environment.
Security Fix(es):
* OpenJDK: Improve Resource Resolving (2026-08 Security Update) (CVE-2026-60589)
* OpenJDK: Enhance HTTP Connections (2026-08 Security Update) (CVE-2026-61308)
* OpenJDK: Enhance TLS server (2026-08 Security Update) (CVE-2026-70907)
* openj9: Eclipse OpenJ9: Denial of Service via crafted .class file (CVE-2026-16440)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.15/html-single/release_notes/index#acm-release-notes
Red Hat Advanced Cluster Management for Kubernetes provides the
capabilities to address common challenges that administrators and site
reliability engineers face as they work across a range of public and
private cloud environments. Clusters and applications are all visible and
managed from a single console—with security policy built in.
This advisory contains the container images for Red Hat Advanced Cluster
Management for Kubernetes, which add new features and enhancements, bug
fixes, and updated container images. See the following
Release Notes documentation, which will be updated shortly for this
release, for additional details about this release:
https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.14/html-single/release_notes/index#acm-release-notes
This update includes the following RPMs:
opentelemetry-collector:
* opentelemetry-collector-0.157.0-0.1.hum1 (aarch64, x86_64)
* opentelemetry-collector-0.157.0-0.1.hum1.src (src)
Security Fix(es):
opentelemetry-collector:
* CVE-2026-56852
Red Hat issued a security advisory for Multicluster Global Hub 1.8.2 addressing a high severity vulnerability identified as CVE-2026-17106. The vulnerability affects the component that manages multiple hub clusters from a single hub cluster. The advisory also includes updates to Red Hat Hardened Images RPMs, specifically podman packages. A fix is available in updated packages including podman-6.0.2-2.2.hum1. No CVSS score is provided. The advisory provides instructions for applying the update.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CVE-2026-46076)
* kernel: ext4: fix e4b bitmap inconsistency reports (CVE-2026-45942)
* kernel: KVM: arm64: Reassign nested_mmus array behind mmu_lock (CVE-2026-46317)
* kernel: fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (CVE-2026-53341)
* kernel: perf/core: Detach event groups during remove_on_exec (CVE-2026-64556)
* kernel: vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CVE-2026-68299)
* kernel: crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CVE-2026-80522)
* kernel: perf: Reject exited events as group leaders (CVE-2026-74753)
* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
* kernel: KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (CVE-2026-89775)
Bug Fix(es) and Enhancement(s):
* KVM: s390: Limit adapter indicator access to mapped page [rhel-10.2.z] (JIRA:RHEL-188661)
* crypto: xxhash64 should not be fips approved [rhel-10.2.z] (JIRA:RHEL-254943)
* kata-tdx TD vCPU stuck at reset vector (EIP=0xFFF0) on Intel Xeon 6 (Granite Rapids / Sierra Forest) ? guest never executes. (10.2.z) (JIRA:RHEL-260402)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Access Control Lists (ACLs) are used to define fine-grained discretionary access rights for files and directories. The acl packages contain the getfacl and setfacl utilities needed for manipulating access control lists.
Security Fix(es):
* acl: Symlink traversal privilege escalation via libacl functions (CVE-2026-54369)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.