CVE-2026-108094 is a use-after-free vulnerability in the mutter component of Red Hat Enterprise Linux 10, specifically in the Wayland color-management ICC image-description path. A local attacker running a malicious Wayland client can trigger this flaw by destroying a resource while an asynchronous ICC file read is ongoing. This leads to the compositor writing into freed memory and freeing a pointer derived from it, potentially crashing the GNOME session or enabling arbitrary code execution within the compositor process. The vulnerability has a high severity score of 7.8 CVSS 3.1.
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements.
Breaking changes:
* None
Deprecations:
* None
Technology Preview features:
* None
Enhancements:
* None
Bug fixes:
* Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821.
* The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822.
* The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928.
* TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435.
* Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238.
Known issues:
* None
Red Hat Quay versions prior to 3.9.26 contain multiple security vulnerabilities affecting the logging subsystem for Red Hat OpenShift and related components. These issues are addressed in the Red Hat Quay 3.9.26 update. The advisory emphasizes the importance of applying this update to remediate the vulnerabilities.
Multiple security vulnerabilities have been identified in the goose component of Red Hat Enterprise Linux 10. These include arbitrary command execution via malicious Git configuration, token impersonation due to missing OAuth resource field validation, denial of service through unauthenticated session table leak, and denial of service via crafted Certificate Revocation List. A security update is available that addresses these issues by updating goose to version 1.45.0-1.el10_2. The update is applicable to Red Hat Enterprise Linux 10 on multiple architectures including x86_64, s390x, ppc64le, and aarch64.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940)
* python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A heap-based buffer overflow vulnerability exists in the libxml2 library's xmlXPtrEval function due to xpointer length saturation (CVE-2026-86142). This vulnerability affects Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued a security advisory with an update to address this moderate severity issue. The advisory provides updated libxml2 packages to fix the flaw.
Red Hat Ansible Automation Platform 2.2 includes updated Ansible plug-ins for the Red Hat Developer Hub that enhance user experience and automation capabilities. A security advisory has been issued covering multiple CVEs including CVE-2026-47686. The advisory marks the severity as critical but does not provide detailed vulnerability descriptions, affected versions, or patches. No fixes or patches are currently available according to the vendor advisory.
CVE-2026-109082 is an authentication bypass vulnerability in the Client-Initiated Backchannel Authentication (CIBA) implementation within the keycloak-services component of Red Hat Build of Keycloak. The flaw allows public clients to bypass authorization checks and trick users into approving login requests, potentially granting attackers full access to user accounts without requiring a client secret. The vulnerability has a medium severity with a CVSS score of 6.8.
CVE-2026-107203 is an incorrect authorization vulnerability in the Foreman package used by Red Hat Satellite 6. The flaw affects network interface handling where API checks only verify host permission but do not enforce search limits. This allows a low-privileged user with some host view permissions to access interface records of hosts they should not see within a shared domain or subnet. Additionally, if the user has edit permissions on some hosts, they can modify interfaces of unauthorized hosts, with changes being saved.
CVE-2026-107193 is a medium severity vulnerability in Red Hat Satellite 6's foreman package involving authorization bypass through user-controlled keys in permission filters. A low-privileged user allowed to delete filters for one role can delete filters belonging to other unlocked roles, causing those roles to lose access granted by the deleted filters.
The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP.
Security Fix(es):
* curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924)
* curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to qt6 packages. The advisory addresses vulnerabilities identified by CVE-2026-95509 and CVE-2026-16762. The update includes bug fixes and enhancements for qt6-filesystem and related macros across multiple architectures. No specific affected versions are detailed in the advisory. The update is available and should be applied as per Red Hat's instructions.
The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly.
Security Fix(es):
* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039)
* bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946)
* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321)
* bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622)
* bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721)
* bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204)
* bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified in the xorg-x11-server-Xwayland component used in Red Hat Enterprise Linux 8. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and heap-based buffer overflow issues. The vulnerabilities affect various versions of the xorg-x11-server-Xwayland package. Red Hat has released security updates addressing these issues.
Red Hat has issued a security advisory for a bug fix and enhancement update to Red Hat Hardened Images RPMs, specifically updating curl and related libcurl packages. The advisory addresses CVE-2026-92392, classified with high severity. The update includes curl version 8.23.0-0.1.hum1 and corresponding libcurl packages for multiple architectures. No specific details about the vulnerability or its exploitation are provided in the advisory.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to libpng packages. The update addresses multiple security issues identified by several CVEs. The advisory provides updated RPM versions for various architectures. No explicit details on the vulnerabilities or their exploitation are provided. The update is available and should be applied to affected systems.
CVE-2026-108119 is a medium severity vulnerability in the busybox tar applet used in Red Hat Hardened Images. The flaw involves improper validation of symlink and hardlink targets during deferred link creation, allowing crafted tar archives to create or replace files outside the intended extraction directory. This can lead to privilege escalation or arbitrary code execution if extraction occurs with elevated privileges. Red Hat has issued an update to busybox (version 1.37.0-9.4.hum1) to address this issue.
A NULL pointer dereference vulnerability exists in the GIMP XCF loader on Red Hat Enterprise Linux 10. This occurs when the loader processes image-simulation-intent and image-simulation-bpc parasites without verifying the presence of parasite data. Opening a specially crafted XCF file with a zero-size simulation parasite can cause GIMP to crash.
A use-after-free vulnerability (CVE-2026-74705) exists in the Linux kernel's UDP tunnel segmentation code, affecting various Red Hat kernel versions. This flaw could potentially be exploited to cause system instability or other impacts. Red Hat has released patches addressing this issue. Users should apply the official kernel updates and reboot to ensure remediation.