A denial of service vulnerability (CVE-2026-56860) exists in the golang net/url package due to quadratic complexity in path resolution. This affects the host metering service in Red Hat Enterprise Linux, including Extended Lifecycle Support versions. The vulnerability can cause service disruption by exhausting resources during URL path processing. Red Hat has issued security advisories and updates to address this issue.
Multiple high-severity security vulnerabilities have been identified in PostgreSQL, affecting various components such as tsvector and tsquery functions, psql COPY FROM STDIN, logical decoding plugins, and others. These vulnerabilities include arbitrary code execution, privilege escalation, and information disclosure. Red Hat has issued security advisories and updates addressing these issues for affected Red Hat Enterprise Linux versions, including Red Hat Update Infrastructure 5.3. The vulnerabilities impact critical database operations and require applying the provided updates.
CVE-2026-56859 is a high severity vulnerability affecting Red Hat Ansible Automation Platform 2.2 and related components, specifically the Automation Portal Operator used for managing Ansible Automation Portal deployments on OpenShift. The vulnerability is documented by Red Hat but no specific fix or patch has been explicitly stated in the advisory. No known exploits are reported in the wild at this time.
This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides new features, security improvements, and bug fixes.
Breaking changes:
* High availability defaults for TempoStack deployment sizes: Before this update, only the ingester component was scaled for high availability while all other components defaulted to a single replica, leaving the overall ingest and query paths vulnerable to single points of failure. With this update, when you set a non-demo deployment size (1x.pico, 1x.extra-small, 1x.small, or 1x.medium) in the spec.size field of the TempoStack custom resource, the Operator defaults each component to at least 2 replicas, and scales throughput-bound components at larger sizes. Watch your resource consumption, as running more replicas per component increases the total CPU and memory consumed by the deployment. Explicit per-component replicas values always take precedence. For more information, see https://redhat.atlassian.net/browse/TRACING-6169.
Deprecations:
* Jaeger Query is deprecated: The Jaeger Query component in the Tempo Operator is deprecated and will be removed in a future release. The Tempo Operator emits a warning when the Jaeger Query feature is enabled. To visualize traces, use the distributed tracing UI plugin as the recommended replacement for the Jaeger UI. For more information, see https://redhat.atlassian.net/browse/TRACING-6509.
Technology Preview features:
* None
Enhancements:
* High availability for TempoStack deployments: You can use the spec.replicationZones field in the TempoStack custom resource to define zone-aware replication. By using this feature, you can deploy TempoStack instances with higher resilience by spreading replicas across topology zones and ensuring minimum pod availability during disruptions. For more information, see https://redhat.atlassian.net/browse/TRACING-6168.
* Service name and namespace auto-complete with query RBAC enabled: When you enable query Role-Based Access Control (RBAC) in a multi-tenant TempoStack deployment, the Tempo gateway supports auto-complete for non-sensitive attributes such as service name and namespace. Before this update, all tag value API endpoints were blocked when query RBAC was enabled, which prevented the Service Name drop-down filter in the distributed tracing console plugin from displaying results. With this update, the gateway allows the search tags API for non-sensitive attributes while still protecting sensitive span data. As a result, the Service Name filter and other non-sensitive attribute drop-down list items work correctly in multi-tenant RBAC mode. For more information, see https://redhat.atlassian.net/browse/TRACING-6485.
Bug fixes:
* TempoStack and TempoMonolithic status conditions accurately reflect pod readiness: Before this update, the status field of the TempoStack or TempoMonolithic custom resource might show Ready=false even when all pods were ready, or vice versa. With this update, the Operator watches Deployment and StatefulSet status changes, and the status conditions accurately reflect actual pod readiness. Deleted pods are removed from the pod status map. As a result, the status field reliably indicates the current state of the deployment. For more information, see https://redhat.atlassian.net/browse/TRACING-6453.
* Gateway redirect URL respects the custom ingress hostname: Before this update, setting a custom hostname with the spec.template.gateway.ingress.host field in the TempoStack custom resource did not update the OpenShift OAuth redirect URL, so authentication redirects pointed to the wrong URL. With this update, the Operator uses the custom hostname when generating the redirect URL, and gateway authentication works correctly with custom ingress hostnames. For more information, see https://redhat.atlassian.net/browse/TRACING-6435.
* Gateway starts on clusters that use external OIDC authentication: Before this update, on clusters using external OpenID Connect (OIDC) authentication instead of the built-in OpenShift OAuth server, the Tempo gateway container failed to start because it could not auto-discover the OpenShift OAuth endpoints. With this update, the gateway handles external authentication and starts correctly on such clusters. For more information, see https://redhat.atlassian.net/browse/TRACING-6646.
Known issues:
* None
Multiple security vulnerabilities and bugs have been fixed in the Linux kernel packages distributed by Red Hat. These include issues such as use-after-free, double-free, out-of-bounds reads, permission checks, and memory corruption across various kernel subsystems. The update addresses these flaws to improve system security and stability. A patch is available and users are advised to apply the update and reboot to ensure protection. The kernel update requires recompilation of third-party kernel modules due to ABI changes.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CVE-2026-31566)
* kernel: netfilter: nf_queue: hold bridge skb->dev while queued (CVE-2026-52912)
* kernel: Linux kernel: PPPoE memory corruption via stale pointer (CVE-2026-68121)
* kernel: Linux kernel IPVS: Denial of Service due to stale memory references (CVE-2026-80714)
* kernel: nvme-tcp: reject a read that transferred too few bytes (CVE-2026-89480)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: drm/amdgpu: Fix use-after-free race in VM acquire (CVE-2026-43370)
* kernel: mac802154: llsec: add skb_cow_data() before in-place crypto (CVE-2026-63831)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
* kernel: ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CVE-2026-72261)
* kernel: xfrm: ah6: validate routing header segments_left (CVE-2026-80844)
* kernel: net: tun: bound receive headroom (CVE-2026-81000)
* kernel: scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CVE-2026-89846)
Bug Fix(es) and Enhancement(s):
* sctp: prevent peer transport count overflow [rhel-8.10.z] (JIRA:RHEL-216297)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language.
For details about this release, refer to the release notes listed in the References section.
Red Hat Ansible Automation Platform 2.5 for RHEL 9 contains multiple critical security vulnerabilities affecting its automation-controller and related components. These include remote code execution, privilege escalation, information disclosure, denial of service, command injection, cross-tenant data exposure, and other serious flaws. The vulnerabilities impact features such as GitPython integration, workflow job templates, credential handling, Jinja template rendering, and mesh certificate issuance. Red Hat has issued a security advisory with updates to address these issues.
VolSync v0.16, a Kubernetes operator used for asynchronous replication of persistent volumes, has security vulnerabilities identified by CVE-2026-46603 and CVE-2026-84445 affecting Red Hat Advanced Cluster Management for Kubernetes versions 0.32.14-r1 and earlier. Red Hat has released updated container images and patches to address these issues. The update is rated as having an important security impact. No active exploits are currently known in the wild.
Red Hat has released a security advisory addressing multiple vulnerabilities in Red Hat Hardened Images RPMs, specifically updating nodejs24 and nodejs26 packages. The advisory includes bug fixes and enhancements for CVE-2026-18540, CVE-2026-19534, CVE-2026-84961, and CVE-2026-85024. Updated packages cover architectures including aarch64 and x86_64. No known exploits have been reported in the wild. The advisory provides updated package versions to mitigate these vulnerabilities.
CVE-2026-5241 is a high-severity vulnerability in Red Hat AI Inference Server 3.4.5 (spyre) affecting the mlx-lm product, specifically in the huggingface/transformers LightGlue model loading path. It allows arbitrary code execution during model initialization. The vulnerability has a CVSS score of 8.0 and requires user interaction with high attack complexity. No known exploits in the wild have been reported. The Red Hat advisory lists this CVE among multiple others affecting the product but does not provide specific patch or fix details.
A cross-site scripting (XSS) vulnerability (CVE-2026-75838) was found in the DOMPurify library used by Red Hat Hardened Images RPMs, specifically in the grafana13.2 package. The issue occurs during in-place sanitization when element-removal hooks fail to neutralize detached subtrees, allowing malicious scripts to execute via crafted HTML with event handlers. This vulnerability requires a non-default DOMPurify configuration with an element-removal hook and user interaction with malicious content. Red Hat has released updated RPMs including grafana13.2-13.2.1-0.6.hum1 to fix this issue. Default DOMPurify configurations are not affected.
A security advisory from Red Hat addresses a medium severity vulnerability identified as CVE-2026-84783 affecting Red Hat Hardened Images RPMs, specifically the openssl3 packages. The update includes new versions of openssl3-devel, openssl3-devel-engine, openssl3-libs, and the openssl3 source package. The advisory provides updated RPMs for aarch64 and x86_64 architectures. No explicit fix details or exploit reports are mentioned.
Red Hat has released a critical security advisory for the Red Hat Hardened Images RPMs, specifically updating the openshell, openshell-gateway, and python3-openshell packages to version 0.0.116-0.2.hum1 on aarch64 and x86_64 architectures. The advisory addresses multiple CVEs including CVE-2026-65083, CVE-2026-65093, and CVE-2026-93599, but does not provide detailed vulnerability descriptions or CVSS scores. The update is intended as a bug fix and enhancement to improve security.
A vulnerability in the GStreamer gst-plugins-good package affects the rtph264depay and rtph265depay RTP depayloader elements. These elements do not enforce a maximum size limit on the reassembly buffer during fragmented RTP packet processing, allowing a remote unauthenticated attacker to cause unbounded memory growth and denial of service. The vulnerability is exploitable when processing RTP from untrusted sources without authentication. Red Hat has released a security update to address this issue.
Red Hat has issued a security advisory for Red Hat Enterprise Linux 9.6 Extended Update Support addressing four kernel vulnerabilities affecting netfilter nf_tables, blk-mq cached requests, slab zeroing behavior, and SCTP transport handling. The update also includes bug fixes and enhancements for Intel drivers. Systems must be rebooted after applying the update to activate the fixes. The advisory rates the security impact as Important. No CVSS score is provided and no known exploits are reported in the wild.