A denial of service vulnerability (CVE-2026-56860) exists in the golang net/url package used by the host metering service in Red Hat Enterprise Linux 7 Extended Lifecycle Support. The issue is caused by quadratic complexity in path resolution when processing relative paths containing parent directory segments ('..'), which can lead to service disruption. Red Hat has released a security update to address this vulnerability.
The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.
Security Fix(es):
* kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
* kernel: netfilter: nat: use kfree_rcu to release ops (CVE-2026-53000)
* kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
* kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
* kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
Bug Fix(es) and Enhancement(s):
* WARNING: CPU: 5 PID: 20420 at net/core/stream.c:206 sk_stream_kill_queues+0xd2/0xe0 (JIRA:RHEL-256439)
* Backport 3e684903a857 - kpatch transition stalls on KVM vCPU threads running guest DPDK PMD [9.2.z] (JIRA:RHEL-258954)
* Backport request 747f7a2901174 [rhel-9.2.z] (JIRA:RHEL-259005)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
An update is now available for the Red Hat build of Cryostat 4 on RHEL 9.
Security Fix(es):
* Apache HttpComponents Core: Denial of Service via excessive HTTP headers (CVE-2026-54399)
* Apache HttpComponents Core: Denial of Service via oversized HTTP/2 HPACK header blocks (CVE-2026-54428)
* Eclipse Vert.x: Information disclosure via improper handling of HTTP 30x redirects (CVE-2026-15075)
* Eclipse Vert.x Web Client: Information disclosure via improper cookie domain validation (CVE-2026-15076)
* SeaweedFS: Information disclosure via S3 API gateway path traversal (CVE-2026-55874)
* SeaweedFS: Unauthorized data deletion via path traversal in S3 gateway (CVE-2026-58372)
* protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877)
* Quarkus REST: Unbounded multipart MIME part-header accumulation allows remote OOM denial of service (CVE-2026-16308)
* Netty: Denial of Service via SPDY header decompression amplification (CVE-2026-55833)
* Netty: Denial of Service via SPDY SETTINGS frame processing (CVE-2026-55831)
* Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message (CVE-2026-55851)
* Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec (CVE-2026-56745)
* Netty: Security control bypass allows unauthorized requests via null origin header (CVE-2026-56746)
* Netty: Denial of Service via HTTP/2 DATA frame memory leak (CVE-2026-56819)
* Netty: Memory exhaustion in netty-codec-http (decompression bomb) (CVE-2026-59899)
* Apache Thrift: Denial of Service via integer overflow or wraparound (CVE-2026-55969)
* Apache Thrift: Denial of Service via improper handling of highly compressed data (CVE-2026-48586)
* Apache Thrift: Denial of Service due to uncontrolled resource allocation (CVE-2026-45112)
* brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation (CVE-2026-69152)
* ip-address: Inconsistent IP address parsing leads to Server-Side Request Forgery (SSRF) and trust-boundary bypass (CVE-2026-69192)
* jackson-core: Denial of Service via incomplete fix in async JSON parser (CVE-2026-68494)
* DOMPurify: Cross-site scripting vulnerability allows code execution (CVE-2026-49978)
* OpenTelemetry-Go: Denial of Service via oversized baggage headers (CVE-2026-41178)
* Go net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* Go encoding/xml: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
* Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* Go crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* js-yaml: Denial of Service via crafted YAML documents (CVE-2026-59869)
* golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions (CVE-2026-56854)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat JBoss Enterprise Application Platform 8.1.8 addresses multiple security vulnerabilities affecting various components including Jackson libraries, Netty, Bouncy Castle, Undertow, Artemis server, Apache CXF, and WildFly Elytron. The update replaces version 8.1.7 and mitigates issues such as denial of service, privilege escalation, authentication bypass, information disclosure, and remote code execution. These vulnerabilities impact Red Hat JBoss EAP 8.1 for RHEL 8 and have been rated with an important security impact by Red Hat Product Security.
Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages used by Red Hat and Ubuntu. These include issues in memory management and SCTP protocol handling that could lead to privilege escalation or system compromise. The vulnerabilities affect various kernel versions and architectures. Official patches are available to address these flaws.
Red Hat has released OpenShift Source To Image version 1.6.4 to address multiple security vulnerabilities affecting prior versions. The advisory covers several CVEs with a high severity rating but does not provide detailed technical information or exploitation methods. Users of versions before 1.6.4 are advised to upgrade to mitigate these issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: rtnetlink: add missing netlink_ns_capable() check for peer netns (CVE-2026-31692)
* kernel: fanotify: fix false positive on permission events (CVE-2026-46150)
* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
* kernel: tipc: fix double-free in tipc_buf_append() (CVE-2026-52993)
* kernel: zram: fix use-after-free in zram_bvec_write_partial() (CVE-2026-53185)
* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
* kernel: scsi: target: iscsi: Bound iscsi_encode_text_output() appends to rsp_buf (CVE-2026-63887)
* kernel: Kernel: Remote out-of-bounds write in RDMA/siw (CVE-2026-64268)
* kernel: sctp: don't free the ASCONF's own transport in DEL-IP processing (CVE-2026-64564)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
PostgreSQL is an advanced object-relational database management system (DBMS).
Security Fix(es):
* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)
* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)
* postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)
* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)
* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)
* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparound (CVE-2026-15742)
* postgresql: PostgreSQL: Arbitrary code execution via type confusion in cursor lifecycle (CVE-2026-16239)
* postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation (CVE-2026-14669)
* postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists (CVE-2026-19385)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A use-after-free vulnerability (CVE-2026-6653) exists in the libxml2 library, which can cause denial of service or potentially allow arbitrary code execution when parsing specially crafted XML input. This issue affects multiple specific versions of libxml2 used in Red Hat Enterprise Linux and Ubuntu distributions. Official patches are available from both Red Hat and Ubuntu to address this vulnerability. The vulnerability is rated as moderate severity by Red Hat Product Security. No known exploits are reported in the wild at this time.
CVE-2026-102422 is a vulnerability in the node-shell-quote package where the quote() function emits a comment token that can comment out the rest of a shell line. This vulnerability is associated with CWE-78 and has a CVSS score of 8.1, indicating high severity. The affected versions are 1.6.1+20160617-git72fb5a8ce29b-1 and 1.10.0-1. The Red Hat advisory references this CVE but does not explicitly state patch availability or remediation details for node-shell-quote. The advisory mainly discusses updates to prometheus3.13 packages. No known exploits are reported in the wild.
Red Hat OpenShift AI 3.5.1 includes important security updates addressing multiple vulnerabilities identified by several CVEs including CVE-2026-19913. The advisory rates the severity of these issues as high but does not provide specific technical details or fixes. Updated images are available, and users are advised to upgrade their clusters following Red Hat's guidance to apply the errata. There are no known exploits in the wild at this time.
Red Hat has issued an important security advisory for Red Hat AMQ Clients 2026.Q3 addressing multiple vulnerabilities in components such as Apache Qpid Proton-J, Jackson-databind, Netty, Spring Boot, and others. The vulnerabilities include denial of service, authentication bypass, arbitrary code execution, information disclosure, and HTTP request smuggling. These flaws affect message sending and receiving capabilities with AMQ Broker 7. The update also includes numerous bug fixes and enhancements. Users are advised to apply this update after ensuring all previous errata are applied.
Multiple security vulnerabilities have been identified in Red Hat AI Inference Server versions 3.4.0 through 3.4.5 (rocm). These vulnerabilities are collectively addressed in Red Hat Security Advisory RHSA-2026:69469. No specific fixes or patches are currently provided in the advisory. The vulnerabilities affect a range of security weaknesses as indicated by numerous CWE identifiers. The severity of these vulnerabilities is assessed as high.
Multiple security vulnerabilities were identified in OpenSSH affecting both client and server components. These include an sftp client flaw allowing attackers to control the location of downloaded files (CVE-2026-59995), a security bypass in sshd due to improper handling of forwarding and tunneling options (CVE-2026-59999), and a use-after-free vulnerability in the ssh client leading to information disclosure and potential data corruption (CVE-2026-73282). Red Hat and Ubuntu have released patches addressing these issues. The vulnerabilities impact various OpenSSH versions distributed with Red Hat Enterprise Linux 8 and Ubuntu LTS releases. The issues are rated with high severity.
Red Hat Data Grid 8.6.3 includes multiple security fixes addressing vulnerabilities such as denial of service, information disclosure, cross-site scripting, and security bypass primarily in Netty components and related libraries. These issues affect the in-memory distributed NoSQL datastore and could impact availability, confidentiality, and integrity. The update replaces version 8.6.2 and resolves a range of CVEs including CVE-2026-44891 (Netty STOMP decoder DoS) and CVE-2026-49978 (DOMPurify XSS).