CVE-2026-106064 is a heap-based buffer overflow vulnerability in the GIF export plug-in of GIMP on Red Hat Enterprise Linux 10. The issue arises when exporting images with very large dimensions, causing a 32-bit integer overflow during pixel buffer size calculation. This leads to allocation of a smaller buffer than needed, while the actual image data written exceeds this buffer, resulting in memory corruption. The vulnerability has a CVSS score of 6.3, indicating medium severity, with potential impact on integrity and availability. No explicit affected versions or patch information is provided in the available data.
Red Hat JBoss Web Server 7.0.2 includes multiple security fixes addressing vulnerabilities in the Apache Tomcat components it bundles. These vulnerabilities include local information disclosure, improper input validation, access control bypasses, denial of service, authentication bypass, and session management issues. The update replaces version 7.0.1 and addresses several CVEs related to these security flaws.
A low severity argument injection vulnerability (CWE-88) was identified in the CUPS package, affecting multiple versions. Red Hat has issued an advisory with updated RPM packages to address this issue. The vulnerability has a CVSS score of 2.5, indicating low impact, primarily affecting confidentiality with limited attack vector and requiring low privileges. No known exploits are reported in the wild.
Red Hat JBoss Web Server 7.0.2 includes a security update addressing multiple vulnerabilities, including acceptance of PKCS#12 files with PBMAC1 using short HMAC keys, which weakens cryptographic protections. This issue affects Red Hat JBoss Web Server 7.0.2 and related components. The advisory rates the update as important but does not provide a CVSS score or detailed technical impact for this specific vulnerability. No known exploits are reported in the wild. The update replaces version 7.0.1 and includes fixes for several Apache Tomcat vulnerabilities and OpenSSL issues.
A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation. This issue causes the application to crash, resulting in a Denial of Service (DoS).
A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.
CVE-2026-107151 is a vulnerability in Red Hat Satellite 6 involving missing authentication in the smart_proxy_dynflow package's remote-execution task updates. Specifically, progress and completion callbacks accept reports without requiring a one-time token, allowing an attacker who knows a running job's identifier to send fake job outputs and mark jobs as successful or failed. This affects configurations where remote execution is set to pull or pull-mqtt mode.
A use-after-free vulnerability in the Linux kernel's vsock/vmci subsystem was fixed by Red Hat. The flaw occurs during a peer reset connection in the handshake phase, causing improper socket cleanup and leading to a use-after-free condition detected by KASAN. This vulnerability has high severity and affects multiple Linux kernel versions prior to specific 5.15.x updates. Official kernel updates have been released to address this issue. Users should apply these updates and reboot to mitigate the vulnerability.
A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: smb: client: fix OOB reads parsing symlink error response (CVE-2026-31613)
* kernel: RDMA/rxe: Fix race condition in QP timer handlers (CVE-2026-45910)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: RDMA/rxe: Reject non-8-byte ATOMIC_WRITE payloads (CVE-2026-46114)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
* kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
* kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
* kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130)
* kernel: ipv6: fix use-after-free in ip6_finish_output2() (CVE-2026-80792)
* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
CVE-2026-103870 is a medium severity path traversal vulnerability in Red Hat Satellite 6's pulp-rpm component. It occurs when publishing a distribution tree using addon and variant IDs from .treeinfo as directory names. A user with sync or upload permissions can cause the publish task to create directories outside the intended work area and write repository metadata and packages there. This does not replace existing files or directories, does not disclose data, and does not disrupt service.
CVE-2026-103869 is a medium severity vulnerability in Red Hat Ansible Automation Platform 2 related to pulp-ansible's bearer-token refresh mechanism. The flaw causes an access token to be stored in a module-level variable and reused across different token downloads within the same worker. This allows a user who can sync an Ansible remote using token refresh and control the remote server to receive and reuse an access token intended for a different remote. The vulnerability does not alter stored content or disrupt the service.
CVE-2026-103868 is a vulnerability in Red Hat Ansible Automation Platform 2's pulp-container component where credentials from one remote registry can be exposed and reused in another session. This occurs because basic and bearer credentials are reused improperly within the same worker. The flaw allows a user who can sync a container remote and control the remote server to obtain credentials intended for a different remote. The vulnerability does not alter stored content or disrupt service availability.
Red Hat has issued a security advisory for a high severity use-after-free vulnerability (CVE-2026-19445) affecting python3.15 packages in Red Hat Hardened Images RPMs for aarch64 and x86_64 architectures. The advisory does not provide detailed technical information or explicit patch versions but references updated python3.15 packages. The vulnerability is related to CWE-416. No known exploits are reported in the wild, and no explicit fix version is stated in the advisory.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663)
* kernel: ALSA: 6fire: fix use-after-free on disconnect (CVE-2026-31581)
* kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
* kernel: RDMA/rxe: Validate pad and ICRC before payload_size() in rxe_rcv (CVE-2026-46043)
* kernel: RDMA/rxe: Reject unknown opcodes before ICRC processing (CVE-2026-46133)
* kernel: sctp: purge outqueue on stale COOKIE-ECHO handling (CVE-2026-52924)
* kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239)
* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921)
* kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919)
* kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917)
* kernel: RDMA/rxe: Fix a use-after-free problem in rxe_mmap (CVE-2026-64582)
* kernel: net: qrtr: restrict socket creation to the initial network namespace (CVE-2026-68294)
* kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426)
* kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CVE-2026-74556)
* kernel: netfilter: flowtable: publish GC-visible tuple last (CVE-2026-74746)
* kernel: RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp (CVE-2026-80864)
* kernel: RDMA/rxe: Fix OOB in free_rd_atomic_resources() (CVE-2026-80863)
Bug Fix(es) and Enhancement(s):
* xfs corruption from [xfs_trans_cancel] during inode allocation (JIRA:RHEL-257185)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A buffer overflow vulnerability (CVE-2025-68347) was identified and fixed in the Linux kernel ALSA firewire-motu driver affecting the hwdep_read() function for DSP events. The flaw allowed writing more bytes to a user buffer than requested if the buffer was smaller than the event header size. Red Hat released a security update for Red Hat Enterprise Linux 8.6 and related variants to address this issue. The update clamps the copy size to the user-requested length, preventing the overflow. The fix is part of a broader kernel security update addressing multiple vulnerabilities. A system reboot is required after applying the update for the fix to take effect.
CVE-2026-106061 is a medium severity vulnerability in GIMP's X cursor (XMC) thumbnail loader on Red Hat Enterprise Linux 10. The flaw involves an integer overflow during pixel buffer size calculation, leading to an out-of-bounds read on the heap. This can cause GIMP to crash or corrupt process memory. The vulnerability requires local access with user interaction and does not impact confidentiality or integrity but affects availability.
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: Local MITM of X11 forwarding via abstract UNIX socket pre-binding in Red Hat Enterprise Linux OpenSSH client versions (CVE-2026-55655)
* openssh: Double free in Red Hat Enterprise Linux versions of OpenSSH DH-GEX client path during FIPS known-group validation leads to client-side denial of service (CVE-2026-55653)
* openssh: OpenSSH: sftp client allows attacker to control downloaded file location (CVE-2026-59995)
* openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side (CVE-2026-60002)
* openssh: OpenSSH sshd: Security bypass due to incorrect handling of forwarding and tunneling options (CVE-2026-59999)
* openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy (CVE-2026-59996)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.
CVE-2026-80048 is a medium severity vulnerability in the sssd-kcm component of Red Hat Enterprise Linux 10. A local user or process with access to the sssd-kcm UNIX socket can exploit this flaw by sending a large request length header and stalling the connection. This causes the system to preallocate excessive memory, leading to memory exhaustion and a denial of service condition.