Red Hat Data Grid is an in-memory, distributed, NoSQL datastore solution. It increases application response times and allows for dramatically improving performance while providing availability, reliability, and elastic scale.
Data Grid 8.6.3 replaces Data Grid 8.6.2 and includes bug fixes and enhancements. Find out more about Data Grid 8.6.3 in the Release Notes[3].
Security Fix(es):
* CVE-2026-68494 jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser [jdg-8.6] (CVE-2026-68494)
* CVE-2026-56745 datagrid-8/datagrid-8: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec [jdg-8.6] (CVE-2026-56745)
* CVE-2026-62243 netty-handler: Netty: TLS hostname verification bypass via OpenSSL client path misconfiguration [jdg-8.6] (CVE-2026-62243)
* CVE-2026-73508 netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names [jdg-8.6] (CVE-2026-73508)
* CVE-2026-49978 dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution [jdg-8.6] (CVE-2026-49978)
* CVE-2026-76844 redhat-datagrid-maven-repository.zip: webpack-dev-middleware: Information Disclosure via Path Traversal [jdg-8.6] (CVE-2026-76844)
* CVE-2026-59901 netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2) [jdg-8.6] (CVE-2026-59901)
* CVE-2026-59899 netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb) [jdg-8.6] (CVE-2026-59899)
* CVE-2026-56820 netty-handler-ssl-ocsp: Netty: Certificate revocation bypass via OCSP response replay attack [jdg-8.6] (CVE-2026-56820)
* CVE-2026-56819 netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak [jdg-8.6] (CVE-2026-56819)
* CVE-2026-56817 netty-codec-xml: Netty: Information disclosure via XML External Entity (XXE) vulnerability [jdg-8.6] (CVE-2026-56817)
* CVE-2026-56746 netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header [jdg-8.6] (CVE-2026-56746)
* CVE-2026-55851 netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message [jdg-8.6] (CVE-2026-55851)
* CVE-2026-55831 netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing [jdg-8.6] (CVE-2026-55831)
* CVE-2026-55833 netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification [jdg-8.6] (CVE-2026-55833)
* CVE-2026-44891 netty-codec-stomp: Netty: Denial of Service vulnerability in STOMP decoder [jdg-8.6] (CVE-2026-44891)
* CVE-2026-59296 micrometer-core: Micrometer: Line-protocol and log injection via unsanitized input allows metric and log spoofing [jdg-8.6] (CVE-2026-59296)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat has released a security advisory addressing multiple vulnerabilities in the satellite/iop-host-inventory-frontend-rhel9 component used in Red Hat Satellite, part of Red Hat Lightspeed. This component analyzes system health and configuration locally without sending data externally. Several CVEs including CVE-2026-59879 are associated with this advisory. A patch is available for affected versions, and users are advised to update accordingly.
rhc is a client tool and daemon that connects the system to Red Hat hosted services enabling system and subscription management.
Security Fix(es):
* golang.org/x/text: golang.org/x/text: Denial of Service via invalid UTF-8 input (CVE-2026-56852)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities affecting Apache Tomcat as distributed by Red Hat have been identified and fixed. These include issues such as improper input validation, authentication bypass, HTTP/2 header validation flaws, information disclosure during WebSocket authentication, improper authorization, case sensitivity handling errors, and security constraint bypasses. The vulnerabilities have a moderate security impact and affect Red Hat Enterprise Linux versions from 10.1.0 up to but not including 10.1.49. Red Hat has released an update addressing these issues.
A service for building customized OS artifacts, such as VM images and OSTree commits, that uses osbuild under the hood. Besides building images for local usage, it can also upload images directly to cloud. It is compatible with composer-cli and cockpit-composer clients.
Security Fix(es):
* golang-fips: Golang FIPS zeroed buffer (CVE-2024-9355)
* golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect (CVE-2024-45336)
* crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec (CVE-2025-22866)
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* crypto/x509: golang: Go crypto/x509: Certificate validation bypass due to incorrect DNS constraint application (CVE-2026-33810)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service (CVE-2026-56853)
* html/template: golang: Go html/template: Cross-Site Scripting via pathological input (CVE-2026-56858)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security update for webkit2gtk3 on Red Hat Enterprise Linux 9 addresses multiple vulnerabilities in the ANGLE component used by chromium-browser. These include out-of-bounds memory access, heap buffer overflows, use-after-free, integer overflows, type confusion, and insufficient validation of untrusted input. The update is rated as important by Red Hat Product Security and fixes numerous CVEs affecting ANGLE. The vulnerabilities could potentially lead to memory corruption and other security issues.
WebKitGTK is the port of the portable web rendering engine WebKit to the GTK platform.
Security Fix(es):
* chromium-browser: Skia in Google Chrome: Sandbox escape via crafted HTML page (CVE-2026-19154)
* chromium-browser: skia: Skia: Sandbox escape via out-of-bounds write in Chromium (CVE-2026-19173)
* chromium-browser: Skia in Google Chrome: Cross-origin data leakage via uninitialized use (CVE-2026-19161)
* chromium-browser: Skia: Arbitrary code execution via crafted HTML page (CVE-2026-19176)
* chromium-browser: Chromium: Information leak allows web origin policy bypass (CVE-2026-76041)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-28984)
* webkitgtk: Visiting a website may lead to an app denial-of-service (CVE-2026-43804)
* webkitgtk: Websites may know if the user has visited a given link (CVE-2026-64713)
* webkitgtk: Maliciously crafted web content may violate iframe sandboxing policy (CVE-2026-64728)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-64787)
* webkitgtk: Visiting a website that frames malicious content may lead to UI spoofing (CVE-2026-64730)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64757)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64783)
* webkitgtk: use-after-free of JSCValue function parameters (CVE-2026-78376)
* chromium-browser: Skia: Information disclosure via out-of-bounds read in crafted media file (CVE-2026-79020)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-43795)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process crash (CVE-2026-64715)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64718)
* webkitgtk: Visiting a maliciously crafted website may leak sensitive data (CVE-2026-64778)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64779)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64780)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64782)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-64784)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65331)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65332)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65334)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65335)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65336)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65337)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65338)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65340)
* webkitgtk: Processing maliciously crafted web content may lead to memory corruption (CVE-2026-65341)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash (CVE-2026-65351)
* webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature (CVE-2026-83596)
* chromium-browser: skia: chromium-browser: Information leak in Skia (CVE-2026-84359)
* webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination (CVE-2026-84635)
* webkitgtk: Processing maliciously crafted web content may disclose sensitive user information (CVE-2026-64753)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin (CVE-2026-28417)
* vim: Vim: Denial of service and information disclosure via crafted swap file (CVE-2026-28421)
* vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)
* vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)
* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)
* vim: command injection when decompressing .tgz archives (CVE-2026-46483)
* vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)
* vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)
* vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)
* vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
* vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
* vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This Red Hat Security Advisory addresses multiple vulnerabilities and bugs in the Linux kernel-rt packages for Red Hat Enterprise Linux 8. It fixes security issues including user-triggerable warnings, double-free errors, use-after-free vulnerabilities, and arbitrary code execution via userfaultfd shadow stack manipulation. The update includes fixes for CVE-2026-46117 and CVE-2026-53071, impacting kernel components such as RDMA/mana and Bluetooth l2cap. The update requires a system reboot to take effect.
Red Hat has released a security advisory addressing multiple high severity vulnerabilities in Red Hat Hardened Images RPMs, including updates to Grafana packages version 12.4.10-0.2.hum1 and 13.1.6-0.2.hum1 for aarch64 and x86_64 architectures. The update is a bug fix and enhancement release that resolves these issues. The advisory covers a range of CVEs including CVE-2026-14199 and others. The update is available and users are advised to apply it as per Red Hat's instructions.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the jaeger package to version 2.20.0-0.9.hum1. This update addresses the security vulnerability identified as CVE-2026-81871. The advisory does not provide detailed technical information about the vulnerability or its exploitation but categorizes it with medium severity.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana12.4 package version 12.4.10-0.6.hum1 for aarch64 and x86_64 architectures to address multiple vulnerabilities including CVE-2026-61709. The advisory highlights this CVE as a security fix. The severity of the vulnerabilities is assessed as high. The update is available as new RPM packages. No explicit patch status beyond the availability of updated RPMs is stated in the advisory.
Red Hat has issued a security advisory for an update to Red Hat Hardened Images RPMs, specifically addressing vulnerabilities identified by CVE-2026-63209 and CVE-2026-71557 in the syft package version 1.52.0-0.1.hum1 for aarch64 and x86_64 architectures. The update is described as a bug fix and enhancement update without detailed technical information on the vulnerabilities. No known exploits are reported in the wild at this time.
A vulnerability exists in the Qt XML parsing component (QDomNode destructor) used in Red Hat Hardened Images RPMs containing qt6-qtbase packages. The flaw can cause unbounded recursion leading to denial-of-service (DoS) crashes when processing untrusted XML input. Currently, no fix has been released and no mitigation meets Red Hat's criteria.
A critical vulnerability in GitPython allows bypassing safety checks for dangerous Git options when using Python keyword arguments with underscores, leading to arbitrary command execution. This affects certain Red Hat Satellite container images and related GitPython versions. Red Hat has released a Technology Preview container image addressing this issue but no official fix for Red Hat Satellite is currently available. The vulnerability could allow attackers to execute arbitrary commands if exploited.