CVE-2026-86345 is a critical vulnerability in Red Hat Directory Server 11 where the server improperly handles buffered plaintext bytes during StartTLS negotiation. This flaw allows an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade, causing the client to potentially treat a failed authentication attempt as successful due to message ID collision.
A critical command injection vulnerability exists in Red Hat Satellite 6 API (rubygem-foreman_remote_execution) allowing attackers with job template execution permissions to inject arbitrary shell commands via the effective_user parameter when it is marked overridable. This flaw affects Red Hat Satellite versions from 6.16 up to but not including 6.19.5. The vulnerability arises from improper input sanitization during job execution environment instantiation, enabling command execution on target infrastructure with execution user privileges. Red Hat has released an official patch in version 6.19.5 to address this issue.
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276)
* tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434)
* jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
* tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
* tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
* tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
* tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
* tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
* tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299)
* tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180)
* tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422)
* tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
* tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.
A vulnerability in GitPython's TagReference.create() method allows an attacker to read arbitrary local files by bypassing unsafe option guards with a specially crafted positional argument. This causes the contents of arbitrary files to be returned in the annotated tag message. The issue affects GitPython versions up to 3.1.58 and requires the embedding application to forward a user-controlled reference value. A fix is available that properly checks positional arguments or separates them with '--' to prevent this bypass. This vulnerability is relevant to Red Hat Satellite and related container images as noted in the Red Hat security advisory.
CVE-2026-75899 is a high severity vulnerability affecting Red Hat Hardened Images RPMs, including the satellite/iop-vulnerability-frontend-rhel9 container image. The issue is addressed in updated packages such as grafana13.2. No known exploits are reported in the wild. The vulnerability impacts specific versions of node-ajv and related components within Red Hat's hardened images.
An off-by-one error in the GLib library's g_key_file_get_locale_string_list function can cause a one-byte out-of-bounds access or denial of service when processing a key file with an empty value. This vulnerability affects Red Hat OpenShift Container Platform 4.12 and related products. Red Hat has released security updates addressing this and other GLib vulnerabilities.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the openshell packages to address multiple vulnerabilities identified by CVE-2026-102821, CVE-2026-102823, and CVE-2026-102824. The update includes new versions of openshell, openshell-gateway, and python3-openshell RPMs for aarch64 and x86_64 architectures. No explicit details on the nature of the vulnerabilities or their impact are provided in the advisory. The advisory does not list any fixed versions prior to these updates, indicating these RPM versions contain the security fixes.
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.2.5 serves as a replacement for Red Hat JBoss Web Server 6.2.4. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat-catalina: Apache Tomcat: Misleading security logs due to incorrect control flow (CVE-2026-55276)
* tomcat-coyote-ffm: Apache Tomcat: Error condition not handled when configuring CRL (CVE-2026-53434)
* jws6-tomcat: Apache Tomcat: Security constraint bypass via improper URL encoding in rewrite valve (CVE-2026-59083)
* tomcat: Apache Tomcat: Local information disclosure via Unix domain socket TOCTOU race condition (CVE-2026-65183)
* tomcat: Apache Tomcat: Security constraint bypass due to improper access control (CVE-2026-65182)
* tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing (CVE-2026-65927)
* tomcat: Apache Tomcat: Denial of Service via HTTP/2 allocation leak (CVE-2026-68763)
* tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass (CVE-2026-68525)
* tomcat: Apache Tomcat - DoS in WebSocket chat example (CVE-2026-66299)
* tomcat: Apache Tomcat: Authenticated WebSocket session persists after HTTP session termination (CVE-2026-73180)
* tomcat: Apache Tomcat: Improper Authorization allows bypass of declarative role constraints (CVE-2026-66422)
* tomcat: Apache Tomcat: Improper Authentication due to principal lookup failure (CVE-2026-68569)
* tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator (CVE-2026-65905)
* openssl.exe: Heap Use-After-Free in OpenSSL PKCS7_verify() (CVE-2026-45447)
* jws-optional-native-components-win6-x86_64.zip: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys (CVE-2026-34181)
* jws-optional-native-components-win6-x86_64.zip: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure (CVE-2026-34180)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container
Platform 4.18.56. See the following advisory for the RPM packages for this
release:
https://access.redhat.com/errata/RHSA-2026:70614
Space precludes documenting all of the container images in this advisory.
See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/
Security Fix(es):
* urllib3: urllib3: Unbounded decompression chain leads to resource
exhaustion (CVE-2025-66418)
* bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation
(CVE-2026-3039)
* bind: BIND: Denial of Service via specially crafted DNS messages
(CVE-2026-5946)
* dracut: dracut: Root code execution via DHCP options command injection
(CVE-2026-6893)
* bind9: bind: Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331)
* bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field
(CVE-2026-13321)
* dracut: dracut: root code execution via unescaped error message written
to sourced emergency hook script in die() (CVE-2026-15816)
* libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via
dangling filtered_buf pointer in init_unpack() (CVE-2026-14164)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.18 users are advised to upgrade to these
updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc)
or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.
Red Hat Quay versions prior to 3.9.26 contain multiple security vulnerabilities affecting the logging subsystem for Red Hat OpenShift and related components. These issues are addressed in the Red Hat Quay 3.9.26 update. The advisory emphasizes the importance of applying this update to remediate the vulnerabilities.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.12.99. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:70645
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes
Multiple security vulnerabilities affect Red Hat OpenShift Container Platform versions including 4.12.98, 4.14, 4.15, 4.16 through 4.22.11. These include a bypass vulnerability in cri-o allowing /etc/passwd injection via the HOME environment variable (CVE-2026-15809), denial of service issues in Go language packages, privilege escalation via incorrect Punycode processing, and cross-site scripting in Go's html/template package. Red Hat has released updated RPM packages and container images to address these issues. Users are advised to upgrade to the fixed versions using the OpenShift CLI or web console.
CVE-2026-103754 is a medium severity vulnerability in Red Hat Ansible Automation Platform 2 involving improper validation of symbolic link targets and filesystem paths when extracting streamed zip archives. The flaw exists in the ansible-runner's unstream_dir() function, which can create or modify files outside the intended directory. This can potentially lead to unauthorized changes in file permissions or creation of symbolic links, which may be leveraged for code execution.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.55. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHSA-2026:66385
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/
This advisory addresses security vulnerabilities in GVFS, the GNOME Virtual File System, affecting Red Hat Enterprise Linux 9. The update fixes a heap-based buffer overflow in the SFTP component and a local privilege escalation via a socket ownership race condition. These issues could allow local attackers to gain elevated privileges or cause memory corruption. The update is rated as important by Red Hat and applies to multiple architectures and variants of Red Hat Enterprise Linux 9.
CVE-2026-96577 is a vulnerability in the oc-mirror component of Red Hat OpenShift Container Platform 4.18. The embedded local cache registry improperly binds to all network interfaces without authentication or encryption during mirroring operations. This misconfiguration allows an unauthenticated attacker on an adjacent network to connect to the service and potentially push tampered container images, delete cached images, or access mirrored content.
A vulnerability in oauth-proxy allows improper validation of the destination redirect parameter after login, enabling an attacker to redirect users to arbitrary external websites. This open redirect flaw can be exploited for phishing or credential theft. Red Hat has issued a security advisory with updates for OpenShift Container Platform 4.20.41 to address this issue.