Two security vulnerabilities have been identified in the X.Org X11 libXfont2 runtime library affecting Red Hat Enterprise Linux 8. These include an out-of-bounds read/write in the Font Server Client encoding and a privilege escalation via a heap buffer overflow in the Font Server Client. Red Hat has issued an important security advisory with updates to address these issues. Updated packages are available for multiple architectures and variants of Red Hat Enterprise Linux 8.
Red Hat has issued security advisories addressing multiple vulnerabilities in the .NET 8.0 platform on Red Hat Enterprise Linux 8 and Red Hat Hardened Images RPMs. The vulnerabilities include security feature bypass, information disclosure, denial of service, and elevation of privilege issues affecting various .NET runtime and SDK components across multiple architectures. Official fixes are available through updated RPM packages for both Red Hat Enterprise Linux 8 and Red Hat Hardened Images. The advisories provide detailed remediation instructions and updated package versions to mitigate these vulnerabilities.
CVE-2026-33818 is a high severity vulnerability in the Go standard library encoding/asn1 package that involves uncontrolled resource consumption. Red Hat has issued a security advisory addressing this and other vulnerabilities by releasing updated golang1.26 RPM packages. The fix is included in golang1.26 version 1.26.6-0.1.hum1 for multiple architectures. No detailed technical or exploitation information is provided in the advisory.
A denial of service vulnerability exists in Apache Thrift Java bindings (libthrift-java) due to uncontrolled resource allocation. This issue is addressed in a security update released by Red Hat for their Build of Apache Camel 4.18 for Quarkus 3.33. The vulnerability can cause service disruption but does not impact confidentiality or integrity. The update is rated as important and recommended for affected users.
This release of the Red Hat build of OpenTelemetry provides new features, security improvements, and bug fixes.
Breaking changes:
* None
Deprecations:
* None
Technology Preview features:
* None
Enhancements:
* None
Bug fixes:
* None
Known issues:
* None
Red Hat Discovery, also known as Discovery, is an inspection and reporting tool that finds,
identifies, and reports environment data, or facts, such as the number of physical and virtual
systems on a network, their operating systems, and relevant configuration data stored within
them. Discovery also identifies and reports more detailed facts for some versions of key
Red Hat packages and products that it finds in the network.
Red Hat has released an important security update for Red Hat build of Quarkus version 3.27.5 addressing multiple vulnerabilities. These include a heap buffer overflow in Jansi causing denial of service, authentication downgrade attacks via SCRAM libraries, man-in-the-middle protection bypass in PostgreSQL JDBC, and unauthorized command execution in Apache MINA SSHD due to improper certificate validation. The update fixes these issues to improve security.
Red Hat Streams for Apache Kafka, based on the Apache Kafka project, offers a distributed
backbone that allows microservices and other applications to share data with
extremely high throughput and extremely low latency.
This release of Red Hat Streams for Apache Kafka 3.2.1 serves as a replacement for Red Hat Streams for Apache Kafka 3.2.0, and includes security and bug fixes, and enhancements.
Security Fix(es):
* golang-github-danielqsj-kafka_exporter: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests (CVE-2026-39852)
* kafka-clients: Apache Kafka Clients: Information disclosure and data corruption due to race condition in producer buffer management (CVE-2026-35554)
* log4j-layout-template-json: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output (CVE-2026-34481)
* log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging (CVE-2026-34480)
* log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames (CVE-2026-34478)
* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement (CVE-2026-42579)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion (CVE-2026-42584)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers (CVE-2026-42581)
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation (CVE-2026-42578)
* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression (CVE-2026-42587)
* netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder (CVE-2026-42583)
* netty-codec-compression: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder (CVE-2026-42583)
* next: Next.js: Authorization bypass via crafted query parameters (CVE-2026-44574)
* next: Next.js: Denial of Service via crafted POST requests to server actions (CVE-2026-44579)
* next: Next.js: Denial of Service via Image Optimization API (CVE-2026-44577)
* next: Next.js: Information disclosure due to middleware bypass in Pages Router with i18n (CVE-2026-44573)
* next: Next.js: Server-Side Request Forgery via crafted WebSocket upgrade requests (CVE-2026-44578)
* next: Next.js: Information disclosure via security fix bypass in middleware with Turbopack (CVE-2026-45109)
* next: Next.js: Unauthorized access to protected content via middleware bypass (CVE-2026-44575)
* quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters (CVE-2026-50559)
* golang-github-danielqsj-kafka_exporter: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* vertx-core: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name (CVE-2026-6860)
* netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation (CVE-2026-44249)
* netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message (CVE-2026-44893)
* netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak (CVE-2026-48043)
* netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers (CVE-2026-48059)
* netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records (CVE-2026-47691)
* netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation (CVE-2026-45674)
* netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake (CVE-2026-45416)
* golang-github-danielqsj-kafka_exporter: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* cluster-operator: Cross-namespace privilege escalation via Kafka.spec.entityOperator.watchedNamespace in Strimzi (CVE-2026-55225)
* micrometer-core: Micrometer: Denial of Service via specially crafted HTTP requests (CVE-2026-40984)
* micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests (CVE-2026-40983)
* golang-github-danielqsj-kafka_exporter: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries (CVE-2026-27145)
* jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass (CVE-2026-54512)
* jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing (CVE-2026-50193)
* golang-github-danielqsj-kafka_exporter: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* jacks
Red Hat released a critical security update for Multicluster Global Hub, addressing multiple vulnerabilities identified by CVE-2026-42306, CVE-2026-55969, and CVE-2026-66801. The affected versions are from 1.5.1 up to but not including 1.5.7. The update is delivered in version 1.5.7 and later, which includes security fixes and updated container images. No known exploits are reported in the wild at this time.
GNOME Remote Desktop is a remote desktop and screen sharing service for the GNOME desktop environment.
Security Fix(es):
* gnome-remote-desktop: gnome-remote-desktop system-mode RDP server missing connection throttling allows unauthenticated denial of service (CVE-2026-18358)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This update includes the following RPMs:
prometheus3.5:
* prometheus3.5-3.5.5-0.8.hum1 (aarch64, x86_64)
* prometheus3.5-3.5.5-0.8.hum1.src (src)
Security Fix(es):
prometheus3.5:
* CVE-2026-73086
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana12.4 package version 12.4.8-0.1.1.hum1 on aarch64 and x86_64 architectures. The update addresses multiple vulnerabilities identified by CVE-2026-73086, CVE-2026-73088, CVE-2026-73089, CVE-2026-45819, and CVE-2026-16221. The severity of these vulnerabilities is classified as high. The advisory provides updated RPM packages to remediate these issues.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing two vulnerabilities identified as CVE-2026-73088 and CVE-2026-73089 in the grafana13.1 package version 13.1.3-0.1.1.hum1 for aarch64 and x86_64 architectures. The advisory provides updated RPMs to mitigate these vulnerabilities. No detailed technical information or CVSS scores are provided in the advisory.
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP), released under the Apache license. The xfreerdp client can connect to RDP servers such as Microsoft Windows machines, xrdp, and VirtualBox.
Security Fix(es):
* FreeRDP: FreeRDP: Remote code execution or denial of service via heap-based buffer overflow (CVE-2026-64620)
* FreeRDP: FreeRDP: Double-free vulnerability via crafted .rdp file leading to potential remote code execution (CVE-2026-64621)
* FreeRDP: FreeRDP: Arbitrary code execution via malicious RDP files (CVE-2026-64624)
* FreeRDP: FreeRDP: Denial of Service via crafted WindowIcon async message (CVE-2026-67299)
* FreeRDP: FreeRDP: HTTP Proxy Request Injection via Redirection (CVE-2026-67289)
* FreeRDP: FreeRDP: Remote code execution or denial of service via audio input integer overflow (CVE-2026-68580)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in jackson-databind affects versions from 2.0.0 up to but excluding 2.18.8, 2.21.4, and 3.1.4. The issue arises because the JDKFromStringDeserializer class eagerly resolves DNS names during deserialization of InetSocketAddress fields, potentially causing an attacker-controlled DNS query before application validation. The vulnerability is fixed by deferring DNS resolution until an explicit connect call. This flaw has a CVSS score of 7.5 and is rated as medium severity.
Red Hat has released a security advisory addressing multiple vulnerabilities in Red Hat Hardened Images RPMs, including updates to nodejs24 packages for aarch64 and x86_64 architectures. The advisory covers several CVEs such as CVE-2026-18149 and others. A patch is available to remediate these issues. The update includes bug fixes and enhancements to various nodejs24-related RPMs. The vulnerabilities are rated with high severity.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple nodejs22 packages to address a security vulnerability identified as CVE-2026-69152. The update includes various nodejs22 components for aarch64 and x86_64 architectures. No explicit affected versions are stated. The advisory does not mention any known exploits in the wild.