A Regular Expression Denial of Service (ReDoS) vulnerability (CVE-2026-15154) exists in the guardrails-detectors component of Red Hat OpenShift AI. This vulnerability allows remote attackers to send specially crafted regular expressions to the public detection API, causing catastrophic backtracking and resulting in a worker process consuming 100% CPU indefinitely. This leads to denial of service for the guardrails-mediated large language model pipeline. The issue affects specific versions of Red Hat OpenShift AI and has been assigned a medium severity rating with a CVSS score of 6.5. Red Hat has released updated images and version 2.25.10 to address this vulnerability.
Red Hat OpenShift AI versions 3.4.0 up to but not including 3.4.3 contain multiple critical security vulnerabilities, including CVE-2026-13717 and others. Red Hat has released version 3.4.3 with updated images to address these issues. Users are strongly advised to upgrade their clusters following Red Hat's official documentation to mitigate these vulnerabilities. No detailed technical or exploit information is provided in the advisory.
A security update for IBM Java SE version 8 (java-1.8.0-ibm) addresses multiple vulnerabilities including arbitrary class loading and instantiation via a malicious IIOP server (CVE-2026-8400), information disclosure or denial of service via integer overflow in Little CMS (CVE-2026-41254), and several enhancements and fixes in OpenJDK components such as TLS certificate handling, image processing, Jar file handling, and method delegation. The update is rated as important by Red Hat Product Security and affects Red Hat Enterprise Linux 8 on multiple architectures.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: iio: event: Fix event FIFO reset race (CVE-2026-64496)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Ansible Automation Platform 2.1 delivers an Ansible-first Red Hat Developer Hub
user experience that simplifies the automation experience for Ansible users of all skill levels.
The Ansible plug-ins provide curated content and features to accelerate Ansible learner
onboarding and streamline Ansible use case adoption across your organization.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: crypto: seqiv - Do not use req->iv after crypto_aead_encrypt (CVE-2025-71131)
* kernel: selinux: fix overlayfs mmap() and mprotect() access checks (CVE-2026-46054)
* kernel: drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CVE-2026-52976)
Bug Fix(es) and Enhancement(s):
* RHEL9.4 - dasd: Fix PPRC copy pair swap state and format information. [rhel-9.6.z] (JIRA:RHEL-176469)
* [xfstests xfs/017] xfs_repair fails and hit XFS: Assertion failed: 0, file: fs/xfs/xfs_icache.c, line: 1840 [rhel-9.6.z] (JIRA:RHEL-188771)
* nfs: backport patch which checks delegation validity in nfs_start_delegation_return_locked to RHEL 9 [rhel-9.6.z] (JIRA:RHEL-212042)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* ip-address: ip-address: Cross-site scripting via improper HTML escaping of untrusted input (CVE-2026-42338)
* undici: undici: Denial of Service due to unbounded memory growth via WebSocket frames (CVE-2026-12151)
* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)
* brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity (CVE-2026-13149)
* tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
* tar: node-tar: Denial of Service via crafted gzip bomb (CVE-2026-59873)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A TOCTOU race condition vulnerability exists in the fixfiles script of policycoreutils in Red Hat Hardened Images. This flaw allows a local attacker to exploit a timing window during filesystem relabeling to manipulate SELinux labels on arbitrary system files, potentially undermining SELinux protections on critical files such as /etc/shadow. The vulnerability requires local access, winning a race condition, and an administrator running fixfiles relabel or fixfiles restore. A workaround is to use 'restorecon -R /' instead of the vulnerable fixfiles commands. An official fix has been released in updated policycoreutils RPMs.
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.
Security Fix(es):
* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)
Bug Fix(es) and Enhancement(s):
* spec: systemd build fails due to rename of rhel-net-naming-sysattrs upstream (JIRA:RHEL-150625)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)
* urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A memory leak vulnerability exists in UltraJSON (ujson) when using ujson.dump() to write JSON to a file-like object that raises an exception during the write operation. The leak occurs because the serialized JSON string object is not properly decremented, causing memory to grow linearly with each failed write. This affects applications that serialize data using ujson.dump() to potentially attacker-controlled file-like objects that can fail. The issue is fixed in UltraJSON version 5.12.1. A workaround is to replace ujson.dump() with file.write(ujson.dumps(obj)), which avoids the leak.
A denial of service vulnerability exists in the python-multipart library used for parsing multipart/form-data requests. The flaw allows an attacker to cause excessive CPU usage by sending requests with many repeated headers without termination or a single very large header value. This affects ASGI applications using frameworks like Starlette or FastAPI that rely on python-multipart. The issue is mitigated by upgrading to python-multipart version 0.0.27 or later. If immediate upgrade is not possible, limiting request body size at the server or proxy can reduce exposure but does not fully resolve the vulnerability.
Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings. When you install Red Hat Lightspeed in Satellite locally, you can generate Red Hat Lightspeed recommendations without sending system data to Red Hat services.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (CVE-2026-23415)
* kernel: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CVE-2026-43450)
Bug Fix(es) and Enhancement(s):
* kernel panics caused by NULL pointer dereferences within octeon_ep_vf [rhel-9.8.z] (JIRA:RHEL-186331)
* [RHEL 9.4] Kernel memory reclaim bug [rhel-9.8.z] (JIRA:RHEL-211058)
* Bond network interface is not coming up with MTU 9000 while vPMEM is enabled [rhel-9.8.z] (JIRA:RHEL-215575)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.17.56. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:47726
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.17/html/release_notes/
CVE-2026-71556 is a high severity vulnerability affecting Red Hat OpenShift Virtualization v4.18 images and related Red Hat Hardened Images RPMs. The issue is addressed by an update to the syft package version 1.51.1-0.1.hum1 for multiple architectures. Red Hat has released a security advisory with a patch available to remediate this vulnerability.