A security vulnerability in the Linux kernel's IPv4 implementation was identified and fixed by Red Hat. The issue involves improper validation of the checksum_start parameter before completing the checksum calculation. This vulnerability is tracked as CVE-2026-99999 and affects Red Hat Enterprise Linux 9.4 versions. Red Hat has released a security update to address this issue and recommends applying the update and rebooting the system to ensure the fix takes effect.
Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running services, and configuration settings.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including multiple PHP packages version 8.5.11-2.hum1 for aarch64 and x86_64 architectures. This update addresses several vulnerabilities identified by multiple CVEs, including CVE-2025-1218. The advisory marks the severity as high but does not provide detailed technical descriptions or CVSS scores. Updated RPM packages are available to fix bugs and enhance security in these PHP packages.
A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.
This golang security update addresses multiple vulnerabilities including a high-severity HTTP/1 CONNECT request handling flaw (CVE-2026-56866) where a non-empty request body can cause connection desynchronization and cross-user response poisoning in reverse proxies. Additional issues fixed include HTTP/2 response smuggling due to lax header validation (CVE-2026-78660) and multipart form parsing that can bypass memory limits (CVE-2026-94440).
Multiple security vulnerabilities have been identified in OpenEXR, an open-source high-dynamic-range image file format library used for high-quality image processing and storage. These vulnerabilities include memory corruption, denial of service, out-of-bounds write, and information disclosure issues triggered by processing specially crafted EXR image files. Red Hat has issued an important security advisory for OpenEXR in Red Hat Enterprise Linux 9, providing updated packages to address these issues. The vulnerabilities affect various architectures supported by Red Hat Enterprise Linux 9 and related products. No CVSS scores are provided, but the overall severity is rated as important by Red Hat. Users are advised to apply the available updates as detailed in the Red Hat advisory.
Red Hat has released a critical security advisory for Red Hat Ansible Automation Platform 2.7 Container Release addressing multiple security vulnerabilities. The update fixes several CVEs affecting the platform, which is used for enterprise IT automation. Users are advised to apply the update after ensuring all previous errata are applied. No specific affected versions are detailed in the advisory.
A local information disclosure vulnerability in cockpit-machines allows a local attacker to obtain a sensitive Red Hat Subscription Management offline token. The token is exposed via command-line arguments to a helper script during token validation. Exploitation requires local access and the ability to inspect process metadata on systems without restrictive /proc visibility settings. The vulnerability compromises confidentiality but does not affect integrity or availability.
A denial of service (DoS) vulnerability exists in the HTTP cookie parsing functionality of the python-tornado library, identified as CVE-2024-52804 (also referenced as CVE-2024-14029). This affects multiple versions of the Tornado Python web framework and asynchronous networking library. Red Hat Enterprise Linux 9 updates address this issue with security advisories and patches. The vulnerability has a CVSS score of 7.5, indicating a medium severity impact.
Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments.
This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.52. See the following advisory for the RPM packages for this release:
https://access.redhat.com/errata/RHBA-2026:83478
Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated
shortly for this release, for details about these changes:
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/
Security Fix(es):
* kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate
release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at
https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.
CVE-2026-114236 is a low severity vulnerability in Red Hat Confidential Compute Attestation where certain functions may leak file descriptors when processing corrupt or malicious inputs. This leak can lead to exhaustion of the process' file descriptor limit after repeated calls. No confidentiality or integrity impact is reported, only availability is affected.
A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI. An authenticated user, able to submit an evaluation job, could exploit this by providing a malicious model URL in the `JobSpec`. This vulnerability allows for the disclosure of the tenant's model authentication secret to an attacker-controlled external listener. Additionally, it enables Server-Side Request Forgery (SSRF) attacks against internal network endpoints reachable from the evaluation job pod.
Red Hat Ansible Automation Platform 2.2 includes updated Ansible plug-ins for the Red Hat Developer Hub that provide new features, bug fixes, and enhancements to simplify automation for users. The advisory references multiple CVEs including CVE-2026-77037 but does not specify individual vulnerability details or fixes. No patches or remediation actions are currently provided in the advisory.
CVE-2026-68497 is a denial of service vulnerability in the jackson-databind library caused by unbounded numeric parsing. This vulnerability allows an attacker to cause a CPU resource exhaustion, leading to a denial of service condition. The issue affects multiple specific versions of jackson-databind. Red Hat and SUSE have issued security advisories and updates addressing this vulnerability. The vulnerability has a CVSS 3.1 score of 7.5 (medium severity). No known exploits are reported in the wild at this time.
CVE-2026-92824 is an out-of-bounds read vulnerability in libmodulemd used by Red Hat Enterprise Linux 10. The flaw occurs in the module stream v2 rpm-map emission path, where an inner loop incorrectly uses the count of digest algorithms instead of the number of checksums, leading to a potential crash and denial of service during YAML serialization of crafted metadata.
A flaw was found in libmodulemd. When parsing module metadata, the xmd field is converted into nested GVariant values through recursive YAML mapping and sequence helpers without a recursion-depth or node-count limit. An attacker who can supply crafted modulemd YAML with deeply nested xmd content can cause stack exhaustion or excessive resource consumption, resulting in a denial of service.
A flaw was found in libmodulemd. In builds with rpmio support enabled, compressed modulemd YAML is decompressed through a custom read handler that does not enforce a cumulative decompressed-size limit before parsing. An attacker who can supply a highly compressible compressed YAML file can cause excessive CPU and memory consumption, resulting in a denial of service.
CVE-2026-114038 is a medium severity vulnerability in Red Hat Enterprise Linux 10's device-mapper-multipath. A local user can cause an out-of-bounds read by sending a specially crafted command with a format string ending in a trailing percent character to the multipath daemon. This can lead to information disclosure or cause the daemon to crash, resulting in denial of service.
Multiple vulnerabilities in the pcre2 library used by Red Hat Enterprise Linux 8 allow out-of-bounds reads and writes, integer overflow, incorrect memory free operations, and information disclosure. These issues affect various functions including pcre2_dfa_match, JIT fallback, pcre2_compile_32 on 32-bit platforms, and pcre2_serialize_encode. The vulnerabilities can lead to memory corruption and potential information leakage. Red Hat has released security updates addressing these issues.
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997)
* openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998)
* openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.