Multiple vulnerabilities in the pcre2 library used by Red Hat Enterprise Linux 8 allow out-of-bounds reads and writes, integer overflow, incorrect memory free operations, and information disclosure. These issues affect various functions including pcre2_dfa_match, JIT fallback, pcre2_compile_32 on 32-bit platforms, and pcre2_serialize_encode. The vulnerabilities can lead to memory corruption and potential information leakage. Red Hat has released security updates addressing these issues.
OpenSSH is an SSH protocol implementation supported by a number of Linux, UNIX, and similar operating systems. It includes the core files necessary for both the OpenSSH client and server.
Security Fix(es):
* openssh: OpenSSH: SFTP security bypass due to command-line argument parsing flaw (CVE-2026-59997)
* openssh: OpenSSH: Undocumented GSSAPIStrictAcceptorCheck behavior impacts security in Windows Active Directory (CVE-2026-59998)
* openssh: OpenSSH: Denial of Service via excessive GSSAPI authentication attempts (CVE-2026-60000)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Two security vulnerabilities were identified in the lrzsz package used in Red Hat Enterprise Linux 10. These include an arbitrary file overwrite via absolute path traversal in restricted mode (CVE-2026-105840) and arbitrary command execution via crafted file names in pipe mode (CVE-2026-105841). Red Hat has issued an important security advisory with updates that fix these issues. The vulnerabilities affect multiple architectures of Red Hat Enterprise Linux 10 and its extended update support versions. The advisory also includes bug fixes and enhancements unrelated to the security issues. No CVSS score is provided, but the impact is considered high. Users are advised to apply the provided updates to remediate these vulnerabilities.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating golang1.27 packages to version 1.27.3-1.hum1. The update addresses multiple CVEs including CVE-2026-94440, CVE-2026-97030, and CVE-2026-111943. The advisory provides updated RPM packages for several architectures and includes bug fixes and enhancements. No explicit details on the vulnerabilities or their exploitation are provided in the advisory.
CVE-2026-84268 is a heap-based buffer overflow vulnerability in the GNOME gvfs component, specifically in the SFTP protocol handling function read_reply(). This vulnerability has a high severity with a CVSS score of 8.8, indicating it can lead to high impact on confidentiality, integrity, and availability. The issue affects Red Hat Enterprise Linux 8 and related distributions. A security update addressing this vulnerability is available from Red Hat.
Multiple security issues affecting the shadowsocks-rust package version 1.25.0-2.1 on openSUSE Tumbleweed and Red Hat Hardened Images have been addressed. These issues relate to a CWE-125 vulnerability tracked under CVE-2026-93599. Red Hat has released updated RPM packages as part of advisory RHSA-2026:70694 to fix these issues. No known exploits are reported in the wild. The severity is assessed as medium.
CVE-2026-84375 is a medium severity vulnerability affecting Red Hat Hardened Images RPMs, specifically impacting OpenShift Virtualization v4.12 images and related packages including grafana13.2. The issue relates to CWE-835 and has no known exploits in the wild. Red Hat has issued an update to the grafana13.2 package to version 13.2.0-0.1.4.hum1 to address this vulnerability.
A medium severity vulnerability (CVE-2026-58374) exists in hostapd, specifically in wpa_supplicant's AP-mode Wi-Fi 7 Multi-Link Operation association request processing. The flaw is due to a missing bounds check that allows an unauthenticated attacker to send a crafted management frame causing an out-of-bounds write, leading to denial of service. The issue affects Red Hat Enterprise Linux 10 and related packages. Red Hat has released a security update to address this vulnerability. There are no known exploits in the wild.
A denial of service vulnerability (CVE-2026-91777) affecting the jackson-databind component of the Jackson Data Processor has been identified and addressed by Red Hat. The issue involves a quadratic forward-reference completion that can lead to denial of service. Red Hat has released security updates for Red Hat Enterprise Linux 9 and related variants to remediate this vulnerability.
Red Hat issued a security advisory for Submariner v0.23, a Kubernetes operator enabling cross-cluster connectivity for services and pods. The advisory addresses multiple security fixes and container updates in the Submariner operator and related components. The update is rated as having an Important security impact. The advisory references several CVEs affecting the product and provides updated container images and documentation improvements. No CVSS score is provided for these vulnerabilities. The affected product is Red Hat Advanced Cluster Management for Kubernetes version 2.16. The advisory includes links to upstream Submariner release notes and Red Hat documentation for further details.
Red Hat has issued an important security advisory for OpenShift Virtualization version 4.21 images addressing multiple bugs and enhancements, including fixes for CVE-2026-56858 and related CVEs. The advisory updates container images for Red Hat's virtualization solution on the OpenShift Container Platform. Users are advised to apply the update after ensuring all prior relevant errata are installed. No detailed vulnerability descriptions or exploitation methods are provided in the advisory.
A vulnerability in urllib3 versions 1.26.0 through 2.7.0 causes improper separation of TLS configurations between HTTPS proxies and target servers. This can result in the proxy TLS connection using the target server's SSL context and certificate verification policies, potentially disabling proxy certificate verification. An attacker intercepting the HTTPS proxy connection could impersonate the proxy, exposing sensitive data and client TLS identity information. The issue affects HTTPS forwarding proxy configurations and is fixed in urllib3 version 2.8.0 and later.
Red Hat OpenShift AI 3.4.5 is a security advisory release that addresses multiple critical vulnerabilities identified by various CVEs including CVE-2025-61162. The advisory announces updated images for Red Hat OpenShift AI but does not provide specific details about the vulnerabilities or fixes in the release notes. Users are directed to official Red Hat documentation for upgrade instructions. No explicit patch details or affected versions are provided in the advisory content.
Red Hat has issued a security advisory for updated RPM packages in its Hardened Images, specifically for nodejs24 and related components. The update addresses multiple security vulnerabilities identified by CVE identifiers including CVE-2026-87018, CVE-2026-87029, and others. These vulnerabilities affect various architectures including aarch64, s390x, and x86_64. The advisory provides updated package versions to mitigate these issues.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple mariadb10.11 packages to address several security vulnerabilities identified by CVE-2026-85745, CVE-2026-85985, CVE-2026-86047, CVE-2026-97380, CVE-2026-107814, and CVE-2026-107823. The advisory provides updated RPM versions that include fixes for these vulnerabilities. No specific affected versions prior to the update are detailed in the advisory.
Multiple security vulnerabilities have been identified in OpenSSL affecting Red Hat Enterprise Linux 10.0 Extended Update Support and related variants. These include information disclosure, data tampering, denial of service, acceptance of forged messages, unbounded memory growth, and use-after-free issues in various cryptographic operations. Red Hat has issued an important security advisory with updates to address these issues.