Red Hat has released a security update for Red Hat build of Keycloak 26.6.7 addressing multiple vulnerabilities including information disclosure, privilege escalation, authorization bypasses, remote code execution, and denial of service. These flaws affect authentication, authorization, token handling, and endpoint protections. Users of affected versions prior to 26.6.7 are advised to apply the update to mitigate these risks.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating the opentelemetry-collector-contrib package version 0.161.0-0.1.hum1 for aarch64 and x86_64 architectures. This update addresses multiple security vulnerabilities identified by several CVEs. The advisory provides updated RPMs and directs users to apply the update via Red Hat's image repository. No detailed fix information or exploit data is provided in the advisory.
This Red Hat security advisory addresses multiple vulnerabilities in the BIND DNS software included in Red Hat Hardened Images RPMs. The update fixes issues such as unauthenticated application of IXFR deltas before TSIG verification, use-after-free crashes in recursive resolvers, remote assertion failures, and denial of service via cached AliasMode trees. These vulnerabilities could lead to crashes, data leakage, or denial of service conditions. The update is provided in bind version 9.20.29-0.1.hum1 for aarch64 and x86_64 architectures. The severity is assessed as high due to the potential impact on DNS resolution.
CVE-2026-92615 is a medium severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 related to improper resource locking in the flightctl component. The flaw arises from a race condition in the configureRepoHTTPSClient() function, which installs per-repository TLS configurations into a process-global map shared across concurrent git clone operations. This can cause TLS settings, including InsecureSkipVerify and mTLS client credentials, from one tenant to leak into another tenant's git operations in multi-tenant deployments.
Red Hat JBoss Web Server is a fully integrated and certified set of components for hosting Java web applications. It is comprised of the Apache Tomcat Servlet container, JBoss HTTP Connector (mod_cluster), the PicketLink Vault extension for Apache Tomcat, and the Tomcat Native library.
This release of Red Hat JBoss Web Server 6.2.4 serves as a replacement for Red Hat JBoss Web Server 6.2.3. This release includes bug fixes, enhancements and component upgrades, which are documented in the Release Notes that are linked to in the References section.
Security Fix(es):
* tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated (CVE-2026-41293)
* tomcat-coyote: Apache Tomcat: Information disclosure via AJP secret timing discrepancy (CVE-2026-43514)
* tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication (CVE-2026-43512)
* tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm (CVE-2026-43513)
* tomcat-coyote: tomcat: Improper Authorization allows security bypass (CVE-2026-43515)
* tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication (CVE-2026-42498)
* tomcat-catalina: Apache Tomcat: Denial of Service due to uncontrolled resource allocation (CVE-2026-41284)
* tomcat-catalina: Apache Tomcat: Incorrect control flow in rewrite valve allows unexpected rule processing (CVE-2026-53404)
* tomcat-catalina: Apache Tomcat: Improper Authorization Allows Security Constraint Bypass (CVE-2026-55956)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat issued a security advisory for Red Hat Edge Manager version 1.2.1 addressing multiple high severity vulnerabilities including CVE-2026-6377. Red Hat Edge Manager is a solution for managing edge devices and container workloads with a focus on scalable and secure lifecycle management. The advisory does not provide specific details on the fixes or patches. No known exploits in the wild have been reported. The product supports large-scale edge deployments and integrates with other Red Hat platforms for enhanced management capabilities.
A flaw was found in the theme localization endpoints of the keycloak-services component, which is the core service responsible for authentication flows and theme management in Keycloak. The issue occurs because the system accepts arbitrary locale tags from unauthenticated requests and stores them in a permanent in-memory cache without limits. An attacker can exploit this by sending a large number of unique locale tags, eventually causing the server to run out of memory and crash.
Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enforcer fails to correctly normalize web addresses that contain special encoded characters, such as those representing semicolons or directory traversal segments. An authenticated user can use these encoded characters to trick the enforcer into applying a less restrictive security policy than intended, potentially gaining unauthorized access to sensitive administrative or private application endpoints.
A flaw was found in the SAML Redirect Binding implementation of Keycloak, an open-source identity and access management solution. The issue occurs because the custom DEFLATE compression and decompression helpers fail to release native zlib memory after use. An unauthenticated attacker can exploit this by sending repeated malformed SAML requests, leading to native memory exhaustion and a denial of service.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, specifically updating multiple python3.12 packages to address several vulnerabilities including CVE-2026-82049. The update includes packages for various architectures such as aarch64 and x86_64. No explicit patch versions prior to this update are stated. The advisory references multiple CVEs but focuses on python3.12 RPMs. No known exploits in the wild have been reported.
Multiple security vulnerabilities exist in the libevent library versions prior to 2.1.13 and 2.2.2-alpha, including denial of service, memory corruption, buffer overflow, request smuggling, arbitrary code execution, and access control bypass. These issues relate to how chunked HTTP trailers are processed and merged into request headers. Red Hat Hardened Images using affected libevent versions have been updated to address these vulnerabilities.
A heap-based buffer overflow vulnerability (CVE-2026-81665) exists in the Corosync Cluster Engine's totempg assembly buffer during fragmented message reassembly. This vulnerability affects multiple architectures and versions of Corosync used in Red Hat Enterprise Linux 8 and related products. Red Hat has issued security updates to address this flaw. The vulnerability is rated as high severity and could allow memory corruption during cluster communication message processing.
Multiple privilege escalation vulnerabilities affecting Intel processors are addressed by a security update to the ucode-intel microcode package. These vulnerabilities involve improper value and memory range handling in privileged CPU modes, specifically Ring 0 and System Management Mode (SMM). The update is available for SUSE and Red Hat Enterprise Linux distributions, including microcode releases up to 20260812. The vulnerabilities are identified as CVE-2025-31936 and CVE-2025-35973. The update fixes these issues by providing updated microcode and related packages.
Multiple security vulnerabilities were identified in the libevent library used in Red Hat Hardened Images and various Ubuntu LTS distributions. These vulnerabilities include denial of service, HTTP request smuggling, buffer overflows, access control bypass, and arbitrary code execution. The issues affect HTTP parsing, RPC data handling, and AF_UNIX socket processing. Official patches are available from Red Hat and Ubuntu, including extended support via Ubuntu Pro. Users are advised to apply these updates to mitigate the risks.
A medium severity vulnerability identified as CVE-2026-90439 affects Red Hat Hardened Images RPMs, specifically various nginx packages. Red Hat has released a security advisory with a patch update to address this issue. The update includes multiple nginx-related RPMs version 1.30.5-4.hum1 for different architectures. The vulnerability is related to a software defect categorized under CWE-787. A fix is available and users are advised to apply the update as per Red Hat's guidance.
Red Hat has issued a security advisory addressing vulnerabilities in the GNU coreutils package, specifically affecting the uniq and unexpand utilities. The uniq utility suffers from a denial of service and information disclosure vulnerability due to an out-of-bounds read with multibyte input (CVE-2026-56391). The unexpand utility is vulnerable to denial of service through crafted tab stop values (CVE-2026-56392). Updated coreutils packages have been released to mitigate these issues.
CVE-2026-92091 is a medium severity denial of service vulnerability in the jwcrypto library used by Red Hat Ansible Automation Platform 2. The issue arises from an inefficient algorithm in the JWK.import_key() function that validates the key_ops member with quadratic time complexity and no length bound. An unauthenticated remote attacker can exploit this by supplying a JWK with a large key_ops array, causing excessive CPU consumption and service disruption. No specific affected versions or patch information are provided by the vendor.
CVE-2026-92358 is a vulnerability in the Red Hat Build of Keycloak involving insufficient session expiration in the first broker login flow. A temporary proof created during account-linking is not properly cleared after linking or unlinking, allowing an attacker controlling the external identity to silently re-establish the link and gain unauthorized access. Exploitation requires a specific sequence of user actions within a short time window before the proof expires. The severity is rated medium with a CVSS score of 6.4.
Multiple security vulnerabilities affecting the Linux kernel have been addressed in a Red Hat security advisory. The issues include use-after-free, heap overflow, access control bypass, and validation errors across various kernel subsystems such as netfilter, Bluetooth, crypto, IPv6, USB serial drivers, and SCSI. These vulnerabilities could potentially be exploited to compromise system integrity or stability. A patch is available and should be applied to affected kernel versions. The advisory also includes bug fixes and enhancements unrelated to security. Users are advised to update and reboot their systems to apply the fixes.