Tomcat is the servlet container that is used in the official Reference Implementation for the Java Servlet and JavaServer Pages technologies. The Java Servlet and JavaServer Pages specifications are developed by Sun under the Java Community Process. Tomcat is developed in an open and participatory environment and released under the Apache Software License version 2.0. Tomcat is intended to be a collaboration of the best-of-breed developers from around the world.
Security Fix(es):
* Apache Tomcat: Apache Tomcat: Information disclosure via Padding Oracle vulnerability in EncryptInterceptor (CVE-2026-29146)
* Apache Tomcat: Apache Tomcat: Missing Encryption of Sensitive Data due to EncryptInterceptor bypass (CVE-2026-34486)
Bug Fix(es) and Enhancement(s):
* Remove tomcat clustering JAR from RPM builds (JIRA:RHEL-185571)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities have been identified in the unbound DNS resolver packages used in Red Hat Enterprise Linux 9. These include denial of service issues caused by excessive EDNS options, large DNS resource record sets, and degraded resolution performance, as well as a cache manipulation vulnerability via 'ghost domain names'. Red Hat has released security updates addressing these issues.
The cert-manager Operator for Red Hat OpenShift builds on top of Kubernetes, introducing certificate authorities
and certificates as first-class resource types in the Kubernetes API. This makes it possible to provide
certificates-as-a-service to developers working within your Kubernetes cluster.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout (CVE-2024-27398)
* kernel: Bluetooth: SCO: Fix UAF on sco_sock_timeout (CVE-2024-50125)
* kernel: ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (CVE-2025-68183)
* kernel: Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CVE-2026-31408)
* kernel: netfilter: nf_conntrack_helper: pass helper to expect cleanup (CVE-2026-43027)
* kernel: ALSA: usb-audio: Add sanity check for OOB writes at silencing (CVE-2026-43279)
* kernel: dlm: validate length in dlm_search_rsb_tree (CVE-2026-43125)
* kernel: gfs2: Fix use-after-free in iomap inline data write path (CVE-2026-45984)
* kernel: wifi: mac80211: drop stray 'static' from fast-RX rx_result (CVE-2026-46152)
* kernel: RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CVE-2026-46189)
Bug Fix(es) and Enhancement(s):
* Kernel panic while shutting down ice driver due to use-after-free [rhel-9.4.z] (JIRA:RHEL-177523)
* crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode [rhel-9.4.z] (JIRA:RHEL-182538)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A security vulnerability (CVE-2026-9800) exists in the Keycloak Policy Enforcer component of the Red Hat build of Quarkus 3.33.2.SP2. This flaw allows any authenticated user to bypass all authorization policies, including role, scope, and UMA permission checks, by manipulating the request URL to include the configured access-denied page path. This results in unauthorized access to protected resources. Red Hat has released security updates in Keycloak 26.4.13 addressing this and multiple other vulnerabilities. Users are advised to apply these updates to mitigate the risk.
Red Hat Advanced Cluster Security for Kubernetes (RHACS) versions 4.10 up to but not including 4.11.1 contain multiple security vulnerabilities and bugs. These issues are addressed in the 4.11.1 update, which includes security patches, bug fixes, and performance improvements. Users are advised to upgrade to RHACS 4.11.1 to mitigate these vulnerabilities.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: eventpoll: defer struct eventpoll free to RCU grace period (CVE-2026-43074)
* kernel: net: mana: Fix double destroy_workqueue on service rescan PCI path (CVE-2026-43276)
* kernel: net/ipv6: ioam6: prevent schema length wraparound in trace fill (CVE-2026-43341)
* kernel: smb/client: fix out-of-bounds read in smb2_compound_op() (CVE-2026-46155)
* kernel: eventpoll: fix ep_remove struct eventpoll / struct file UAF (CVE-2026-46242)
* kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CVE-2026-46259)
Bug Fix(es) and Enhancement(s):
* CNB103: net: page_pool: avoid false positive warning if NAPI was never added [rhel-10.2.z] (JIRA:RHEL-162140)
* [RHEL 10] Bonding reports unknown speed/duplex for tg3 interface [rhel-10.2.z] (JIRA:RHEL-182770)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel live patch module for kernel version 5.14.0-570.17.1.el9_6. The update fixes a privilege escalation or denial of service issue in the KVM component due to improper shadow page table entry handling (CVE-2026-23401), a heap overflow in the NFSv4.0 LOCK replay cache (CVE-2026-31402), and a use-after-free vulnerability in the bonding driver that can lead to denial of service (CVE-2026-31419). The advisory targets Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. A security update is available to address these issues.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: tcp: fix potential race in tcp_v6_syn_recv_sock() (CVE-2026-43198)
* kernel: RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CVE-2026-46181)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The buildah package provides a tool for facilitating building OCI container images. Among other things, buildah enables you to: Create a working container, either from scratch or using an image as a starting point; Create an image, either from a working container or using the instructions in a Dockerfile; Build both Docker and OCI images.
Security Fix(es):
* golang.org/x/crypto/ssh: golang: golang.org/x/crypto/ssh: Denial of Service via crafted SSH certificate (CVE-2026-39835)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted public key with excessive parameters (CVE-2026-39829)
* golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via resource leak from unsolicited SSH responses (CVE-2026-39830)
* golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: Security bypass due to improper handling of key restrictions (CVE-2026-39832)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat Directory Server 389-ds-base contains heap buffer overflow vulnerabilities related to SASL packet processing. These vulnerabilities affect Red Hat Enterprise Linux 9 and related CodeReady Linux Builder variants on multiple architectures including x86_64, s390x, ppc64le, and aarch64. The issues are due to a heap buffer overflow in sasl_io_recv() via padded SASL UNBIND (CVE-2026-11610) and an integer overflow in SASL packet length that bypasses size limits leading to a heap buffer overflow (CVE-2026-11774).