Multiple security vulnerabilities have been identified and fixed in the Linux kernel packages used by Red Hat. These include issues such as use-after-free, overflow, double-free, and protocol handling errors affecting various kernel subsystems including Bluetooth, exFAT, key management, SMB client, iomap, and IPv6 networking. The vulnerabilities could potentially allow local attackers to escalate privileges or cause system instability. A patch is available to address these issues.
Red Hat Satellite 6.16.13 for RHEL 8 and 9 addresses multiple security vulnerabilities affecting components such as jackson-databind, ruby-jwt, python-aiohttp, Eclipse Jetty, and jackson-core. These vulnerabilities include arbitrary code execution, authentication bypass, denial of service, HTTP request smuggling, and information disclosure. The update fixes these issues and also resolves a bug related to content view filtering.
A vulnerability in Perl's regular expression engine used in Red Hat Hardened Images involves a signed 32-bit integer overflow in the superlinear cache size calculation. This can lead to out-of-bounds heap memory reads and writes during regex matching. Exploitation requires a very large input (~273 MiB) matched against a complex pattern with at least 15 participating WHILEM nodes. The primary impact is denial of service due to process crashes; arbitrary code execution has not been demonstrated. Red Hat has deferred fixing this issue due to its complexity and limited exposure. Mitigations include limiting untrusted input size and avoiding complex regex patterns on untrusted data.
CVE-2026-84185 is a medium severity vulnerability in the jwcrypto library used by Red Hat Ansible Automation Platform 2. The flaw involves improper verification of cryptographic signatures in JSON Web Signatures (JWS) when multiple keys are used. Due to a coding error, the library may accept a signature from any valid key in the set rather than verifying the specific key ID (kid). This can allow an attacker with a valid key to bypass authorization checks that rely on the key ID to identify tenants or users.
GitPython versions up to and including 3.1.50 contain a vulnerability in the Repo.clone_from() method where environment variables in the remote URL are expanded before cloning. This behavior allows an attacker who controls the URL to embed environment variable tokens that are expanded server-side and exfiltrated to an attacker-controlled host. A fix for this issue is available.
Red Hat Quay versions from 3.15.0 up to but not including 3.15.8 contain multiple high severity security vulnerabilities, including CVE-2026-15927. Red Hat has released version 3.15.8 to address these issues. There are no known exploits reported in the wild. Users are advised to apply the official update to remediate these vulnerabilities.
A Server-Side Template Injection (SSTI) vulnerability (CVE-2026-12894) exists in the ReflectionValueResolver component of the Qute template engine used by Red Hat Build of Apache Camel 4.18 for Quarkus. This flaw allows an attacker who can influence template text to bypass restrictions and execute unauthorized commands on the server. Red Hat has released an update (RHBQ 3.33.3.SP1) that addresses this and other vulnerabilities. The update is rated as important by Red Hat Product Security.
Red Hat has released a security advisory for Red Hat Hardened Images RPMs, specifically updating the grafana13.1 package to version 13.1.3-0.5.hum1. This update addresses multiple security vulnerabilities including CVE-2026-8595 and others. The advisory covers both aarch64 and x86_64 architectures. The update is a bug fix and enhancement release.
A vulnerability in the Node.js qs library causes qs.stringify to throw a TypeError when serializing an object whose own constructor property has a truthy, non-callable isBuffer member. Red Hat has issued an advisory for Red Hat Hardened Images RPMs, including an update to the grafana13.2 package, addressing this and other vulnerabilities. The update is available and should be applied to affected systems. No active exploitation has been reported.
CVE-2026-71221 is a stack out-of-bounds write vulnerability in the gfs2-utils component of Red Hat Enterprise Linux 7. The flaw occurs because the height value from on-disk inode metadata is used as a loop bound without proper bounds checking in the savemeta function. This leads to a stack buffer overflow, which may allow arbitrary code execution when processing specially crafted GFS2 filesystem images. The vulnerability has a high severity score of 7.0 and requires local access with high attack complexity and no privileges. The vendor advisory from Red Hat is available but does not explicitly state patch status in the provided data.
CVE-2026-71220 is a high-severity stack out-of-bounds write vulnerability in gfs2-utils on Red Hat Enterprise Linux 7. The flaw occurs in the gfs2_edit tool where the di_height field from on-disk inode metadata is used as an array index without bounds checking. This leads to a stack buffer overflow that could allow arbitrary code execution when processing specially crafted GFS2 filesystem images.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing multiple vulnerabilities in util-linux packages affecting components such as libblkid, libfdisk, liblastlog2, libmount, libsmartcols, libuuid, and python3-libmount on aarch64 and x86_64 architectures. The advisory provides updated RPM packages to remediate these issues. No active exploits are known in the wild at this time.
A stack overflow vulnerability was found in gfs2-utils. The metadata walk code in metawalk.c uses alloca() with an untrusted inode height value from on-disk metadata without bounds validation, causing stack exhaustion and a denial of service when processing crafted GFS2 filesystem images.
A heap out-of-bounds read vulnerability was found in gfs2-utils. The ea_num_ptrs field from on-disk extended attribute metadata is consumed without bounds validation, causing a heap buffer over-read that may disclose sensitive memory contents or cause a crash when processing crafted GFS2 filesystem images.
A stack overflow vulnerability was found in gfs2-utils. The hash table traversal code in metawalk.c uses alloca() with an exponentially-derived size from the untrusted on-disk di_depth field without bounds validation. A crafted GFS2 filesystem image with a large di_depth value causes stack exhaustion and a denial of service when processed by fsck.gfs2, gfs2_edit, or savemeta.
A use-after-free vulnerability (CVE-2025-11234) exists in the qemu-kvm component's VNC WebSocket handshake in Red Hat Enterprise Linux 9. This vulnerability is rated moderate severity by Red Hat Product Security and is addressed in the Red Hat OpenShift Container Platform 4.12.97 update. The update fixes the issue specifically in qemu-kvm but does not include additional security fixes for OpenShift itself. Users running affected versions of Red Hat Enterprise Linux 9 are advised to apply the update to remediate the vulnerability.
Red Hat has issued a security advisory for an important update to Erlang packages used in Red Hat OpenStack Services on OpenShift 18.0. The update addresses two security vulnerabilities in the Erlang OTP public_key module: certificate chain forgery due to improper trust chain validation (CVE-2026-42789) and certificate validation bypass allowing hostname spoofing (CVE-2026-42790). These issues could undermine the security of certificate validation processes. A patch is available and should be applied to affected systems.
A NULL pointer dereference flaw was found in GStreamer's RTSP support library. The vulnerability occurs while parsing an Authorization or WWW-Authenticate header that uses Digest authentication. Specially crafted whitespace placement around a parameter's terminator can cause an internal length calculation to underflow, leading to a crash of the process parsing the header. On an RTSP server this can be triggered by a remote, unauthenticated attacker sending a single malformed request when the server has authentication enabled; the same flaw can also be triggered against an RTSP client by a malicious or compromised RTSP server. Successful exploitation results in a denial of service (application crash) and has no confirmed impact on confidentiality or integrity.