This Red Hat security advisory addresses multiple vulnerabilities in the PHP 8.4 module for Red Hat Enterprise Linux 9. The issues include a denial of service via unbounded recursion in the SOAP parser (CVE-2026-91765), an out-of-memory bailout during request parsing that can lead to memory corruption and remote code execution (CVE-2026-109618), and a use-after-free vulnerability caused by stale request state retention during fatal error handling (CVE-2026-109619). These vulnerabilities have been rated with an important security impact by Red Hat. Updates are available to remediate these issues.
A denial of service vulnerability exists in the mod_auth_openidc module for Apache HTTP Server due to malformed state cookie parsing. This module enables Apache to function as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. The issue affects Red Hat Enterprise Linux 9 and has been addressed in an update.
A denial of service vulnerability exists in the python-jwcrypto library due to an O(n^2) duplicate check on an unbounded JWK key_ops array. This issue affects Red Hat Enterprise Linux 9 packages and has been rated as having moderate security impact. A security update is available to address this flaw.
Node.js is a software development platform for building fast and scalable network applications in the JavaScript programming language.
Security Fix(es):
* nodejs: Node.js: Permission Model bypass via `process.report.writeReport()` path misvalidation (CVE-2026-48617)
* nodejs: Node.js HTTP Agent: Information disclosure due to premature response acceptance (CVE-2026-48931)
* nodejs: Node.js: Denial of Service via unlimited HTTP/2 ORIGIN frames (CVE-2026-48619)
* nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling (CVE-2026-48930)
* nodejs: Node.js: Unauthorized file metadata modification (CVE-2026-48935)
* nodejs: Node.js WebCrypto: Denial of Service via large input to subtle.encrypt() (CVE-2026-48933)
* nodejs: Node.js: Certification validation bypass in TLS host verification (CVE-2026-48934)
* Node.js: Node.js: Trust-policy bypass due to hostname matching inconsistency (CVE-2026-48928)
* nodejs: Node.js: Information disclosure of proxy credentials via proxy tunnel error handling (CVE-2026-48615)
* nodejs: Node.js: Local server can be started without network permission via Permission API flaw (CVE-2026-48936)
* nodejs: Node.js: Authentication bypass due to TLS hostname handling and unicode dot separator mismatch (CVE-2026-48618)
* undici: undici: Information disclosure and Denial of Service via malformed Cache-Control directives (CVE-2026-13697)
* nodejs: Node.js: Unauthorized filesystem access due to Permission Model enforcement flaw (CVE-2026-58043)
* nodejs: HTTPS Agent TLS session reuse skips hostname verification (CVE-2026-58040)
* nodejs: Node.js: Permission Model flaw allows trace logs to bypass filesystem write restrictions (CVE-2026-56847)
* nodejs: Node.js: mTLS client identities can be reused due to HTTPS Agent connection flaw (CVE-2026-56850)
* nodejs: Information disclosure due to improper permission enforcement (CVE-2026-58039)
* nodejs: Node.js: Request smuggling via HTTP client header truncation (CVE-2026-58044)
* nodejs: Node.js: Denial of Service via DNS responses with excessive A records (CVE-2026-58042)
* nodejs: Node.js: Remote memory exhaustion via HTTP/2 retained header blocks (CVE-2026-56846)
* nodejs: Node.js: Denial of Service vulnerability (CVE-2026-58045)
* nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator (CVE-2026-58041)
* nodejs: Node.js: Heap-use-after-free in HTTP/2 handling can lead to denial of service (CVE-2026-56848)
* undici: undici: Authentication bypass via cross-origin cache poisoning due to missing origin isolation (CVE-2026-85152)
* undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect options (CVE-2026-84961)
* undici: undici: Denial of Service via unrequested WebSocket subprotocol (CVE-2026-19534)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A critical deserialization vulnerability (CWE-502) exists in React Server Components within react-server-dom-webpack, react-server-dom-parcel, and react-server-dom-turbopack packages in versions from 19.0.0 up to but not including fixed versions 19.0.9, 19.1.10, 19.2.9, and 19.3.1. This flaw allows unauthenticated remote code execution via crafted payloads in rare cases involving multiple typed arrays and attacker-controlled values. Applications not using React Server Components or relevant frameworks/bundlers are not affected. The issue is fixed in the stated versions.
This advisory addresses multiple security vulnerabilities in the Go programming language's crypto/tls and crypto/x509 packages, fixed in an update to the Delve debugger version 1.27 for Red Hat Enterprise Linux 9. The issues include denial of service via indefinite KeyUpdate messages and multiple ECH outer extension references, as well as man-in-the-middle attacks via untrusted intermediate certificates. The update mitigates these vulnerabilities by incorporating fixes in the underlying Go libraries used by Delve.
A security vulnerability (CVE-2026-93657) in the hickory-resolver component of rust-sequoia-sq allows DNSSEC validation bypass, enabling forged DNS records. This issue affects Red Hat Enterprise Linux 9 across multiple architectures. Red Hat has released an important security update to address this vulnerability.
Red Hat issued a security advisory for PostgreSQL 16 module in Red Hat Enterprise Linux 9 addressing two vulnerabilities: CVE-2026-73515 in PostGIS causing memory disclosure and denial of service via malformed FlatGeobuf buffer, and CVE-2026-103484 in pgvector allowing arbitrary code execution through an out-of-bounds write during IVFFlat index build. The update is rated as Important by Red Hat Product Security. No CVSS scores are provided in the advisory. The advisory includes updated packages to remediate these issues.
CVE-2024-36309 is a medium-severity vulnerability affecting AMD EPYC 9004 Series processors. It involves missing lock bit protection in the Northbridge IO (NBIO), which could allow a privileged attacker to exploit an intentionally disabled device for remapping attacks. This may impact data confidentiality, integrity, or availability. No patch or remediation information is currently available.
A path traversal vulnerability (CVE-2026-79655) exists in the sos package used in Red Hat Enterprise Linux 9. This flaw occurs during tar extraction in the sos clean process due to unvalidated symlink and hardlink targets, allowing arbitrary file writes. Red Hat has released an update that fixes this issue in sos version 4.11.2-7.el9_9. The vulnerability is rated as important by Red Hat Product Security.
Multiple security vulnerabilities have been identified in libreswan, an implementation of IPsec and IKE for Linux used to build secure VPN tunnels. The issues include an IKEv2 Use-After-Free bug when using IKE-over-TCP, a pre-authentication null pointer dereference in the EAP code, and a null pointer dereference in the PKCS#7 bundle with no certificates. These vulnerabilities have been rated as important by Red Hat and affect Red Hat Enterprise Linux 9. An update is available to address these issues.
A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager 7.4.0 through 7.4.5, FortiManager 7.2.0 through 7.2.8 may allow an unauthenticated attacker that can reach the FGFM port to execute code or commands via crafted FGFM packets.
The hissakdx-wix-ssr-callback-canary npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
The npm package 'selectlist-polyfill-lite' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by this package.
The npm package 'read-react-app-in' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone may not eliminate all malicious software, as the attacker may have gained full control of the system.
The npm package 'read-react-app-test' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eliminate the malicious software, as the attacker may have gained full control of the system.
The npm package 'read-react-app-out' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removing the package alone may not fully eradicate the malicious software, as the attacker may have established persistent control over the system.
Red Hat has issued a security advisory for OpenSSH addressing three vulnerabilities: a security bypass in SFTP due to command-line argument parsing (CVE-2026-59997), an undocumented GSSAPIStrictAcceptorCheck behavior affecting Windows Active Directory security (CVE-2026-59998), and a denial of service via excessive GSSAPI authentication attempts (CVE-2026-60000). These issues impact OpenSSH implementations on Red Hat Enterprise Linux 9 across multiple architectures. The update is rated as having moderate security impact.
Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU), potentially resulting in unauthorized debug access.
The solvit-cli npm package contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.