Threat database

CVE-2026-5680 is a vulnerability in Red Hat JBoss Enterprise Application Platform 8.1.8.GA affecting the Undertow component. It allows a remote attacker to cause excessive memory consumption by sending specially crafted WebSocket messages with permessage-deflate negotiated. This can lead to a denial of service (DoS) condition due to unbounded resource allocation in the PerMessageDeflateFunction.largerBuffer() method.

A flaw was found in rsyslog. An unauthenticated remote attacker can trigger a heap buffer overflow in the RainerScript `replace()` function by sending specially crafted syslog messages. This vulnerability arises from an incorrect buffer size calculation during string replacement, causing memory corruption. Successful exploitation can lead to a denial of service (DoS) for the affected system.

A use-after-free vulnerability (CVE-2026-74581) exists in the Linux kernel's IPv6 networking code, specifically in fib6_rule_suppress due to a stale pointer. This vulnerability affects various Red Hat Enterprise Linux kernel versions. A security update addressing this issue is available and should be applied with a system reboot. The vulnerability is rated as high severity by Red Hat Product Security.

A medium severity vulnerability (CVE-2026-3446) was found in the Python base64 module used in Red Hat Hardened Images RPMs. The flaw causes base64 decoding functions to stop prematurely at the first padding character, leading to incomplete data processing and potential data integrity issues. Red Hat has issued updates for python3.12 packages to address this issue.

CVE-2026-81668 is a medium severity authorization bypass vulnerability in Red Hat Satellite 6's Katello component. It allows an authenticated user with low privileges in one organization to access and modify Content View Filter rules in another organization by supplying the filter's identifier. This can lead to unauthorized disclosure and modification of filter-rule information.

CVE-2026-81658 is a vulnerability in Red Hat Satellite 6's Foreman component where the template revision endpoint fails to enforce object-level authorization. This allows an authenticated user with low privileges and a template-related permission to access historical template contents from other organizations or locations by supplying an audit ID. These templates may contain sensitive information such as credentials or secrets. The REST API revision endpoints are not affected as they enforce proper authorization. No patch or workaround is currently available, and Red Hat advises applying security updates once released.

CVE-2026-80158 is a vulnerability in the ipa_getkeytab module of the community.general Ansible collection used by Red Hat Ceph Storage 5. The bind_pw parameter, which supplies the LDAP simple-bind password, is not marked as no_log, causing the password to be exposed in system logs, job outputs, and process listings. This exposure allows local users with access to these logs or process information to obtain sensitive directory bind credentials.

Red Hat Advanced Cluster Management for Kubernetes versions 2.16.0 through 2.16.4 contain multiple security vulnerabilities addressed in the 2.16.4 update. The update includes security fixes, bug fixes, and enhancements. The overall security impact is rated as important with a high severity level. Users are advised to apply this update after ensuring all previous relevant errata are applied. No specific CVSS scores are provided for the individual vulnerabilities.

### Impact When following cross-origin redirects for requests made using urllib3’s high-level APIs, such as `urllib3.request()`, `PoolManager.request()`, and `ProxyManager.request()`, sensitive headers — `Authorization`, `Cookie`, and `Proxy-Authorization` (defined in `Retry.DEFAULT_REMOVE_HEADERS_ON_REDIRECT`) — are stripped by default, as expected. However, cross-origin redirects followed from the low-level API via `ProxyManager.connection_from_url().urlopen(..., assert_same_host=False)` still forward these sensitive headers. ### Affected usage Applications and libraries using urllib3 versions earlier than 2.7.0 may be affected if they allow cross-origin redirects while making requests through `HTTPConnection.urlopen()` instances created via `ProxyManager.connection_from_url()`. ### Remediation Upgrade to urllib3 version 2.7.0 or later, in which sensitive headers are stripped from redirects followed by `HTTPConnection`. If upgrading is not immediately possible, avoid using this low-level redirect flow for cross-origin redirects. If appropriate for your use case, switch to `ProxyManager.request()`.

A critical path traversal and arbitrary file overwrite vulnerability exists in Argo Workflows within Red Hat OpenShift AI 3.5. An attacker with workflow submission privileges can submit a malicious archive containing symbolic links that bypass extraction directory restrictions, allowing overwriting of files inside the workflow pod. This can lead to arbitrary command execution during pod startup. The impact is limited to the compromised pod and does not affect the host system. Currently, no official fix or mitigation meeting Red Hat's deployment or stability standards is available.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.19.44. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:57401 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ Security Fix(es): * kernel: xen: AMD Zen 2 Processors: Privilege escalation via improper CPU cache isolation (CVE-2025-54518) * gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment (CVE-2026-33845) * gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) * kernel: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CVE-2026-43112) * gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison (CVE-2026-3833) * systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111) * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.19 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html-single/updating_clusters/index#updating-cluster-cli.

CVE-2026-44222 is a denial of service vulnerability in vLLM, an inference engine for large language models, as integrated into Red Hat AI Inference Server 3.3.6 (Spyre). Unauthenticated attackers can cause worker termination by submitting malformed multimodal inputs or text prompts with special tokens, disrupting AI inference workloads. No fix is currently available that meets Red Hat's criteria for deployment and stability.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.18.54. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:57482 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ Security Fix(es): * samba: Missing access check on reparse point operations (CVE-2026-1933) * samba: group policy certificate enrollment uses http:// without validation (CVE-2026-3012) * samba: Remote Code Execution in SAMR (CVE-2026-4408) * sssd: sssd: sudo LDAP provider searches entire directory tree for sudoRole objects by default, enabling privilege escalation (CVE-2026-14474) * gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment (CVE-2026-33845) * gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly (CVE-2026-33846) * vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982) * gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability (CVE-2026-42009) * gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010) * kernel: net: openvswitch: reject oversized nested action attrs (CVE-2026-64531) * samba: vfs_worm does not block directory modification (CVE-2026-2340) * gnutls: gnutls: Information disclosure via heap overread in RSA key exchange (CVE-2026-5260) * glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width (CVE-2026-5450) * sssd: sssd: GPO cache path traversal via unsanitized gPCFileSysPath allows Kerberos authentication bypass (CVE-2026-14476) * vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177) * vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411) * gnutls: gnutls: Security bypass due to incorrect name constraint handling (CVE-2026-42011) * gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name (CVE-2026-42013) * vim: command injection when decompressing .tgz archives (CVE-2026-46483) * libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data (CVE-2026-48864) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.18 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html-single/updating_clusters/index#updating-cluster-cli.

This security update provides a functional equivalent of RHSA-2026:58563. The original Red Hat(R) advisory is available from the Red Hat web site at https://access.redhat.com/errata/RHSA-2026:58563.