Threat database

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: xfrm: hold dev ref until after transport_finish NF_HOOK (CVE-2026-31663) * kernel: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (CVE-2026-53239) * kernel: ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate() (CVE-2026-63921) * kernel: xfrm: input: hold netns during deferred transport reinjection (CVE-2026-63919) * kernel: ip6: vti: Use ip6_tnl.net in vti6_changelink() (CVE-2026-63917) * kernel: xfrm: fix stale skb->prev after async crypto steals a GSO segment (CVE-2026-68426) * kernel: nvmet-auth: reject short AUTH_RECEIVE buffers (CVE-2026-72130) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple critical security vulnerabilities affecting Dovecot 2.4.4 and related versions in Red Hat Enterprise Linux 8 have been addressed in an update to version 2.3.16-16.el8_10. These vulnerabilities include denial of service, authentication bypass, and remote code execution issues across various Dovecot components such as IMAP, ManageSieve, and sieve scripts. The update fixes critical issues including a use-after-free leading to arbitrary code execution and several denial of service vulnerabilities caused by malformed inputs or resource exhaustion.

A vulnerability in Flatpak before version 1.18.1 allows a malicious sandboxed application to gain arbitrary read and write access to host files. This occurs due to missing symlink protection in app data directories created within the sandbox, which can be exploited to redirect directory mounts to arbitrary host locations. This flaw can potentially lead to arbitrary code execution on the host system.

This release of the Red Hat OpenShift distributed tracing platform (Tempo) provides security improvements. Breaking changes: * None Deprecations: * None Technology Preview features: * None Enhancements: * None Bug fixes: * Punycode labels are no longer processed incorrectly: Before this update, the golang.org/x/net/idna package incorrectly processed certain Punycode labels during internationalized domain name conversion. As a consequence, an attacker could craft a domain name that resolved to a different host than the one that was validated, which could lead to privilege escalation. With this update, Punycode labels are processed correctly. As a result, converted domain names match the validated input. For more information, see https://access.redhat.com/security/cve/cve-2026-39821. * The os.Root type no longer follows symbolic links outside of its root: Before this update, the Go os package did not correctly restrict some operations performed through an os.Root value. As a consequence, an attacker who controlled a symbolic link inside the root directory could traverse outside of it and access files elsewhere on the file system. With this update, operations on an os.Root value are correctly confined to the root directory. As a result, symbolic links can no longer be used to escape the root. For more information, see https://access.redhat.com/security/cve/cve-2026-39822. * The ungetwc function no longer mishandles specific wide character encodings: Before this update, the ungetwc function in the GNU C Library mishandled certain wide character encodings. As a consequence, an application could disclose information or terminate unexpectedly. With this update, the wide character encodings are handled correctly. As a result, the affected applications no longer disclose information or crash. For more information, see https://access.redhat.com/security/cve/cve-2026-5928. * TSIG record processing no longer writes outside the allocated buffer: Before this update, the DNS resolver in the GNU C Library did not correctly validate buffer boundaries when it processed TSIG records. As a consequence, a crafted TSIG record could trigger an out-of-bounds write and cause memory corruption. With this update, the buffer boundaries are validated correctly. As a result, TSIG record processing no longer writes outside the allocated buffer. For more information, see https://access.redhat.com/security/cve/cve-2026-5435. * Crafted DNS responses no longer cause a crash or an uninitialized memory read: Before this update, the DNS resolver in the GNU C Library did not correctly handle malformed responses. As a consequence, a crafted DNS response could cause an application to read uninitialized memory or terminate unexpectedly. With this update, malformed responses are handled correctly. As a result, the affected applications no longer crash or read uninitialized memory. For more information, see https://access.redhat.com/security/cve/cve-2026-6238. Known issues: * None

Red Hat Quay versions prior to 3.9.26 contain multiple security vulnerabilities affecting the logging subsystem for Red Hat OpenShift and related components. These issues are addressed in the Red Hat Quay 3.9.26 update. The advisory emphasizes the importance of applying this update to remediate the vulnerabilities.

Multiple security vulnerabilities have been identified in the goose component of Red Hat Enterprise Linux 10. These include arbitrary command execution via malicious Git configuration, token impersonation due to missing OAuth resource field validation, denial of service through unauthenticated session table leak, and denial of service via crafted Certificate Revocation List. A security update is available that addresses these issues by updating goose to version 1.45.0-1.el10_2. The update is applicable to Red Hat Enterprise Linux 10 on multiple architectures including x86_64, s390x, ppc64le, and aarch64.

Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fix(es): * python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory (CVE-2026-11940) * python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations (CVE-2026-15308) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A heap-based buffer overflow vulnerability exists in the libxml2 library's xmlXPtrEval function due to xpointer length saturation (CVE-2026-86142). This vulnerability affects Red Hat Enterprise Linux 8 across multiple architectures. Red Hat has issued a security advisory with an update to address this moderate severity issue. The advisory provides updated libxml2 packages to fix the flaw.

Red Hat Ansible Automation Platform 2.2 includes updated Ansible plug-ins for the Red Hat Developer Hub that enhance user experience and automation capabilities. A security advisory has been issued covering multiple CVEs including CVE-2026-47686. The advisory marks the severity as critical but does not provide detailed vulnerability descriptions, affected versions, or patches. No fixes or patches are currently available according to the vendor advisory.

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fix(es): * curl: curl: Cookie injection via malicious HTTP server using super cookies (CVE-2026-8924) * curl: curl: Information disclosure via incorrect Digest authentication header reuse (CVE-2026-11856) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to qt6 packages. The advisory addresses vulnerabilities identified by CVE-2026-95509 and CVE-2026-16762. The update includes bug fixes and enhancements for qt6-filesystem and related macros across multiple architectures. No specific affected versions are detailed in the advisory. The update is available and should be applied as per Red Hat's instructions.

The Berkeley Internet Name Domain (BIND) is an implementation of the Domain Name System (DNS) protocols. BIND includes a DNS server (named); a resolver library (routines for applications to use when interfacing with DNS); and tools for verifying that the DNS server is operating correctly. Security Fix(es): * bind: BIND 9 server memory exhaustion during GSS-API TKEY negotiation (CVE-2026-3039) * bind: BIND: Denial of Service via specially crafted DNS messages (CVE-2026-5946) * bind: bind9: DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) * bind: bind9: Potential memory usage beyond configured limits (CVE-2026-11622) * bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) * bind: bind9: Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) * bind: bind9: Incorrect acceptance of NSEC3 records (CVE-2026-10723) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Multiple security vulnerabilities have been identified in the xorg-x11-server-Xwayland component used in Red Hat Enterprise Linux 8. These include several arbitrary code execution flaws, privilege escalation, use-after-free, double-free, out-of-bounds write, and heap-based buffer overflow issues. The vulnerabilities affect various versions of the xorg-x11-server-Xwayland package. Red Hat has released security updates addressing these issues.

Red Hat has issued a security advisory for a bug fix and enhancement update to Red Hat Hardened Images RPMs, specifically updating curl and related libcurl packages. The advisory addresses CVE-2026-92392, classified with high severity. The update includes curl version 8.23.0-0.1.hum1 and corresponding libcurl packages for multiple architectures. No specific details about the vulnerability or its exploitation are provided in the advisory.

Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to libpng packages. The update addresses multiple security issues identified by several CVEs. The advisory provides updated RPM versions for various architectures. No explicit details on the vulnerabilities or their exploitation are provided. The update is available and should be applied to affected systems.

A use-after-free vulnerability (CVE-2026-74705) exists in the Linux kernel's UDP tunnel segmentation code, affecting various Red Hat kernel versions. This flaw could potentially be exploited to cause system instability or other impacts. Red Hat has released patches addressing this issue. Users should apply the official kernel updates and reboot to ensure remediation.

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fix(es): * kernel: Linux kernel: xfrm single-frag length not properly limited () * kernel: scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CVE-2026-46149) * kernel: blk-cgroup: fix UAF in __blkcg_rstat_flush() (CVE-2026-63802) * kernel: udp: fix potential use-after-free in tunnel segmentation (CVE-2026-74705) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel, including CVE-2026-72129 and CVE-2026-74705. These issues involve improper handling of inline data with a nonzero offset in the nvmet-rdma subsystem and a potential use-after-free vulnerability in UDP tunnel segmentation. The vulnerabilities could allow local attackers to bypass memory protections or escalate privileges. A patch is available to remediate these issues.

Red Hat has released a security advisory for Red Hat Hardened Images RPMs, including updates to golang1.27 packages. The update addresses bugs and enhancements related to CVE-2026-94444 and CVE-2026-94447. No specific details about the vulnerabilities or their impact are provided in the advisory. The update is available for multiple architectures including aarch64 and x86_64.