Libreswan, an IPsec and IKE implementation for Linux, has multiple security vulnerabilities including a Use-After-Free bug in IKEv2 when using IKE-over-TCP (CVE-2026-94453). These issues affect versions prior to 4.15-11.el9_8. The vulnerabilities could impact the secure tunneling capabilities of VPNs relying on Libreswan. A security update fixing these issues is available from Red Hat.
A moderate severity vulnerability (CVE-2026-19662) affects BIND 9.18, a widely used DNS server implementation. The flaw allows a denial of service (DoS) attack via crafted DNSSEC responses. This issue is fixed in version 9.18.29-14.el9_8.11. Users of affected versions should apply the security update provided by Red Hat to mitigate the risk.
A security update for Python 3.9 addresses multiple vulnerabilities including an arbitrary file deletion via a race condition during temporary directory cleanup (CVE-2026-12345), a certificate verification bypass due to missing server_hostname validation in SSLContext.wrap_bio() (CVE-2026-19553), and a use-after-free issue in server-side SSLContext when sni_callback switches contexts (CVE-2026-19445). These issues affect Python versions prior to 3.9.25-7.el9_8.6 and are rated as important by Red Hat. The update fixes these vulnerabilities to prevent potential exploitation.
Multiple vulnerabilities in freeipmi, an IPMI remote console and system management software, allow arbitrary code execution and denial of service via stack-based buffer overflows and malformed Fujitsu System Event Log responses. These issues affect versions prior to 1.6.20-1.el9_8. A security update to version 1.6.20-1.el9_8 addresses these vulnerabilities.
Two security vulnerabilities in Flatpak allow arbitrary file deletion and arbitrary file write in root context via path traversal in specific deploy directories. These issues affect Flatpak versions prior to 1.12.9-4.el9_8.6 and have been addressed in the fixed version 1.12.9-4.el9_8.6. The vulnerabilities were rated as important by Red Hat and are relevant to multiple Red Hat Enterprise Linux 9 variants and related products.
A denial of service vulnerability exists in XZ Utils due to a buffer overflow in index decoding. This flaw affects versions of the xz utility prior to 5.2.5-8.el9_8.1. The issue has been rated as moderate severity by Red Hat and is fixed in version 5.2.5-8.el9_8.1.
Lrzsz is a modified zmodem/ymodem/xmodem package for Linux systems. A security update addresses an arbitrary file overwrite vulnerability via absolute path traversal in restricted mode (CVE-2026-105840). This update also fixes an arbitrary command execution vulnerability via crafted file names in pipe mode (CVE-2026-105841) and resolves a segfault issue. The vulnerabilities affect versions prior to 0.12.20-58.el9_8.
An information disclosure vulnerability (CVE-2026-17183) exists in the Unified Alerting component of Grafana, an open source metrics dashboard and graph editor. This vulnerability could allow unauthorized access to sensitive information. A security update fixing this issue is available in Grafana version 10.2.6-23.el9_8.7. The update is rated critical by Red Hat Product Security. No known exploits in the wild have been reported.
A security update for the Linux kernel addresses multiple vulnerabilities including a NULL pointer exception caused by CALIPSO on IPv4 sockets (CVE-2025-22063). The update also fixes other kernel-related security issues and bugs. The affected kernel versions are those prior to 5.14.0-687.60.1.el9_8. Red Hat has released a patch that must be applied and requires a system reboot. The update is rated as having an Important security impact by Red Hat.
A security update for glib2 addresses a buffer underflow vulnerability in the GVariant parser that leads to heap corruption (CVE-2025-14087), as well as an integer overflow in GLib GIO attribute escaping causing a heap buffer overflow (CVE-2025-14512). These issues affect versions of glib2 prior to 2.68.4-18.el9_7.2. The update is rated as having a moderate security impact by Red Hat.
The freeipmi packages contain an Intelligent Platform Management Interface (IPMI) remote console and system management software based on the IPMI specification.
Security Fix(es):
* freeipmi: buffer overflows on response messages via ipmi-oem (CVE-2026-33554)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.
Security Fix(es):
* pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The libsoup packages provide an HTTP client and server library for GNOME.
Security Fix(es):
* libsoup: libsoup: Information disclosure via cleartext transmission of cookies during HTTPS tunnel establishment (CVE-2026-5119)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The corosync packages provide the Corosync Cluster Engine and C APIs for AlmaLinux cluster software.
Security Fix(es):
* corosync: Corosync: Denial of Service and information disclosure via crafted UDP packet (CVE-2026-35091)
* corosync: Corosync: Denial of Service via integer overflow in join message validation (CVE-2026-35092)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Dovecot is an IMAP server for Linux and other UNIX-like systems, written primarily with security in mind. It also contains a small POP3 server, and supports e-mail in either the maildir or mbox format. The SQL drivers and authentication plug-ins are provided as subpackages.
Security Fix(es):
* dovecot: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (CVE-2025-59032)
* dovecot: denial of service via crafted message before authentication (CVE-2026-27858)
* dovecot: denial of service via specially crafted NOOP command (CVE-2026-27857)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems.
Security Fix(es):
* tornado-python: Tornado: Denial of Service via large multipart bodies (CVE-2026-31958)
* tornado: Tornado: Cookie attribute injection due to improper handling of cookie arguments (CVE-2026-35536)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
The systemd packages contain systemd, a system and service manager for Linux, compatible with the SysV and LSB init scripts. It provides aggressive parallelism capabilities, uses socket and D-Bus activation for starting services, offers on-demand starting of daemons, and keeps track of processes using Linux cgroups. In addition, it supports snapshotting and restoring of the system state, maintains mount and automount points, and implements an elaborate transactional dependency-based service control logic. It can also work as a drop-in replacement for sysvinit.
Security Fix(es):
* systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data (CVE-2026-29111)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A local binary for building customized OS artifacts such as VM images and OSTree commits. Uses osbuild under the hood.
Security Fix(es):
* net/url: Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.