A critical remote code execution vulnerability (CVE-2026-109618) affects PHP versions prior to 8.3.36-1.oe2403sp3. The flaw arises from improper handling of out-of-memory errors using longjmp(), which can leave request memory uninitialized and lead to execution of arbitrary code. Additionally, related global state management issues (CVE-2026-109619) can cause stale pointers to freed memory, further enabling remote code execution. This vulnerability impacts PHP's mod_php module used with Apache HTTP Server. A security fix is available to address these issues.
A use-after-free vulnerability (CVE-2026-109619) exists in PHP's fatal error handling, where stale request state is retained. This flaw affects PHP as packaged in Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat has issued a security update to address this issue. The vulnerability is rated as having an important security impact by Red Hat Product Security.
A critical security update has been issued for the ca-certificates package in Red Hat Enterprise Linux 9.6. The update distrusts eMudhra intermediate Certificate Authority (CA) certificates due to security concerns identified in CVE-2026-114406. This package contains CA certificates used in the Internet Public Key Infrastructure (PKI) to validate SSL/TLS connections. The update is available for multiple Red Hat Enterprise Linux 9.6 variants and architectures. Users should apply the update to ensure that untrusted certificates from eMudhra intermediates are no longer accepted.
CVE-2026-115486 is a high severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. It involves an out-of-bounds read in the IPv6 Neighbor Discovery handler due to accessing link-layer address options at a fixed offset without verifying their presence. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses, allowing an attacker on the same network segment to poison the ARP table and redirect network traffic.
CVE-2026-115485 is a medium severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. The DHCPv6 option parser improperly calls strlen() on raw network data without verifying a NUL terminator, leading to out-of-bounds reads. This flaw can cause daemon crashes, minor heap overwrites, or corruption of the iSCSI initiator name. An attacker on the same network segment can exploit this by sending a crafted DHCPv6 Advertise message.
CVE-2026-115484 is a high-severity vulnerability in the iscsiuio component of open-iscsi on Red Hat Enterprise Linux 10. The DHCPv4 option parser miscalculates the length of options data, leading to an out-of-bounds read beyond the allocated buffer. This flaw allows an attacker on the same network segment to send a crafted DHCP response that can crash the daemon or corrupt its network configuration.
A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.
CVE-2026-115221 is a medium severity vulnerability in FreeIPA on Red Hat Enterprise Linux 10. It involves an incorrect authorization check that allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. The flaw arises because ownership verification relies solely on matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. This can enable an enrolled host to disrupt services by revoking certificates belonging to other entities.
CVE-2026-115424 is a vulnerability in the OpenShift client 'oc' used in Red Hat OpenShift Container Platform 4. The flaw occurs during extraction of container image layers with the 'oc image extract' command, where symbolic and hard link targets are not properly sanitized if they point to absolute paths or sibling directories outside the extraction destination. This allows an attacker supplying a malicious container image to write files to arbitrary locations on the host filesystem with the privileges of the user running the command, potentially modifying files outside the intended directory.
Red Hat has issued a critical security update for the grafana-pcp plugin used in Red Hat Enterprise Linux 9.8 Extended Update Support. The update addresses three vulnerabilities: a denial of service via multiple ECH outer extension references (CVE-2026-97031), a denial of service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669), and man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943). These issues affect components of the golang crypto/tls, net/http, and crypto/x509 packages used by the plugin.
The multicluster engine for Kubernetes provides the foundational components
that are necessary for the centralized management of multiple
Kubernetes-based clusters across data centers, public clouds, and private
clouds.
You can use the engine to create new Red Hat OpenShift Container Platform
clusters or to bring existing Kubernetes-based clusters under management by
importing them. After the clusters are managed, you can use the APIs that
are provided by the engine to distribute configuration based on placement
policy.
CVE-2026-78667 is a denial of service vulnerability in Golang's FileServer(FS), ServeContent, and ServeFile(FS) functions. It occurs when parsing a Range header containing a large number of small ranges, causing excessive CPU consumption and potentially exhausting server resources. This vulnerability affects availability but does not impact confidentiality or integrity. The CVSS score is 7.5 (medium severity).
Multiple security vulnerabilities affecting the buildah package in Red Hat Enterprise Linux 9 have been identified and fixed. These include denial of service issues in several Go packages (net/http, encoding/asn1, net/url, crypto/tls) and a cross-site scripting vulnerability in Go html/template. The update improves the security of container image building and handling by addressing these issues.
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121)
* crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281)
* golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282)
* crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283)
* crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280)
* net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811)
* golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821)
* mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504)
* encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818)
* net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860)
* crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862)
* encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
A critical security update has been released for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17. This update addresses multiple vulnerabilities identified by several CVEs, including CVE-2024-38827 and numerous others. Users of Openshift Jenkins 4.17 are recommended to upgrade to the latest version to mitigate these security issues. No detailed technical information or specific vulnerability descriptions are provided in the advisory.