Threat database

A critical remote code execution vulnerability (CVE-2026-109618) affects PHP versions prior to 8.3.36-1.oe2403sp3. The flaw arises from improper handling of out-of-memory errors using longjmp(), which can leave request memory uninitialized and lead to execution of arbitrary code. Additionally, related global state management issues (CVE-2026-109619) can cause stale pointers to freed memory, further enabling remote code execution. This vulnerability impacts PHP's mod_php module used with Apache HTTP Server. A security fix is available to address these issues.

A use-after-free vulnerability (CVE-2026-109619) exists in PHP's fatal error handling, where stale request state is retained. This flaw affects PHP as packaged in Red Hat Enterprise Linux 7 Extended Lifecycle Support. Red Hat has issued a security update to address this issue. The vulnerability is rated as having an important security impact by Red Hat Product Security.

A critical security update has been issued for the ca-certificates package in Red Hat Enterprise Linux 9.6. The update distrusts eMudhra intermediate Certificate Authority (CA) certificates due to security concerns identified in CVE-2026-114406. This package contains CA certificates used in the Internet Public Key Infrastructure (PKI) to validate SSL/TLS connections. The update is available for multiple Red Hat Enterprise Linux 9.6 variants and architectures. Users should apply the update to ensure that untrusted certificates from eMudhra intermediates are no longer accepted.

Red Hat has issued a critical security update for the grafana-pcp plugin used in Red Hat Enterprise Linux 9.8 Extended Update Support. The update addresses three vulnerabilities: a denial of service via multiple ECH outer extension references (CVE-2026-97031), a denial of service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669), and man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943). These issues affect components of the golang crypto/tls, net/http, and crypto/x509 packages used by the plugin.

The multicluster engine for Kubernetes provides the foundational components that are necessary for the centralized management of multiple Kubernetes-based clusters across data centers, public clouds, and private clouds. You can use the engine to create new Red Hat OpenShift Container Platform clusters or to bring existing Kubernetes-based clusters under management by importing them. After the clusters are managed, you can use the APIs that are provided by the engine to distribute configuration based on placement policy.

CVE-2026-78667 is a denial of service vulnerability in Golang's FileServer(FS), ServeContent, and ServeFile(FS) functions. It occurs when parsing a Range header containing a large number of small ranges, causing excessive CPU consumption and potentially exhausting server resources. This vulnerability affects availability but does not impact confidentiality or integrity. The CVSS score is 7.5 (medium severity).

Multiple security vulnerabilities affecting the buildah package in Red Hat Enterprise Linux 9 have been identified and fixed. These include denial of service issues in several Go packages (net/http, encoding/asn1, net/url, crypto/tls) and a cross-site scripting vulnerability in Go html/template. The update improves the security of container image building and handling by addressing these issues.

Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server. Security Fix(es): * crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption (CVE-2025-68121) * crypto/x509: golang: Go crypto/x509: Denial of Service via inefficient certificate chain validation (CVE-2026-32281) * golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) * crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) * crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) * net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME (CVE-2026-33811) * golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing (CVE-2026-39821) * mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header (CVE-2026-42504) * encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal (CVE-2026-33818) * net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution (CVE-2026-56860) * crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages (CVE-2026-56862) * encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue (CVE-2026-56859) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A critical security update has been released for Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17. This update addresses multiple vulnerabilities identified by several CVEs, including CVE-2024-38827 and numerous others. Users of Openshift Jenkins 4.17 are recommended to upgrade to the latest version to mitigate these security issues. No detailed technical information or specific vulnerability descriptions are provided in the advisory.