Filtered by vendor Redhat Subscriptions
Filtered by product Openstack Subscriptions
Total 772 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-114406 1 Redhat 26 Advanced Cluster Security, Agentic Cluster Security Suite, Ai Inference Server and 23 more 2026-11-13 6.8 Medium
The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included multiple root CA certificates of authorities, which signed intermediate CA certificates with weak private keys issued by the eMudhra certificate authority. A man-in-the-middle attacker could use this flaw to issue certificates for arbitrary host names signed by the weak intermediate CA certificates, which would be considered trusted by a TLS/SSL client using system CA store and cause such clients to connect to malicious sites. Due to inability to only distrust specific intermediate certificates in all clients using the system CA store, root CA certificates of authorities that signed weak intermediate CA certificates are being removed.
CVE-2026-75092 2 Red Hat, Redhat 6 Enterprise Linux, Red Hat Enterprise Linux 9.6 Extended Update Support, Red Hat Openstack Platform 17.1 and 3 more 2026-11-13 7.3 High
A privilege escalation flaw was found in the scan_mysql actor of leapp-upgrade-el9toel10 (provided by leapp-repository). During RHEL 9 to RHEL 10 upgrades, the actor runs: mysqld --validate-config --log-error-verbosity=2 directly as root in the Leapp actor context, bypassing the packaged MySQL systemd unit that normally starts the daemon as User=mysql. A process compromised as the mysql OS identity can write a version-2 persisted configuration (mysqld-auto.cnf) and a malicious shared object into /var/lib/mysql (a directory owned by mysql). That persisted map can set plugin_dir to /var/lib/mysql and early_plugin_load (or related loader options such as plugin_load / plugin_load_add) so MySQL loads the attacker-controlled object during configuration validation. Plugin loading can reach dlopen() before MySQL’s runtime-user check and before plugin-symbol validation. When an administrator subsequently runs the documented Leapp preupgrade or upgrade workflow, attacker-controlled code can execute as UID 0 with a full capability set in an unconfined SELinux domain (unconfined_t). The attack does not require write access to the default system plugin path under /usr; redirecting plugin_dir via mysql-owned persisted state is sufficient. Ordinary SQL privileges alone (including highly privileged SQL accounts) are not a sufficient startpoint — OS-level execution as the mysql service identity is required, plus later administrator invocation of Leapp.
CVE-2026-84503 1 Redhat 18 Acm, Ansible Automation Platform, Ansible Core and 15 more 2026-11-13 6.7 Medium
A flaw was found in ansible-core's ansible.builtin.git module. The module invokes git (ls-remote, clone, fetch) with the repository URL as a positional argument and without a "--" separator, so a repository URL that begins with a dash is interpreted by git as a command-line option. A caller that passes an attacker-controlled repository URL to the module can trigger argument injection (for example --upload-pack/--exec), resulting in arbitrary command execution on the host running the module.
CVE-2026-93683 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-11 6.4 Medium
A flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix.
CVE-2026-86856 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-11 6.5 Medium
A flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption.
CVE-2026-86849 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-11 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend.
CVE-2026-86847 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-11 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash.
CVE-2026-86846 2 Dpdk, Redhat 4 Dpdk, Enterprise Linux, Openshift and 1 more 2026-11-11 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend.
CVE-2026-86845 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-11 6.5 Medium
A flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend.
CVE-2026-86566 3 Dpdk, Red Hat, Redhat 6 Dpdk, Enterprise Linux, Enterprise Linux and 3 more 2026-11-11 6.5 Medium
A flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK.
CVE-2026-86561 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-11 6.5 Medium
A flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption.
CVE-2026-100236 2 Dpdk, Redhat 4 Dpdk, Enterprise Linux, Openshift and 1 more 2026-11-11 8.6 High
A flaw was found in the DPDK GSO library. When software GSO copies packet headers into a new mbuf, it does not check that the header fits in the source first segment or in the destination buffer, and a header longer than the configured GSO segment size can underflow the payload-size calculation. A remote or guest-supplied packet processed with software GSO can trigger an out-of-bounds read or write.
CVE-2026-86848 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-11 8.8 High
A flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend.
CVE-2026-86567 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-11 8.8 High
A flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap.
CVE-2026-86565 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-11 8.2 High
A flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process.
CVE-2026-86563 3 Dpdk, Red Hat, Redhat 8 Dpdk, Enterprise Linux, Enterprise Linux and 5 more 2026-11-11 7.8 High
A flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access.
CVE-2026-86562 1 Redhat 3 Enterprise Linux, Openshift, Openstack 2026-11-11 7.8 High
A flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler.
CVE-2026-92091 1 Redhat 5 Ansible Automation Platform, Enterprise Linux, Openshift Ai and 2 more 2026-11-11 5.9 Medium
A flaw was found in jwcrypto. The JWK.import_key() function validates the key_ops JWK member for duplicate values using an algorithm with O(n^2) time complexity, and the length of key_ops is not bounded. A remote, unauthenticated attacker can supply a JWK with a large key_ops array to an application that passes attacker-controlled key material to a public key-import API (reachable via ECDH-ES key agreement, OIDC dynamic client registration, DPoP, or ACME account key registration, among others) to consume excessive CPU time, resulting in a denial of service.
CVE-2026-80179 2 Red Hat, Redhat 6 Red Hat Openshift Ai (rhoai), Ansible Automation Platform, Enterprise Linux and 3 more 2026-11-11 5.9 Medium
A flaw was found in jwcrypto. A remote attacker can send a specially crafted JSON Web Encryption (JWE) token containing numerous period delimiters. This malformed token can force the JWE.deserialize() function to allocate excessive memory, leading to a MemoryError. This issue results in a denial of service (DoS) for services that process untrusted JWE values.
CVE-2026-93009 3 Dnsmasq, Red Hat, Redhat 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more 2026-11-06 4.3 Medium
A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigger this with a single DHCPv6 packet. The extra byte is not returned to the client or logged, and no crash has been demonstrated.