Filtered by vendor Red Hat Subscriptions
Total 209 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-93565 2 Red Hat, Redhat 23 Red Hat Amq Broker 7, Amq Broker, Amq Clients and 20 more 2026-11-06 7.5 High
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
CVE-2026-92855 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.4 High
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
CVE-2026-83494 2 Red Hat, Redhat 2 Red Hat Openshift Ai (rhoai), Openshift Ai 2026-11-06 N/A
A flaw was found in the training-operator. An incorrect object casting in the PyTorchJob ValidateUpdate webhook allows users to bypass an immutability check. This vulnerability could enable users to detach a queued job from its quota management system or hijack a running job's controller ownership. The primary impact is a Denial of Service (DoS) condition.
CVE-2026-123151 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-06 7.5 High
A flaw was found in the GNU debugger (GDB). When GDB connects to a remote debug target, a malicious target can cause GDB to overflow a buffer on the stack while parsing the target's replies. This can crash GDB or potentially allow the target to execute arbitrary code in the GDB client process with the privileges of the user running GDB.
CVE-2026-121994 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-06 8.8 High
A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.
CVE-2026-9150 3 Opensuse, Red Hat, Redhat 13 Libsolv, Red Hat Satellite 6, Enterprise Linux and 10 more 2026-11-06 6.5 Medium
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.
CVE-2026-92824 2 Red Hat, Redhat 7 Enterprise Linux, Enterprise Linux, Hardened Images and 4 more 2026-11-06 6.2 Medium
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
CVE-2026-9149 3 Opensuse, Red Hat, Redhat 14 Libsolv, Red Hat Satellite 6, Enterprise Linux and 11 more 2026-11-06 6.5 Medium
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).
CVE-2026-14164 3 Libarchive, Red Hat, Redhat 16 Libarchive, Enterprise Linux, Ai Inference Server and 13 more 2026-11-06 7.5 High
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
CVE-2026-120194 3 Json-glib, Red Hat, Redhat 7 Json-glib, Enterprise Linux, Enterprise Linux and 4 more 2026-11-06 7.5 High
A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.
CVE-2026-121997 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-06 8.1 High
A heap buffer overflow in gdbserver's QTDPsrc packet handler allows an unauthenticated remote attacker to achieve native code execution in the gdbserver process. The vulnerability results from a mismatch between a packet's declared source length and the actual data length, causing hex2bin to write beyond the allocated heap buffer.
CVE-2026-93011 3 Dnsmasq, Red Hat, Redhat 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more 2026-11-06 5.3 Medium
A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.
CVE-2026-93007 3 Dnsmasq, Red Hat, Redhat 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more 2026-11-06 5.3 Medium
A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.
CVE-2026-93006 3 Dnsmasq, Red Hat, Redhat 9 Dnsmasq, Enterprise Linux, Ceph Storage and 6 more 2026-11-06 6.8 Medium
A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.
CVE-2026-84185 2 Red Hat, Redhat 7 Red Hat Openshift Ai (rhoai), Ansible Automation Platform, Enterprise Linux and 4 more 2026-11-06 5.9 Medium
A flaw was found in the jwcrypto library, which is used for implementing Javascript Object Signing and Encryption (JOSE) standards. The issue occurs when the library verifies a General JSON Serialization JWS using a set of keys. Due to a coding error, the library fails to correctly identify the specific key ID (kid) and may instead accept a signature made by any valid key in the set. This can allow an attacker with a valid key to bypass authorization checks in applications that rely on the key ID to identify specific tenants or users.
CVE-2026-111079 2 Red Hat, Redhat 2 Enterprise Linux, Enterprise Linux 2026-11-06 7.4 High
A flaw was found in Goose. When the terminal integration feature is enabled, the application captures shell command history and sends it verbatim without sanitization to configured Large Language Model (LLM) provider endpoints during queries. If a user enters sensitive data—such as API tokens, passwords, or environment variables containing secrets—in the terminal, this unredacted information is transmitted across trust boundaries. This can lead to sensitive information disclosure, exposing confidential credentials to external service providers and logs.
CVE-2026-18651 2 Red Hat, Redhat 6 Enterprise Linux, 389 Directory Server, Directory Server and 3 more 2026-11-05 5.4 Medium
A flaw was found in 389 Directory Server. During SASL PLAIN authentication, the server installs connection-level bind credentials before performing the account-lock check. If the account is subsequently found to be locked, the bind is reported as failed to the client, but the already-installed authenticated state on the connection is not reverted. A client that supplies valid credentials for an account that has been administratively locked can continue to use the same connection with that account's privileges, defeating account lock as an access-revocation control.
CVE-2026-121996 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-05 8.2 High
A length validation flaw in gdbserver's agent-expression parser allows an unauthenticated remote attacker to read uninitialized heap memory from the gdbserver process and cause a denial of service. Disclosed heap content includes addresses suitable for defeating ASLR in further exploitation.
CVE-2026-119842 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Els 2026-11-05 6.5 Medium
A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD (.sub) subtitle file.
CVE-2026-119729 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Els 2026-11-05 6.5 Medium
A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker can cause integer overflow in the parser, resulting in incorrect length values being used during stream processing, which can lead to a denial of service.