Filtered by vendor Red Hat Subscriptions
Total 129 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-14164 3 Libarchive, Red Hat, Redhat 16 Libarchive, Enterprise Linux, Ai Inference Server and 13 more 2026-11-05 7.5 High
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
CVE-2026-115221 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Els 2026-11-05 5.4 Medium
A flaw was found in FreeIPA. An improper authorization check allows an authenticated host to retrieve and revoke digital certificates assigned to other users or services. This issue occurs because FreeIPA verifies ownership solely by matching the host name to the certificate's subject Common Name (CN), without confirming actual ownership in the directory service. Consequently, an enrolled host can disrupt services by revoking certificates belonging to other entities.
CVE-2026-115207 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-05 5.5 Medium
A flaw was found in GNU patch. An attacker can achieve arbitrary file creation outside the intended working directory by enticing a user or automated workflow to apply a specially crafted patch file. Due to missing validation during automatic patch reversal, absolute file paths in patch headers are accepted rather than rejected. Consequently, the utility can create files in arbitrary locations with the permissions of the executing user.
CVE-2026-114691 3 Gcc, Red Hat, Redhat 8 Gcc, Enterprise Linux, Enterprise Linux and 5 more 2026-11-05 5.9 Medium
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.
CVE-2026-114690 3 Gcc, Red Hat, Redhat 8 Gcc, Enterprise Linux, Enterprise Linux and 5 more 2026-11-05 6.2 Medium
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
CVE-2026-114038 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more 2026-11-05 5.1 Medium
A flaw was found in device-mapper-multipath. A local user can trigger an out-of-bounds read by sending a command with a format string ending in a trailing percent character to the multipath daemon. This issue can allow the user to expose unintended daemon memory, leading to information disclosure, or cause the daemon to crash, resulting in a Denial of Service (DoS).
CVE-2026-118593 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more 2026-11-05 5.9 Medium
A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lead to softirq starvation and denial of service on systems with SRv6 tunnels configured. Upstream and RHEL 10 are not affected.
CVE-2026-117548 2 Red Hat, Redhat 5 Enterprise Linux, Directory Server, Enterprise Linux and 2 more 2026-11-05 6.5 Medium
A NULL pointer dereference flaw was found in 389-ds-base. This flaw occurs when a ModifyDN (rename) operation uses an attribute's schema alias name (such as "commonName") instead of its canonical name (such as "cn") as the new relative distinguished name. An authenticated attacker with the ModifyDN (rename) permission on the affected entry can use this flaw to crash the directory server, causing a denial of service.
CVE-2026-116497 3 Gssproxy Project, Red Hat, Redhat 6 Gssproxy, Enterprise Linux, Enterprise Linux and 3 more 2026-11-05 5.5 Medium
A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field absent, the daemon dereferences the resulting NULL pointer and crashes. The request requires no authentication, allowing any local user to crash the gssproxy daemon via its Unix socket. The daemon does not automatically restart, resulting in a persistent denial of service that also affects dependent services such as Kerberized NFS and IdM.
CVE-2026-115485 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Els 2026-11-05 6.3 Medium
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.
CVE-2026-115484 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Els 2026-11-05 7.6 High
A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.
CVE-2026-115455 3 Gcc, Red Hat, Redhat 8 Gcc, Enterprise Linux, Enterprise Linux and 5 more 2026-11-05 6.5 Medium
A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an affected application could trigger a stack-based buffer overflow leading denial of service (DoS).
CVE-2026-110777 3 Gnome, Red Hat, Redhat 4 Evolution-data-server, Enterprise Linux, Enterprise Linux and 1 more 2026-11-05 5.7 Medium
A flaw was found in evolution-data-server. Calendar events containing a file:// URI in their ATTACH property automatically read the targeted local file, base64-encode its contents and upload it back to the server when the event is saved. There are no file path restrictions or checks to verify whether the attachment originally came from the server or was added locally. This allows an attacker with access to a shared CalDAV calendar to exfiltrate arbitrary files the user has access to when interacting with malicious calendar events.
CVE-2026-110133 3 Ghostscript, Red Hat, Redhat 4 Ghostscript, Enterprise Linux, Enterprise Linux and 1 more 2026-11-05 5.8 Medium
A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit this by enticing a victim or automated service to open the malicious content, potentially resulting in a Denial of Service (DoS) crash or arbitrary code execution.
CVE-2026-109971 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more 2026-11-05 4.7 Medium
A flaw was found in the clevis PKCS#11 pin. The clevis-decrypt-pkcs11 script passes the PKCS#11 token PIN as a command-line argument to pkcs11-tool, making it visible to any local user through process listing or the /proc filesystem.
CVE-2026-109970 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more 2026-11-05 4.7 Medium
A flaw was found in the clevis PKCS#11 pin. The clevis-luks-pkcs11-askpin script writes the PKCS#11 token PIN in plaintext to a file without setting restrictive permissions. Under the default process umask, the file is world-readable. Additionally, the PIN file is not reliably cleaned up if the decryption script exits early, leaving the PIN accessible indefinitely.
CVE-2026-109969 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more 2026-11-05 4.7 Medium
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon creates AF_UNIX sockets without explicit permission restrictions or peer credential verification. Under a permissive process umask, any local user can connect to the control socket and inject arbitrary device/key pairs, or connect to the data socket to receive LUKS passphrases.
CVE-2026-109968 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Openshift and 2 more 2026-11-05 5.5 Medium
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable under the default process umask. A local attacker can read the log file to obtain the LUKS passphrase.
CVE-2026-100231 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Els 2026-11-05 6.1 Medium
A flaw was found in the GStreamer multimedia framework's ASF muxer plugin (asfmux). When writing string metadata tags containing Unicode characters outside the Basic Multilingual Plane (such as emoji) to an ASF container, the plugin incorrectly calculates the buffer size needed for the UTF-16LE representation. The size calculation assumes each Unicode code point requires 2 bytes, but non-BMP characters require 4 bytes (surrogate pairs). This leads to a heap out-of-bounds write when the actual UTF-16LE conversion is written into the undersized buffer. An attacker could exploit this by providing media with crafted metadata tags to an application that transcodes or remuxes to ASF format while preserving metadata, potentially causing a denial of service or limited memory corruption.
CVE-2026-108063 2 Red Hat, Redhat 3 Enterprise Linux, Enterprise Linux, Rhel Els 2026-11-05 5.5 Medium
A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash, resulting in a Denial of Service (DoS).