Filtered by vendor Red Hat Subscriptions
Total 146 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2026-93566 2 Red Hat, Redhat 22 Red Hat Amq Broker 7, Amq Broker, Amq Clients and 19 more 2026-11-06 6.5 Medium
A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions.
CVE-2026-82965 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.5 High
A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution. The SAML Artifact Resolution and ECP SOAP endpoints do not properly limit the size or complexity of incoming XML requests. An unauthenticated remote attacker can exploit this by sending specially crafted, large XML messages that cause the server to consume excessive memory. This leads to the application running out of memory and crashing, resulting in a denial of service for all users.
CVE-2026-114232 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 8.1 High
A flaw was found in the UserManagedPermissionService of the Keycloak authorization server. The UMA Protection API, which manages user permissions, fails to validate the resourceType field when a user creates a new policy. This allows an attacker to create a policy that applies to resources owned by other users, potentially leading to unauthorized access or modification of sensitive data across the entire realm.
CVE-2026-112208 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 8.1 High
A flaw was found in the Organization identity-first login flow of the Keycloak authentication server. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when an attacker who belongs to multiple organizations initiates a login and then switches to a registration or password reset path. During this process, a flag indicating a successful login is not properly cleared when the user is removed from the session. An attacker can then provide a victim's username, and the system incorrectly treats the stale flag as proof of the victim's identity. This allows the attacker to bypass authentication and gain full access to the victim's account and connected applications.
CVE-2026-110932 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.5 High
A flaw was found in the theme resource endpoint of Keycloak, an open-source identity and access management solution. The issue occurs because the server fails to validate theme names before using them as keys for an on-disk gzip cache. An unauthenticated attacker can exploit this by sending many requests with unique, fabricated theme names, leading to persistent disk space exhaustion that survives server restarts and causes service disruptions.
CVE-2026-110931 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.5 High
A flaw was found in the SAML 1.1 assertion parser of Keycloak, a tool used for identity and access management. The issue occurs when the parser handles a specific element called AuthorityBinding within an authentication statement. Due to an incomplete fix for a previous vulnerability, the parser can enter an infinite loop that consumes all available memory, causing the entire Keycloak service to crash and become unavailable to users.
CVE-2026-107602 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.5 High
A flaw was found in the SAML 1.1 XML parsing logic of Keycloak, an open-source identity and access management solution. The issue occurs when the parser encounters unexpected elements within a security token's key information section, causing the processing thread to enter an infinite loop. An unauthenticated remote attacker could exploit this by sending specially crafted requests, leading to 100% CPU usage and a total denial of service that requires a server restart to resolve.
CVE-2026-107123 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.5 High
A flaw was found in the SAML XML processing component of Keycloak, an open-source identity and access management solution. The issue occurs when the server parses XML documents containing excessively long dateTime or duration values. Because these strings are not properly validated before processing, the XML parser consumes excessive CPU time. An unauthenticated remote attacker can exploit this by sending specially crafted SAML requests to the server, leading to high CPU utilization and a denial of service for all users.
CVE-2026-103112 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.5 High
A flaw was found in the authentication session handling of the keycloak-services component in Keycloak. The issue occurs because the system fails to verify if an authenticator is valid for the current authentication flow when switching between the standard authentication path and the reset credentials path. An authenticated attacker can exploit this by triggering a race condition during the credential reset process to associate their successful authentication state with another user's session. This can result in the attacker gaining full access to the victim's account and changing their password.
CVE-2026-93565 2 Red Hat, Redhat 23 Red Hat Amq Broker 7, Amq Broker, Amq Clients and 20 more 2026-11-06 7.5 High
A flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems.
CVE-2026-92857 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 8.1 High
Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own applications. A flaw in how Keycloak validates these registration requests allows an attacker to create a malicious application that forges identity information. By mapping their own user profile details to protected fields like the user ID (sub) or intended audience (aud), an attacker can generate signed security tokens that make them appear to be a different user. This could allow an attacker to impersonate other users or gain unauthorized access to services that rely on these tokens for identity verification.
CVE-2026-92855 2 Red Hat, Redhat 5 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak and 2 more 2026-11-06 7.4 High
A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to external identity providers. The issue occurs because the broker fails to verify that a user actually possesses the private key associated with a holder-of-key assertion. An attacker who intercepts a victim signed assertion can replay it to gain unauthorized access and impersonate the victim without needing their private key.
CVE-2026-121994 2 Red Hat, Redhat 5 Enterprise Linux, Enterprise Linux, Hardened Images and 2 more 2026-11-06 8.8 High
A stack buffer overflow in the GDB client's remote protocol handler allows an attacker-controlled debug target to execute arbitrary code in the GDB process. The vulnerability exists in fetch_register_using_p, which decodes a stub's register reply into an alloca-sized buffer without bounding writes by the register width.
CVE-2026-9150 3 Opensuse, Red Hat, Redhat 13 Libsolv, Red Hat Satellite 6, Enterprise Linux and 10 more 2026-11-06 6.5 Medium
A flaw was found in libsolv. This stack-based buffer overflow vulnerability occurs in libsolv's Debian metadata parser when processing specially crafted Debian repository metadata. An attacker could exploit this by providing malicious SHA384 or SHA512 checksum tags, leading to memory corruption and a denial of service (DoS) in the affected system.
CVE-2026-92824 2 Red Hat, Redhat 7 Enterprise Linux, Enterprise Linux, Hardened Images and 4 more 2026-11-06 6.2 Medium
A flaw was found in libmodulemd. In the module stream v2 rpm-map emission path, an inner loop incorrectly uses the count of digest algorithms as its bound instead of the number of checksums in the current digest table. Crafted modulemd v2 metadata with multiple digest types can trigger an out-of-bounds read during YAML serialization, typically causing a crash and resulting in a denial of service.
CVE-2026-9797 2 Red Hat, Redhat 3 Red Hat Build Of Keycloak 26.4, Build Keycloak, Build Of Keycloak 2026-11-06 6.5 Medium
A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin). A highly privileged attacker, authenticated with a 'manage-clients' role, could exploit this vulnerability through several methods, including manipulating client JSON Web Key Sets (JWKS), swapping client authenticator types and resetting secrets, or downloading legitimate signing keys. Successful exploitation allows the attacker to obtain a token with 'realm-admin' role assignments, leading to privilege escalation and potential unauthorized access to sensitive resources.
CVE-2026-9149 3 Opensuse, Red Hat, Redhat 14 Libsolv, Red Hat Satellite 6, Enterprise Linux and 11 more 2026-11-06 6.5 Medium
A flaw was found in libsolv. This heap buffer overflow vulnerability occurs when a victim processes a specially crafted `.solv` file containing negative size values in the `repo_add_solv` function. This leads to an undersized memory allocation and a subsequent out-of-bounds write. An attacker could exploit this to cause a denial of service (DoS).
CVE-2026-114691 3 Gcc, Red Hat, Redhat 9 Gcc, Enterprise Linux, Enterprise Linux and 6 more 2026-11-06 5.9 Medium
A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the container in an inconsistent state, leading to out-of-bounds memory access and resulting in an application crash or a Denial of Service (DoS) during subsequent operations.
CVE-2026-114690 3 Gcc, Red Hat, Redhat 9 Gcc, Enterprise Linux, Enterprise Linux and 6 more 2026-11-06 6.2 Medium
A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compiled with parallel mode, causing the process to crash and leading to a Denial of Service (DoS).
CVE-2026-14164 3 Libarchive, Red Hat, Redhat 16 Libarchive, Enterprise Linux, Ai Inference Server and 13 more 2026-11-06 7.5 High
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.