Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:84844 | (RHSA-2026:84844) Important: pcs security update | October 19, 2026 |
| RHSA-2026:84799 | (RHSA-2026:84799) Important: mariadb11.8 security update | October 19, 2026 |
| RHSA-2026:84798 | (RHSA-2026:84798) Important: pcs security update | October 19, 2026 |
| RHSA-2026:84796 | (RHSA-2026:84796) Important: openexr security update | October 19, 2026 |
| RHSA-2026:84795 | (RHSA-2026:84795) Important: librabbitmq security update | October 19, 2026 |
| RHSA-2026:84793 | (RHSA-2026:84793) Important: kernel security update | October 19, 2026 |
| RHSA-2026:84785 | (RHSA-2026:84785) RHTAS 1.4.4 - Release of Model Transparency 1.0.5 | October 19, 2026 |
| RHSA-2026:84753 | (RHSA-2026:84753) Moderate: glibc security update | October 19, 2026 |
| RHSA-2026:84744 | (RHSA-2026:84744) Important: gimp:2.8 security update | October 19, 2026 |
| RHSA-2026:84734 | (RHSA-2026:84734) RHOAI 3.4.5 - Red Hat OpenShift AI | October 19, 2026 |
By the Year
In 2026 there have been 4598 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1196 security vulnerabilities published. That is, 3402 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.43.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 4598 | 7.29 |
| 2025 | 1196 | 6.87 |
| 2024 | 1704 | 6.82 |
| 2023 | 1208 | 6.74 |
| 2022 | 1362 | 6.97 |
| 2021 | 1123 | 6.54 |
| 2020 | 664 | 6.37 |
| 2019 | 772 | 6.93 |
| 2018 | 762 | 7.17 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-16460 | Oct 19, 2026 |
bootc/ostree: Bypass Image Signature Validation on RebootA flaw was found in bootc and ostree. Already-staged deployments are finalized without revalidating the deployment's container image against the current containers signature policy. Unsigned OS content staged under a prior permissive policy can remain bootable after policy is hardened to reject unsigned images, leading to full host compromise on reboot. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
|
| CVE-2026-16487 | Oct 19, 2026 |
Bootc SigPolicy Flaw Enables Unsigned Image Exec as RootA flaw was found in bootc when operating with the default containers signature policy. Automatic or manual upgrades of a mutable image tag may apply unsigned content for registries that fall through to insecureAcceptAnything, allowing an attacker who can update that tag to execute arbitrary OS content as the host root filesystem on reboot. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-89096 | Oct 16, 2026 |
nfs-utils rpc.statd DoS via Memory LeakA flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-89088 | Oct 16, 2026 |
Heap-based Buffer Overflow in libparted's FAT16 Resize LogicA flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversized read into a fixed-size memory buffer. This issue causes memory corruption, resulting in an application crash and a denial of service (DoS). |
Enterprise Linux (RHEL)
|
| CVE-2026-89085 | Oct 16, 2026 |
Parted Heap Overflow in FAT32 Image Processing (DoS)A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image, resulting in an application crash leading to a Denial of Service (DoS) or potential memory corruption. |
Enterprise Linux (RHEL)
|
| CVE-2026-17591 | Oct 16, 2026 |
libarchive UAF in archive_entry_copy_mac_metadata (CVE-2026-17591)A flaw was found in libarchive. An attacker can cause a Denial of Service (DoS) or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archive_entry_copy_mac_metadata() function deallocates an internal buffer before completing a data copy. An attacker who can supply input to an application utilizing this function can trigger the flaw to crash the application or read uninitialized memory data. |
Enterprise Linux (RHEL)
Hummingbird
|
| CVE-2026-62438 | Oct 16, 2026 |
GIMP Integer Overflow in Image Decompressor Enables DoS/memory DisclosureA flaw was found in GIMP. An attacker can cause a Denial of Service (DoS) or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive (PAA) texture file. Due to an integer overflow when calculating image dimensions during file decompression, the application allocates an undersized memory buffer. Subsequent processing reads memory past the buffer boundary, terminating the plug-in process unexpectedly. |
Enterprise Linux (RHEL)
|
| CVE-2026-62439 | Oct 16, 2026 |
GIMP file-pvr plugin integer overflow heap buf overflowA flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR (.pvr) file, an attacker can trigger a heap-based buffer overflow, potentially leading to arbitrary code execution or a Denial of Service (DoS) via an application crash. |
Enterprise Linux (RHEL)
|
| CVE-2026-85977 | Oct 16, 2026 |
libtirpc Denial of Service via Unbounded PMAPPROC_DUMP DecodingA flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROC_DUMP replies to a client application that uses the pmap_getmaps() function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation, causing the client process to experience a Denial of Service (DoS) due to resource exhaustion. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-85231 | Oct 16, 2026 |
libtirpc DoS via Unbounded Memory Allocation by Oversized RPCSEC_GSS DataA flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC (Remote Procedure Call) service configured with RPCSEC_GSS (Remote Procedure Call Security-Generic Security Service) integrity or privacy. This can lead to unbounded memory allocation, resulting in a Denial of Service (DoS) by exhausting system resources and causing the service to become unstable or terminate. |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-89098 | Oct 16, 2026 |
Local DoS via fsidd assertion failure in nfs-utilsA flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-86047 | Oct 16, 2026 |
SQL Injection via Unquoted Identifiers in MariaDB SHOW CREATEMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump are affected because each does not consistently quote identifiers and values when serializing SQL. A low-privileged attacker can trigger the issue when an attacker-created object with crafted identifiers or values is included in SHOW output or a dump, then create an object with crafted identifiers or values so generated SQL contains injected statements and execute attacker-injected SQL when the poisoned output is applied. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. |
|
| CVE-2026-85745 | Oct 16, 2026 |
MariaDB ST_Area WKB Buffer Overflow (10.6.110.6.28, 10.11.19, 11.4.13)MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, ST_Area reads beyond the allocated buffer when processing invalid WKB for a MultiPolygon because the multi-polygon parser advances past a nested geometry header without first verifying enough input remains. A low-privileged remote attacker can supply malformed spatial data to disclose memory useful for bypassing ASLR as part of a multi-vulnerability chain. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. |
|
| CVE-2026-97380 | Oct 16, 2026 |
MariaDB Server <=13.0.2 GRANT PROXY empty password auth bypassMariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the GRANT PROXY statement treats an IDENTIFIED clause with an empty password as though authentication were not specified, causing it to check the wrong grantor privileges. A low-privileged attacker who can name another account can exploit this authorization error to set that account's password. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. |
|
| CVE-2026-85985 | Oct 16, 2026 |
MariaDB CONNECT UDF RCE via file-access plugin; fixed up to 13.0.2MariaDB server is a community developed fork of MySQL server. From 10.6.1 until 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2, the CONNECT engine plugin file-access UDFs json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file() are affected because each does not enforce FILE privilege or the secure_file_priv setting. A low-privileged attacker can trigger the issue by calling a CONNECT file-access UDF with a filesystem path, then invoke a CONNECT file-access UDF to access a filesystem path and read or write files that the database account is not authorized to access, subject to operating-system permissions. This issue is fixed in versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. |
|
| CVE-2026-84823 | Oct 15, 2026 |
WildFly Path Traversal in take-snapshot Allows Monitor Role to Read ConfigA flaw was found in WildFly. A user with the `Monitor` role, which is the lowest standard Role-Based Access Control (RBAC) role, can exploit a path traversal vulnerability in the `take-snapshot` operation. By manipulating the `name` parameter, this user can write a copy of the server configuration to an arbitrary location. This allows the `Monitor` role to read back the server configuration, including sensitive credentials, which would otherwise be restricted by RBAC, leading to information disclosure. |
Enterprise Linux (RHEL)
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-87029 | Oct 15, 2026 |
Undici 7.15-7.30.0/8.0-8.12.1: decompress interceptor crash (async exception)undici is an HTTP client library for Node.js. In versions 7.15.0 through 7.30.0 and 8.0.0 through 8.12.1, its decompress interceptor forwards decompressed response data to the downstream handler from zlib stream event callbacks without catching exceptions those callbacks may throw, and while undici's engine converts a synchronous throw from a downstream handler into a per-request failure, that protection is absent when the throw happens asynchronously from a zlib callback. As a result, a downstream handler that throws by design, such as the built-in dump interceptor which throws when a response exceeds its configured maximum size, escapes as an uncaught exception that terminates the Node.js process. A malicious or compromised HTTP server can crash any client that composes the decompress interceptor with such a handler by returning a small compressed body that decompresses to more than the configured limit, so only the decompressed size matters and the bytes on the wire stay tiny. The issue is fixed in undici 7.30.1 and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, avoid composing the decompress interceptor with a response handler that throws during response processing until upgrading. |
|
| CVE-2026-87018 | Oct 15, 2026 |
undici HTTP client crash via TLS1.2 renegotiation (v4.2.18.12.1)undici is an HTTP client library for Node.js. In versions 4.2.1 through 6.29.0, 7.0.0 through 7.30.0, and 8.0.0 through 8.12.1, the client process crashes when a TLS 1.2 server renegotiates after the connection is established and presents a different, CA-trusted certificate whose hostname does not match the requested host. Node.js re-runs hostname verification on the renegotiated handshake and destroys the socket with a certificate-altname error, but undici's established-socket error handler asserted that this error code could never occur, so the peer-controlled error became an uncaught assertion that terminates the Node.js process, affecting both the HTTP/1.1 and HTTP/2 paths. A malicious or compromised HTTPS endpoint reached through undici or the global fetch() can crash the client with a single server-initiated renegotiation, taking down all in-flight requests and background work in the process, and exploitation needs no CA compromise because the attacker controls the endpoint and can present two ordinary valid certificates. Only TLS 1.2 is affected, since TLS 1.3 does not support renegotiation. The issue is fixed in undici 6.29.1, 7.30.1, and 8.12.2, and users should upgrade to one of those versions or later. As a workaround, restrict outbound connections to TLS 1.3 so renegotiation cannot occur, when the target endpoints support it. |
|
| CVE-2026-61702 | Oct 15, 2026 |
CUPS 2.4.20 Path Traversal via IPP natural-language in copy_banner()OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_banner() in scheduler/ipp.c uses the attacker-controlled IPP attributes-natural-language value as a directory component beneath DataDir/banners when processing a job-sheets banner. The job-sheets value must first match a registered banner basename, and the traversed path must contain a matching reachable basename; selecting an arbitrary target as demonstrated additionally requires pre-positioned path state such as a symlink with that basename. Subject to the scheduler's filesystem and sandbox access, path separators in the language value can escape the intended banner directory, make the root scheduler open the reachable file, and copy its bytes into a job-sheet spool object that a configured backend can deliver to an attacker-observable endpoint. This issue is fixed in version 2.4.20. |
|
| CVE-2026-55453 | Oct 15, 2026 |
CUPS 2.4.20+ Fix: CRLF Injection in Ipp Backend leaks PPD keywordOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the backend/ipp.c quote_string() function preserves carriage-return and line-feed characters in a remote printer-controlled marker-message before report_attr() writes the value to the scheduler status stream. The scheduler can parse an injected newline as a separate PPD: control line and persist an attacker-selected PPD keyword. The reporter demonstrated that a later print job on a Foomatic-backed queue could consume an injected FoomaticRIPCommandLine value and execute in the filter context as lp. This issue is fixed in version 2.4.20. |
|
| CVE-2026-55480 | Oct 15, 2026 |
CUPS <2.4.20 Unpredictable TempDir PPD Overwrite (root)OpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, copy_model() in scheduler/ipp.c creates a predictable TempDir/<connection-number>.ppd path in an lp-group-writable directory and opens it as root without O_EXCL or O_NOFOLLOW. Exploitation requires an lp-group process able to write that directory to predict the connection-derived name and plant a symlink before the root open, while a privileged add-printer or modify-printer operation using a model PPD triggers copy_model(). The reporter treats an existing lp foothold and the privileged operation as distinct prerequisites, while the maintainer assesses high privileges because installing the relevant filter or administering the printer requires root or print-administrator access. If the race succeeds, the root scheduler follows the symlink and truncates or overwrites a root-writable target with generated PPD data, compromising file integrity or availability. This issue is fixed in version 2.4.20. |
|
| CVE-2026-55467 | Oct 15, 2026 |
CUPS 2.4.20 Control-Char Injection via Fax QueueOpenPrinting CUPS is an open source printing system for Linux and other Unix-like operating systems. Prior to 2.4.20, the cupsdCreateJob option-string builder in scheduler/job.c maps attacker-controlled destination-uri and pre-dial-string values from a configured fax queue to the phone and faxPrefix options. Unlike ordinary IPP job attributes, these mapped fax values bypass the control-character sanitizer and are copied directly into the filter options argument. A user permitted to submit a job can therefore inject control characters into the downstream option stream. The reporter states that a downstream fax filter passing these values to a shell or modem command could execute code as lp, while the maintainer states that CUPS has no confidentiality or integrity impact because the only known code-executing filter is optional Foomatic and addressed separately, leaving possible disruption of the affected queue. This issue is fixed in version 2.4.20. |
|
| CVE-2026-85634 | Oct 15, 2026 |
WildFly Core Path Traversal in ContentRepositoryImpl Enables PrivEscA flaw was found in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library, which is used by WildFly and JBoss EAP to manage server deployments. The issue occurs when the library processes an unsanitized deployment name. Due to a missing containment check, an attacker with the Deployer RBAC role can use path traversal sequences to access files outside the restricted deployment directory. This can allow the attacker to delete arbitrary directories or create files with arbitrary content, leading to a full privilege escalation to the management SuperUser role. |
Jboss Fuse
Jboss Enterprise Application Platform
Jbosseapxp
And others... |
| CVE-2026-92982 | Oct 15, 2026 |
Ansible Operator Plugins: Jinja2 Template Injection Enables ClusterWide PrivEscA flaw was found in Ansible Operator Plugins. A low-privileged Kubernetes user can exploit a Jinja2 template injection vulnerability by crafting malicious custom resource (CR) specification values. These values are processed by Ansible without proper sanitization, allowing embedded Jinja2 expressions to be executed within the operator pod. This can lead to arbitrary code execution and privilege escalation, granting the attacker control over the operator's service account with cluster-wide permissions. |
Migration Toolkit Applications
Rhmt
Migration Toolkit Virtualization
And others... |
| CVE-2026-86849 | Oct 14, 2026 |
DPDK vhost-crypto Integer Overflow, Host Buffer OverrunA flaw was found in DPDK lib/vhost vhost-crypto. Integer overflow in chain length checks, and missing length checks on the RSA path, can overflow a host buffer in the vhost-crypto backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86856 | Oct 14, 2026 |
DPDK nfp vDPA Driver Buffer Overflow via Excess VirtqueuesA flaw was found in the DPDK nfp vDPA driver. Stack and heap buffers sized for a single queue pair can be overflowed when more virtqueues are configured, leading to a host crash or memory corruption. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86847 | Oct 14, 2026 |
DPDK vhost-crypto Uninitialized Next Pointer Crash in Write-Back ChainA flaw was found in DPDK lib/vhost vhost-crypto. Write-back chain cleanup can follow an uninitialized next pointer when mapping a guest descriptor fails, causing the host vhost-crypto process to hang or crash. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86846 | Oct 14, 2026 |
DPDK vhost-crypto OOB Write via Unchecked Avail-Ring IndexA flaw was found in DPDK lib/vhost vhost-crypto. A guest can supply an avail-ring descriptor index that is used without bounds checking, causing an out-of-bounds write in the host vhost-crypto backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86845 | Oct 14, 2026 |
DPDK vhost-crypto Use-after-Free via stale session pointerA flaw was found in DPDK lib/vhost vhost-crypto. Session cleanup can leave a stale cached session pointer, and the data path does not check the session type before attaching it, leading to use-after-free or type confusion in the host vhost-crypto backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86566 | Oct 14, 2026 |
DPDK lib/vhost RX Descriptor Underflow Causes VDS in OVSDPDKA flaw was found in DPDK lib/vhost. A guest with runt RX descriptors can underflow the copy length in vhost enqueue, causing a denial of service in a shared vhost backend such as OVS-DPDK. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86848 | Oct 14, 2026 |
DPDK lib/vhost vhost-crypto Indirect-Descriptor OOB via double-fetchA flaw was found in DPDK lib/vhost vhost-crypto. The indirect-descriptor snapshot double-fetches a guest descriptor next index, allowing a malicious guest to cause an out-of-bounds access in the host backend. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86567 | Oct 14, 2026 |
DPDK lib/vhost UAF via IOTLB miss leading to use-after-unmapA flaw was found in DPDK lib/vhost. The VDUSE handler fails to invalidate vring pointers when the IOTLB is invalidated, leading to use-after-unmap. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-94200 | Oct 14, 2026 |
Erlang OTP SSL lib DoS: TLS 1.3 Early Data Validation (pre11.7.8)Improper Validation of Consistency within Input vulnerability in Erlang OTP ssl (tls_handshake_1_3, ssl_handshake and tls_client_ticket_store modules) allows a malicious TLS 1.3 server to cause a denial of service of the ssl application on the client node. The TLS 1.3 client decodes the extensions of a NewSessionTicket message as if they came from EncryptedExtensions. It therefore accepts a 0-length early_data extension, a form that is only valid in ClientHello and EncryptedExtensions. With {session_tickets, auto}, the client stores the ticket in the node-global tls_client_ticket_store. On the next automatic resumption, tls_handshake_1_3:get_max_early_data/1 crashes the store with a case_clause. Repeated crashes can exceed the restart intensity of the ssl supervisors, which use the rest_for_one strategy, and take down ssl for all connections on the node. This issue affects OTP from OTP 23.3 before OTP 27.3.4.19, OTP 28.5.0.8, and OTP 29.1.2, corresponding to ssl from 10.3 before 11.2.12.14, 11.6.0.7, and 11.7.8. |
|
| CVE-2026-86565 | Oct 14, 2026 |
DPDK lib/vhost OOB write via virtqueue size desyncA flaw was found in DPDK lib/vhost. A guest can desynchronize virtqueue size from inflight descriptor table size, causing an out-of-bounds write in the host vhost process. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86563 | Oct 14, 2026 |
DPDK vhost double-offset bug causes memory access errorA flaw was found in DPDK lib/vhost. A double-offset bug in vhost log mapping calculation can lead to incorrect memory access. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86562 | Oct 14, 2026 |
DPDK VHOST TOCTOU Double-Fetch Heap Overflow VulnerabilityA flaw was found in DPDK lib/vhost. A TOCTOU double-fetch of control-queue descriptors allows a heap buffer overflow with attacker-controlled content in the VDUSE control-queue handler. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-86561 | Oct 14, 2026 |
DPDK vhost mmap size validation flaw leads to host crashA flaw was found in DPDK lib/vhost. Memory size is not adequately validated before mmap during vhost memory-region setup, which can lead to a host crash or memory corruption. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-93683 | Oct 14, 2026 |
DPDK vhost OOB heap copy via indirect descriptor tableA flaw was found in the DPDK vhost library. When handling a virtio indirect descriptor table, the host reads the table length more than once from guest memory and can allocate a host copy before validating that length. A guest that changes the length between those reads, or that supplies an out-of-range next index on a small host copy in the vDPA relay path, can cause the host vhost process to walk past the validated mapping or heap copy. That can crash or disrupt the vhost process. Out-of-bounds bytes are consumed as descriptor fields for GPA translation and are not returned to the guest as payload. This is a residual issue in the non-contiguous indirect descriptor copy path introduced as part of the CVE-2018-1059 fix. |
Enterprise Linux (RHEL)
Openshift
Openstack
And others... |
| CVE-2026-15176 | Oct 14, 2026 |
NGINX Heap Buffer Overflow via $request_filename in Alias RewriteA vulnerability exists in NGINX Plus and NGINX Open Source when a location is configured that uses the alias directive together with rewrite and a set or return directive referencing the $request_filename variable. Alternatively, the same result could be achieved when the $request_filename variable is used in an access log format directive. An unauthenticated attacker along with conditions beyond their control can exploit this vulnerability by sending crafted HTTP requests. This may cause a heap buffer overflow in the NGINX worker process leading to a restart. Additionally, attackers can execute code on systems with Address Space Layout Randomization (ASLR) disabled or when the attacker can bypass ASLR. Impact: This vulnerability may allow remote attackers to cause a denial-of-service (DoS) on the NGINX system or to possibly trigger a code execution. There is no control plane exposure; this is a data plane issue only. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated. |
|
| CVE-2026-88842 | Oct 14, 2026 |
BusyBox dpkg write_status_file cursor reset flaw causes data corruptionA flaw was found in BusyBox dpkg. The write_status_file() function does not reset a field cursor between package stanzas. When two packages are removed in a single invocation and the first stanza is larger than the second, the second package stanza can be dropped from the status file, causing limited data corruption. |
Hummingbird
|
| CVE-2026-88829 | Oct 14, 2026 |
BusyBox httpd Reverse Proxy Path Bypass via Pipelined RequestsA flaw was found in BusyBox httpd's reverse proxy feature. When the proxy is configured to forward requests matching a URL prefix to a backend server, only the first HTTP request on a TCP connection has its path rewritten. An attacker can send a pipelined second request that is relayed verbatim to the backend, bypassing the configured path restrictions. This allows accessing arbitrary paths on the backend server that were not intended to be exposed through the proxy. |
Hummingbird
|
| CVE-2026-90954 | Oct 14, 2026 |
BusyBox dpkg-deb Symlink Injection via .deb ExtractionA flaw was found in BusyBox's dpkg-deb archive extraction. The ar archive handler flushes deferred symlinks after each archive member, unlike the tar, cpio, and unzip handlers which flush once after the last member. A specially crafted .deb archive with two data.tar members can exploit this ordering: the first member declares a symlink pointing to an absolute path (e.g., '/'), which is deferred as unsafe but flushed after the first member. The second member declares a regular file whose path traverses the now-live symlink, resulting in a file being written outside the intended extraction directory. This could allow an attacker to write arbitrary files to arbitrary locations when a user extracts a crafted .deb package. |
Hummingbird
|
| CVE-2026-86476 | Oct 14, 2026 |
Gst-plugins-base Heap Buffer Overflow via Unchecked GstVideoMetaA flaw was found in gst-plugins-base. A heap buffer overflow can be triggered when processing video buffers whose attached GstVideoMeta metadata declares plane strides and offsets that exceed the actual backing memory allocation. The metadata is not range-checked during deserialization, and the video frame mapping code does not verify that the declared plane geometry fits within the buffer before allowing consumers to read or write video data. A local attacker who controls the sending side of a GStreamer inter-process IPC pipeline can deliver a crafted buffer carrying fabricated strides, causing the receiving process to read or write beyond heap boundaries. Successful exploitation can cause a denial of service or potentially allow code execution within the affected process. |
Enterprise Linux (RHEL)
|
| CVE-2026-92392 | Oct 14, 2026 |
Curl HTTP/2 RST_STREAM UAF during uploadDuring an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object. |
|
| CVE-2026-70162 | Oct 13, 2026 |
Oct 2026: .NET Denial of Service VulnerabilityA denial of service vulnerability exists when Microsoft Common Object Runtime Library improperly handles web requests. An attacker who successfully exploited this vulnerability could cause a denial of service against a .NET web application. A remote unauthenticated attacker could exploit this vulnerability by issuing specially crafted requests to the .NET application. The update addresses the vulnerability by correcting how the .NET web application handles web requests. |
|
| CVE-2026-58280 | Oct 13, 2026 |
Oct 2026: .NET Denial of Service VulnerabilityUncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network. |
|
| CVE-2026-70159 | Oct 13, 2026 |
Oct 2026: ASP.NET Core Denial of Service VulnerabilityAllocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. |
|
| CVE-2026-69651 | Oct 13, 2026 |
Oct 2026: .NET Denial of Service VulnerabilityInefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network. |
|
| CVE-2026-66822 | Oct 13, 2026 |
Oct 2026: .NET Information Disclosure VulnerabilityInsertion of sensitive information into sent data in .NET allows an unauthorized attacker to disclose information over a network. |
|
| CVE-2026-88834 | Oct 13, 2026 |
BusyBox httpd Username Enumeration via System Password AuthA flaw was found in BusyBox's httpd web server. When configured with system password authentication, a user existence oracle may exist in certain build configurations. An attacker could distinguish existing from non-existing usernames by observing authentication failure behavior. Impact is limited to username enumeration and requires non-default compile options or uncommon password file states; default BusyBox builds with shadow password support are not affected. |
Hummingbird
|