Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)2857 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1192 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Openshift665 vulnerabilities

Red Hat Rhel Eus657 vulnerabilities

Red Hat Rhel E4s560 vulnerabilities

Red Hat Rhel Tus481 vulnerabilities

Red Hat Rhel Aus469 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Satellite389 vulnerabilities

Red Hat Rhel Eus Long Life386 vulnerabilities

Red Hat Openshift Ai364 vulnerabilities

Red Hat Rhel Els362 vulnerabilities

Red Hat Hummingbird335 vulnerabilities

Red Hat Jboss Enterprise Application Platform328 vulnerabilities

Red Hat Openstack291 vulnerabilities

Red Hat Build Keycloak267 vulnerabilities

Red Hat Jbosseapxp248 vulnerabilities

Red Hat Ansible Automation Platform247 vulnerabilities

Red Hat Jboss Fuse241 vulnerabilities

Red Hat Single Sign On236 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Jboss Data Grid216 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Openshift Devspaces161 vulnerabilities

Red Hat Acm160 vulnerabilities

Red Hat Quay159 vulnerabilities

Red Hat Enterprise Linux Ai157 vulnerabilities

Red Hat Rhdh128 vulnerabilities

Red Hat Discovery126 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat121 vulnerabilities

Red Hat Ai Inference Server116 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Camel Spring Boot111 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Kafka104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform102 vulnerabilities

Red Hat Ansible Automation Platform Developer102 vulnerabilities

Red Hat Rhui100 vulnerabilities

Red Hat Apache Camel Hawtio99 vulnerabilities

Red Hat Ceph Storage99 vulnerabilities

Red Hat Multicluster Engine99 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Openshift Pipelines95 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Amq Broker94 vulnerabilities

Red Hat Ansible Automation Platform Inside92 vulnerabilities

Red Hat Logging92 vulnerabilities

Red Hat Container Native Virtualization92 vulnerabilities

Red Hat Advanced Cluster Security91 vulnerabilities

Red Hat Quarkus91 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Amq Streams86 vulnerabilities

Red Hat Service Mesh85 vulnerabilities

Red Hat Openshift Data Foundation84 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Camel Quarkus79 vulnerabilities

Red Hat Ansible Portal78 vulnerabilities

Red Hat Apicurio Registry77 vulnerabilities

Red Hat Serverless76 vulnerabilities

Red Hat Openshift Lightspeed75 vulnerabilities

Red Hat Http Server74 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Migration Toolkit Applications71 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Satellite Capsule68 vulnerabilities

Red Hat Cert Manager68 vulnerabilities

Red Hat Openshift Gitops68 vulnerabilities

Red Hat 3scale Amp64 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Podman Desktop58 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Rhmt56 vulnerabilities

Red Hat Debezium55 vulnerabilities

Red Hat Multicluster Globalhub55 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Directory Server55 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Satellite Utils54 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Jboss Core Services48 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Confidential Compute Attestation45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Red Hat Enterprise Linux Server Update Services Sap Solutions43 vulnerabilities

Red Hat Enterprise Linux For Real Time43 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:82059	(RHSA-2026:82059) Red Hat AI Inference 3.5.2 (ROCm)	October 13, 2026
RHSA-2026:82055	(RHSA-2026:82055) OpenShift Container Platform 4.18 CNF IBU extras update	October 13, 2026
RHSA-2026:82054	(RHSA-2026:82054) OpenShift Container Platform 4.20 CNF vRAN extras topology aware lifecycle manager update	October 13, 2026
RHSA-2026:82053	(RHSA-2026:82053) OpenShift Container Platform 4.19 CNF vRAN extras topology aware lifecycle manager update	October 13, 2026
RHSA-2026:82052	(RHSA-2026:82052) OpenShift Container Platform 4.18 CNF vRAN extras topology aware lifecycle manager update	October 13, 2026
RHSA-2026:82041	(RHSA-2026:82041) Important: python-tornado security update	October 13, 2026
RHSA-2026:82040	(RHSA-2026:82040) Important: python-tornado security update	October 13, 2026
RHSA-2026:82015	(RHSA-2026:82015) Important: xorg-x11-server security update	October 13, 2026
RHSA-2026:81913	(RHSA-2026:81913) Important: thunderbird security update	October 13, 2026
RHSA-2026:81912	(RHSA-2026:81912) Important: thunderbird security update	October 13, 2026

By the Year

In 2026 there have been 4377 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1195 security vulnerabilities published. That is, 3182 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.42.

Year	Vulnerabilities	Average Score
2026	4377	7.29
2025	1195	6.87
2024	1702	6.83
2023	1207	6.74
2022	1362	6.97
2021	1123	6.55
2020	664	6.38
2019	772	6.97
2018	761	7.15

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-83535	Oct 12, 2026	OpenStack Network Exporter Basic Auth Bypass via TLS Misconfig A flaw was found in openstack-network-exporter. When an operator configures user authentication but omits or misconfigures Transport Layer Security (TLS), the basic authentication mechanism is silently bypassed. This fail-open design allows an adjacent network attacker to access sensitive Open vSwitch (OVS) and Open Virtual Network (OVN) dataplane metrics without credentials. Consequently, an attacker can enumerate bridge names, port counters, OVN controller state, and host topology, leading to information disclosure.	Openstack
CVE-2026-83536	Oct 12, 2026	openstack-network-exporter DoS via missing ReadHeaderTimeout A flaw was found in openstack-network-exporter. The HTTP server within the component is configured without essential timeout settings, such as ReadHeaderTimeout. This vulnerability allows an unauthenticated, remote attacker to initiate multiple slow HTTP header connections. By trickling header bytes, the attacker can exhaust server resources, specifically file descriptors, leading to a Denial of Service (DoS) that prevents legitimate Prometheus metric scraping and alerting.	Openstack
CVE-2026-85471	Oct 12, 2026	Quay SSRF: Hostname blacklist bypass in webhook notifications A flaw was found in Quay. An authenticated repository administrator could bypass the hostname blacklist in webhook notifications, leading to a Server-Side Request Forgery (SSRF) vulnerability. This allows the Quay application to be tricked into sending requests to internal network resources, such as cloud metadata services or other services within the cluster. Consequently, this could lead to the disclosure of sensitive information from these internal services.	Mirror Registry Quay
CVE-2026-87744	Oct 12, 2026	Quarkus REST Panache unauth access via @MethodProps A flaw was found in Quarkus REST Data Panache. This vulnerability allows unauthenticated attackers to bypass security controls on generated endpoints. When a developer customizes a specific operation using @MethodProperties without explicitly re-declaring security roles, the code generator silently drops class-level security requirements. This results in the affected endpoint defaulting to permissive, unauthenticated access, potentially leading to unauthorized information disclosure or data modification.	Exploit Intelligence Quarkus
CVE-2026-75888	Oct 12, 2026	OpenShift Console SSRF via Helm Chart URL (CVE-2026-75888) A flaw was found in the OpenShift console. An authenticated console user can exploit a Server-Side Request Forgery (SSRF) vulnerability by providing a specially crafted Helm chart URL without proper validation. This allows the user to make the console pod fetch arbitrary URLs, potentially leading to the disclosure of sensitive information through error messages or enabling blind port scanning within the cluster.	Openshift
CVE-2026-94451	Oct 12, 2026	Quarkus REST Data Panache Sort Param Bypass Allows Data Leak & DoS Quarkus REST Data Panache provides a way to automatically generate REST endpoints for data entities. A flaw was found where certain endpoints do not properly check the sort parameter provided by users. This could allow an attacker to learn information they should not have access to or slow down the system by forcing the database to perform complex tasks, potentially causing a denial of service.	Exploit Intelligence Quarkus
CVE-2026-52903	Oct 12, 2026	Deserialization RCE via YAML.safe_load override in ManageIQ A deserialization of untrusted data vulnerability was found in ManageIQ. The YamlLoadAliases module overrides YAML.safe_load to silently fall back to YAML.unsafe_load in production when a Psych::DisallowedClass error occurs. An authenticated attacker with dialog import access can exploit this to achieve remote code execution by uploading a crafted YAML payload that triggers the fallback and deserializes arbitrary Ruby objects. Red Hat CloudForms, which was based on ManageIQ, has reached End of Life and is no longer supported. No errata or patches will be issued. This CVE is being assigned for the benefit of the ManageIQ community and downstream consumers.
CVE-2026-94447	Oct 08, 2026	Go cmd/go Checksum Bypass (Go <1.26.9, 1.27.0-1.27.2) Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/toolchain go.sum entry and operates a malicious GOMODPROXY the user chooses to use can bypass the intended checksum. We now ensure that golang.org/toolchain always goes to the network for the canonical checksum.
CVE-2026-94444	Oct 08, 2026	Go cmd/go Module Injection via bogus golang.org/fips140 (<=1.27.1) Previously, a user operating inside of a malicious Go project that defines a bogus golang.org/fips140 and operates a malicious GOMODPROXY the user chooses to connect to can serve an arbitrary module in its place. We now unpack the trusted ziphash for the bundled golang.org/fips140 module and construct its entry in the GOMODCACHE such that it can be verified by the toolchain.
CVE-2026-89091	Oct 08, 2026	Ansible Core Tarball Path Traversal via Symlink Chain Exploit A flaw was found in ansible-core. When installing a collection with `ansible-galaxy collection install`, the archive extractor validates member paths using lexical path normalisation (os.path.abspath) instead of resolving symbolic links (os.path.realpath), and it performs no containment check on symlink-typed directory members before creating them. A crafted collection tarball can chain symlink directory entries so that a subsequent file member is written outside the intended destination directory. This allows an attacker who can get a victim to install a malicious collection to overwrite arbitrary files with the privileges of the user running ansible-galaxy, leading to code execution on the control node. This is a bypass of the fix for CVE-2020-10691.	Migration Toolkit Applications Migration Toolkit Virtualization Service Mesh And others...
CVE-2026-93017	Oct 08, 2026	OpenShift Insights Operator: Misconfigured ClusterRole Grants All Secrets The `insights-operator-gather` ClusterRole grants the operator's service account read access to secrets in the core API group with no namespace or resourceNames restriction therefore, access to every secret in every namespace in the cluster. Ref: https://github.com/openshift/insights-operator/blob/8f15e3157ff09f54ab22801f5b21da35a195cc6d/manifests/03-clusterrole.yaml#L368-L373 ``` - apiGroups: - "" resources: - secrets verbs: - get - list ``` By spawning a pod with the gather service account mounted, an attacker will be able to access any secret in any namespace. ``` spec: serviceAccountName:"gather" ```	Openshift
CVE-2026-56851	Oct 07, 2026	Nickname Profile Out-of-Bounds Panic in Go The Nickname profile can panic with an out-of-bounds slice error when transforming crafted input into a short destination buffer.
CVE-2026-77214	Oct 07, 2026	Heap Buffer Over-Read in libexpat XML_ParseBuffer (CVE-2026-77214) libexpat before commit 13c5f63 contains a heap buffer over-read vulnerability in xmlparse.c. XML_ParseBuffer advances the parse buffer end with parser->m_bufferEnd += len using a caller-supplied length that is not validated against the allocated buffer size, so repeated XML_ParseBuffer calls move m_bufferEnd past the end of the heap allocation and subsequent parsing reads out of bounds. Reaching this path requires a parse buffer to already be present; otherwise XML_ParseBuffer returns XML_ERROR_NO_BUFFER. A buffer is present after a prior call to XML_GetBuffer, either directly (the common case) or indirectly through a prior XML_Parse call that allocates the buffer internally. The over-read discloses adjacent heap memory to the calling application, recovering heap pointers, libc function pointers, and code pointers sufficient to defeat ASLR and build further exploitation primitives.
CVE-2026-80048	Oct 06, 2026	Red Hat sssd-kcm Local DoS via Large Request Header A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments.	Enterprise Linux (RHEL) Openshift
CVE-2026-76061	Oct 06, 2026	CRI-O bind_mount_prefix Symlink Spoof leads to Host Path Escalation A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.	Openshift
CVE-2026-83550	Oct 06, 2026	Go Postgres-Exporter: pprof debug endpoints exposed, info disclosure & DoS A flaw was found in postgres-exporter. Due to the blank import of `net/http/pprof`, debug endpoints are exposed on the unauthenticated metrics listener. A remote attacker within the cluster network can access these endpoints. This allows for information disclosure, potentially revealing process arguments, full goroutine stacks, and sensitive data like database connection strings or passwords from heap dumps. Additionally, repeated CPU profiling through these endpoints can lead to a denial of service.	Multicluster Globalhub
CVE-2026-88252	Oct 06, 2026	SSSD Local DoS via Responder Service File Descriptor Exhaustion A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.	Enterprise Linux (RHEL) Openshift
CVE-2026-92821	Oct 06, 2026	SSSD LDAP Expired-Password Bypass via Early Rule Termination A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.	Enterprise Linux (RHEL) Openshift
CVE-2026-71297	Oct 05, 2026	Red Hat Maestro gRPC Broker Auth Bypass via Client Cert A flaw was found in the maestro gRPC broker. This vulnerability allows a remote attacker, with a valid client certificate, to bypass authentication. This bypass enables the attacker to subscribe to other consumers' event streams, leading to unauthorized information disclosure, or to publish forged agent status, which can compromise data integrity.	Multicluster Engine
CVE-2026-71299	Oct 05, 2026	Maestro REST API Auth Bypass: UnAuth Writes Possible A flaw was found in Maestro. Its REST API write endpoints were registered without proper authentication middleware. This allows a remote attacker to perform unauthorized write operations, such as creating, modifying, or deleting consumers and resource bundles. This could lead to data integrity issues or a denial of service (DoS).	Multicluster Engine
CVE-2026-71298	Oct 05, 2026	Unauthenticated SQLi in RedHat Maestro REST orderBy for Data Exfiltration A flaw was found in maestro. A remote attacker could exploit a SQL injection vulnerability in the `orderBy` query parameter of its REST API list endpoints. This flaw, which does not require authentication, allows for read-only blind extraction of data from the database.	Multicluster Engine
CVE-2026-94422	Oct 02, 2026	xdg-dbus-proxy <0.1.9 Bypass DBus Message Filtering, Code Exec An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use this to achieve arbitrary code execution outside its sandbox. xdg-dbus-proxy was designed to be part of the sandbox boundary for Flatpak, but it is released as a separate project and is sometimes used by other app frameworks such as Firejail.	Enterprise Linux (RHEL)
CVE-2026-83663	Oct 02, 2026	Apache Thrift Go Bindings Uncontrolled Recursion (pre-0.25.0) Uncontrolled Recursion vulnerability in Apache Thrift go bindings. Both Go transports satisfy a read out of a buffered frame and, when that frame yields no payload bytes, read the next frame and call `Read` again instead of looping. A peer produces such a frame for 4 bytes in `TFramedTransport` (a declared size of zero) or 18 bytes in `THeaderTransport` (a header block that fills the frame), so nothing bounds the depth. The Go stack limit is reached as a `fatal error`, which `recover()` cannot catch, so the whole process dies. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94637	Oct 02, 2026	Data Amplification via Compression in Apache Thrift Go <0.25.0 Improper handling of highly compressed data (data amplification) vulnerability in Apache Thrift Go bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-90440	Oct 02, 2026	Apache Thrift v<0.25.0 TNonblockingServer Exception Resource Shutdown CVE Uncaught exception, improper handling of exceptional conditions, improper resource shutdown vulnerability in Apache Thrift D thrift.server.nonblocking.TNonblockingServer. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-87117	Oct 02, 2026	CVE-2026-87117: Null Pointer Deref in Apache Thrift PHP Bindings before 0.25.0 NULL pointer dereference vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85087	Oct 02, 2026	Thrift Py Bindings CVE-2026-85087 Improper Cert Val Before 0.25.0 Improper certificate validation, Return of wrong status code vulnerability in Apache Thrift python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85086	Oct 02, 2026	Apache Thrift <0.25.0 Improper Cert Validation in Perl Bindings Improper certificate validation, Initialization of a resource with an insecure default vulnerability in Apache Thrift perl bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-82459	Oct 02, 2026	Apache Thrift Int Underflow/OOB in 32bit THeaderTransport (0.24) Integer underflow (wrap or wraparound), Out-of-bounds write vulnerability in Apache Thrift C++ 32 bit THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-82458	Oct 02, 2026	Memory Allocation DoS in Apache Thrift <0.25.0 (CVE-2026-82458) Memory allocation with excessive size value, Allocation of resources without limits or throttling vulnerability in Apache Thrift Go, netstd, OCaml, Erlang, JavaME, Rust, C++, Java, Kotlin and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-96288	Oct 02, 2026	Apache Thrift Erlang Bindings Uncontrolled Recursion (before 0.25.0) Uncontrolled Recursion, Allocation of resources without limits or throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-96292	Oct 02, 2026	Apache Thrift Lua Binding ReDoS before 0.25.0 Inefficient regular expression complexity, Inefficient Algorithmic Complexity vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-96294	Oct 02, 2026	Apache Thrift NodeJS Bindings: Improper Exception Handling (pre-0.25.0) Uncaught exception, Improper Handling of Exceptional Conditions vulnerability in Apache Thrift NodeJS bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-96990	Oct 02, 2026	Apache Thrift Erlang: Resource Exhaustion before 0.25.0 Allocation of Resources Without Limits or Throttling vulnerability in Apache Thrift Erlang bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94644	Oct 02, 2026	Apache Thrift PHP Bindings Resource Exhaustion Pre0.25.0 Allocation of resources without limits or throttling vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94645	Oct 02, 2026	Apache Thrift NodeJS Bindings: Unbounded Resource Allocation (0.25.0) Improper validation of specified quantity in input, Allocation of resources without limits or throttling vulnerability in Apache Thrift nodejs bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94650	Oct 02, 2026	Uncontrolled Recursion in Apache Thrift c_glib Bindings before 0.25.0 Uncontrolled Recursion vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85483	Oct 02, 2026	Uninitialized resource & wrong status in Apache Thrift c_glib (v<0.25.0) Use of uninitialized resource, Return of wrong status code vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85493	Oct 02, 2026	Apache Thrift Uncontrolled Recursion in Dart/Java ME Bindings (0.24.9) Uncontrolled Recursion vulnerability in Apache Thrift Dart and Java ME bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-85494	Oct 02, 2026	Apache Thrift 0.25.0: Improper Length Handling in Bindings Improper handling of length parameter inconsistency, Uncaught exception, Inefficient Algorithmic Complexity, Memory allocation with excessive size value, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python, Ruby, Erlang, Lua, Dart, JavaME, Perl, PHP and D language bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-91137	Oct 02, 2026	Apache Thrift PHP: Improper Qty Validation / Unthrottled Resrc. (0.24.0) Improper validation of specified quantity in input, Allocation of resources without limits or throttling, Excessive Iteration vulnerability in Apache Thrift PHP bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-93925	Oct 02, 2026	Apache Thrift: Stack overflow in THeaderProtocol before 0.25.0 Stack-based buffer overflow, Incorrect bitwise shift of integer vulnerability in Apache Thrift C++ THeaderProtocol. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-93926	Oct 02, 2026	Apache Thrift <0.25.0 Memory Leak in THeaderTransport Missing release of memory after effective lifetime, Missing release of resource after effective lifetime vulnerability in Apache Thrift THeaderTransport. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94633	Oct 02, 2026	Memory alloc with excessive size in Apache Thrift Dart bindings before 0.25.0 Memory allocation with excessive size value, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Dart bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94634	Oct 02, 2026	Apache Thrift Python Bindings Resource Exhaustion Before 0.25.0 Allocation of resources without limits or throttling, Initialization of a resource with an insecure default vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-94635	Oct 02, 2026	Apache Thrift Lua Bindings 0.24 Unbounded Resource Allocation CVE-2026-94635 Allocation of resources without limits or throttling, Improper handling of length parameter inconsistency vulnerability in Apache Thrift Lua bindings. This issue affects Apache Thrift: before 0.25.0. Users are recommended to upgrade to version 0.25.0, which fixes the issue.
CVE-2026-95512	Oct 02, 2026	FreeType CID Font Loader Memory DoS via Repeated Allocations A flaw was found in FreeType, specifically within its CID font loader. A remote attacker could exploit this vulnerability by tricking a user into opening content that embeds or references a specially crafted CID-keyed font. This crafted font can cause repeated allocations and decryptions of subroutine data across multiple font dictionaries, leading to excessive memory and CPU consumption. This can result in a denial of service (DoS) for the application or service processing the font, potentially causing it to hang or terminate.	Openjdk Els Enterprise Linux (RHEL) Hummingbird And others...
CVE-2026-86345	Oct 01, 2026	389-ds-base LDAP StartTLS buffer injection allows auth bypass A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose response is delivered to the client in place of the client's own pending operation's response, due to messageID collision. This can cause a client application to treat a failed authentication (bind) attempt as successful.	Directory Server Enterprise Linux (RHEL)
CVE-2026-86344	Oct 01, 2026	389-ds LDAP Thread Exhaustion DoS via Incomplete LDAPMessage A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before the first worker's result is flushed. The second worker blocks until nsslapd-ioblocktimeout while holding the connection mutex, preventing delivery of the completed operation's result. Repeating this across a small number of connections proportional to the configured worker-thread pool size exhausts the entire pool under default configuration, denying service to all clients (anonymous and authenticated, plaintext and TLS) for as long as the attacker maintains the connections.	Directory Server Enterprise Linux (RHEL)
CVE-2026-56098	Oct 01, 2026	Katello RegistryProxiesController Auth Bypass Enables User Enumeration A flaw was found in rubygem-katello. The RegistryProxiesController in Katello contains an authorization bypass vulnerability due to an execution fall-through in the registry_authorize filter. While the application identifies unauthorized requests and triggers an error response via the unauthorized method, it fails to halt the execution of the current code path (missing return statement). This failure in the control flow allows the application to proceed into subsequent business logic and database validation filters. Consequently, the application reveals its internal state through differential responses, allowing an unprivileged attacker to enumerate valid Users, Organizations, and Products across the entire instance.	Satellite Satellite Capsule Satellite Utils And others...