Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:68787 | (RHSA-2026:68787) Important: perl-Net-DNS security update | September 17, 2026 |
| RHSA-2026:68786 | (RHSA-2026:68786) Important: perl-Net-DNS security update | September 17, 2026 |
| RHSA-2026:68780 | (RHSA-2026:68780) Technical preview of the satellite/iop-vmaas-rhel9 container image | September 17, 2026 |
| RHSA-2026:68776 | (RHSA-2026:68776) satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview | September 17, 2026 |
| RHSA-2026:68775 | (RHSA-2026:68775) General availability of the satellite/iop-insights-engine-rhel9 container image | September 17, 2026 |
| RHSA-2026:68771 | (RHSA-2026:68771) satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview | September 17, 2026 |
| RHSA-2026:68770 | (RHSA-2026:68770) General availability of the satellite/iop-insights-engine-rhel9 container image | September 17, 2026 |
| RHSA-2026:68765 | (RHSA-2026:68765) Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image | September 17, 2026 |
| RHSA-2026:68766 | (RHSA-2026:68766) General availability of the satellite/iop-remediations-rhel9 container image | September 17, 2026 |
| RHSA-2026:68764 | (RHSA-2026:68764) Technical preview of the satellite/iop-vmaas-rhel9 container image | September 17, 2026 |
By the Year
In 2026 there have been 3432 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1179 security vulnerabilities published. That is, 2253 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.37.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 3432 | 7.23 |
| 2025 | 1179 | 6.86 |
| 2024 | 1695 | 6.82 |
| 2023 | 1207 | 6.75 |
| 2022 | 1362 | 6.96 |
| 2021 | 1123 | 6.61 |
| 2020 | 664 | 6.39 |
| 2019 | 772 | 6.98 |
| 2018 | 760 | 7.16 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-94001 | Sep 19, 2026 |
Keycloak Admin REST API DeleteCred PrivEsc for Delegated AdminA flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be restricted from resetting passwords, to delete a user's password credentials, resulting in the user being unable to log in. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-94000 | Sep 19, 2026 |
Privilege Escalation via Keycloak Admin REST Group-Membership APIA flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints where the system fails to check if a group grants administrative privileges before allowing a user to be added. This allows a delegated administrator with limited permissions to add themselves to a high-privilege group, potentially gaining full control over the entire realm. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-93999 | Sep 19, 2026 |
Keycloak OIDC Token Refresh Bypass for Disabled ClientsA flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token refresh process when the server restores requested audiences from stored client IDs. Keycloak fails to verify if the target audience client is still enabled before issuing a new access token. This allows an application with an existing refresh token to continue obtaining valid access tokens for a disabled client, potentially bypassing administrative access controls for resource servers that rely on offline JWT validation. |
Build Keycloak
Red Hat Single Sign On
|
| CVE-2026-75885 | Sep 18, 2026 |
OpenShift Console Unauth devfile API SSRF/DoSA flaw was found in the OpenShift console. Unauthenticated access to the `/api/devfile/` and `/api/devfile/samples/` endpoints allows a remote attacker to send crafted devfile payloads. This can lead to Server-Side Request Forgery (SSRF), where the console pod makes requests to internal services and reflects partial responses to the attacker. Additionally, by sending repeated large requests without a specified content length, an attacker can cause unbounded memory growth, leading to a Denial of Service (DoS). |
Openshift
|
| CVE-2026-93562 | Sep 18, 2026 |
Netty HTTP/1 Decoder Request Smuggling via Malformed Transfer-EncodingA flaw was found in Netty's HTTP/1 decoder. Incomplete validation of malformed Transfer-Encoding headers allows a remote attacker to perform HTTP request smuggling. By sending specially crafted HTTP requests, an attacker can inject arbitrary HTTP requests, potentially bypassing security controls or accessing unauthorized resources. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-93574 | Sep 18, 2026 |
Netty netty-codec-http HTTP Smuggling via Chunk-Size Post-Digit WhitespaceA flaw was found in Netty's `netty-codec-http` component. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP/1.1 chunk-size token that includes post-digit whitespace. This incorrect parsing of the chunk size can lead to HTTP request smuggling. This allows an attacker to bypass security controls or access unauthorized resources in proxy/backend deployments. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-91202 | Sep 18, 2026 |
cockpit-files symlink exploitation: lowpriv local user can change file ownershipA flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link (symlink) and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory, leading to a compromise of data integrity. In some cases, this could also lead to reduced confidentiality if the new ownership grants unauthorized read access. Exploitation requires user interaction to select a non-original owner during the paste operation. |
Enterprise Linux (RHEL)
|
| CVE-2026-91203 | Sep 18, 2026 |
Red Hat Cockpit-files Symlink Race Local Privilege EscalationA flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can redirect these operations to unintended files. This could lead to unauthorized changes in file ownership and permissions on arbitrary files, potentially compromising system integrity and availability by altering system or application states or rendering services unusable. |
Enterprise Linux (RHEL)
|
| CVE-2026-91205 | Sep 18, 2026 |
Unprivileged Race Condition in cockpit-files Enables Symlink AttackA flaw was found in cockpit-files. A local unprivileged attacker can exploit a race condition during directory creation with owner assignment. By controlling a writable parent directory, the attacker can replace a newly created directory with a symbolic link (symlink) before the ownership change operation (chown) is applied. This allows the attacker to redirect the ownership change to an arbitrary file, potentially leading to information disclosure or unauthorized modification of sensitive files. |
Enterprise Linux (RHEL)
|
| CVE-2026-92768 | Sep 18, 2026 |
cockpitmachines CLI Arg Disclosure: VM Credentials LeakedA flaw was found in cockpit-machines. This vulnerability allows a local attacker to expose sensitive Virtual Machine (VM) credentials, including plaintext passwords, by inspecting process command-line arguments during VM creation or installation. The cockpit-machines component passes password values directly on the command line, making them visible to other local users on systems where process arguments are not restricted. Successful exploitation leads to information disclosure, potentially compromising VM access. |
Enterprise Linux (RHEL)
|
| CVE-2026-92747 | Sep 18, 2026 |
Local Inspection Disclosure in cockpit-machines install_machine JSONA flaw was found in `cockpit-machines`. This vulnerability allows a local attacker with the ability to inspect running processes to expose sensitive guest virtual machine (VM) credentials, such as `rootPassword` and `userPassword`. This occurs when the `install_machine.py` script passes these credentials as a JSON command-line argument during VM creation or installation. The exposure is limited to the period when the installation workflow is active and depends on host process-visibility policies. |
Enterprise Linux (RHEL)
|
| CVE-2026-92745 | Sep 18, 2026 |
Local Process Metadata Disclosure in cockpit-machines via RHSM Offline Token LeakA flaw was found in cockpit-machines. This vulnerability allows a local attacker with the ability to inspect process metadata to disclose a sensitive Red Hat Subscription Management (RHSM) offline token. The token is exposed when it is passed as a command-line argument to a helper script during the token validation process. Successful exploitation could lead to the compromise of confidentiality, as the exposed token can be used to request access tokens. |
Enterprise Linux (RHEL)
|
| CVE-2026-93432 | Sep 18, 2026 |
RedHat Quarkus Qute XSS via Unescaped eval Sub-TemplateA flaw was found in the Quarkus Qute template engine. When the {#eval} section helper processes a sub-template, it fails to pass the parent template's content type information. This bypasses standard escaping mechanisms, allowing untrusted data to be output as raw, unescaped text. This vulnerability can lead to Cross-Site Scripting (XSS) and JSON Injection, potentially allowing a remote attacker to execute arbitrary code in a user's browser or manipulate data. |
Exploit Intelligence
Camel Quarkus
Apicurio Registry
And others... |
| CVE-2026-91142 | Sep 18, 2026 |
Cockpit ILP32 Integer Overflow Enables Unauthorized lastlog AccessA flaw was found in Cockpit. An integer overflow vulnerability in the `do_lastlog()` function, specifically in the offset calculation for `lastlog` entries on ILP32 (Integer, Long, Pointer 32-bit) builds, can be exploited. A low-privileged authenticated user with a specially provisioned large User ID (UID) can cause the computed offset to wrap around. This allows the user to perform unauthorized reads and writes to other users' `lastlog` records, potentially disclosing or altering sensitive login accounting information. |
Enterprise Linux (RHEL)
Openshift Devspaces
|
| CVE-2026-91147 | Sep 18, 2026 |
Red Hat cockpit-ws Remote Unauthenticated DoS via URL-Root PrefixA flaw was found in `cockpit-ws`. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a specially crafted request. When the `WebService.UrlRoot` is configured and a request is made to the exact URL-root prefix without a trailing slash, `cockpit-ws` can terminate unexpectedly. This issue leads to the unavailability of the Cockpit web service. |
Enterprise Linux (RHEL)
Openshift Devspaces
|
| CVE-2026-91149 | Sep 18, 2026 |
RedHat Cockpit DoS via Unbounded Thread Creation (CVE-2026-91149)A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the `cockpit-tls` service. This forces the service to create an unbounded number of detached threads, consuming system resources such as memory and file descriptors. The primary consequence is a denial of service (DoS), leading to degradation or complete unavailability of the Cockpit service for legitimate users. |
Enterprise Linux (RHEL)
Openshift Devspaces
|
| CVE-2026-93579 | Sep 18, 2026 |
Netty HTTP/2 Header Field Injection Vulnerability (CVE-2026-93579)A flaw was found in Netty's HTTP/2 stack. This vulnerability allows a remote attacker to inject prohibited characters, such as NUL, Line Feed, and Carriage Return, into HTTP/2 header field values due to insufficient validation. When these values cross an HTTP/2 to HTTP/1.1 translation boundary, they can be exploited for request smuggling, header injection, or response splitting. This could lead to unauthorized access, data manipulation, or other security bypasses. |
Amq Broker
Camel Quarkus
Camel Spring Boot
And others... |
| CVE-2026-93685 | Sep 18, 2026 |
RedHat Multicluster Observability Addon: Auth Bypass on Debug EndpointA flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and command-line details, after completing a basic encrypted connection. This vulnerability does not enable direct remote code execution. |
Acm
|
| CVE-2026-93573 | Sep 18, 2026 |
Netty Transfer-Encoding Field Split Bypass Enables Request SmugglingA flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass `Transfer-Encoding` header validation by splitting the `Transfer-Encoding` field across multiple headers, with the last field containing a non-final transfer coding like `gzip` or `deflate`. This bypass can lead to HTTP request smuggling, enabling attackers to bypass security controls, desynchronize request processing, or cause requests to be processed in an unintended context. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-93568 | Sep 18, 2026 |
Red Hat: HTTP/2/3 EXT CONNECT Downgrade in Apache HTTPdA flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical protocol and path information. This misinterpretation can allow attackers to bypass security policies, such as routing or authorization logic, in applications that rely on Netty for HTTP/2 or HTTP/3 communication, resulting in integrity loss. |
Amq Broker
Camel Quarkus
Camel Spring Boot
And others... |
| CVE-2026-93576 | Sep 18, 2026 |
Netty netty-codec-smtp SMTP cmd-name not CRLF-validated VulnerabilityA flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return (CR) and Line Feed (LF) characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP commands. This can lead to SMTP command smuggling, allowing for unauthorized email relay or spoofing of sender/recipient addresses. While the impact is significant, the real-world exploitability is considered lower as applications typically do not place user-controlled data in the command-name field. |
Camel Spring Boot
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-85511 | Sep 18, 2026 |
EAP Elytron Token-Realm OAuth2 Introspection URL Encoding FlawA flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding. |
Jboss Enterprise Application Platform
Jbosseapxp
|
| CVE-2026-93569 | Sep 18, 2026 |
Netty HTTP/1HTTP/2 Host Header Conflict Allows Unauthorized AccessA flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2 :authority field, discarding the original request-target authority. This inconsistency can allow an attacker to bypass security controls in Netty-based proxies or gateways, potentially leading to unauthorized access, cache poisoning, or misrouting of requests. |
Amq Broker
Camel Quarkus
Camel Spring Boot
And others... |
| CVE-2026-93567 | Sep 18, 2026 |
Netty HTTP/2 CONNECT Host Header Exploit Bypass Tunnel Allow-ListA flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leading to a malformed HTTP/2 CONNECT request. This can bypass security controls such as tunnel allow-lists or egress policies, resulting in integrity loss. |
Amq Broker
Camel Quarkus
Camel Spring Boot
And others... |
| CVE-2026-93676 | Sep 18, 2026 |
xdg-dbus-proxy D-Bus Broadcast Filter Bypass Enables Flatpak Signal Interceptxdg-dbus-proxy incorrectly filters D-Bus broadcast messages, bypassing configured path, interface, and member restrictions. This allows a sandboxed Flatpak application to intercept broadcast signals on the D-Bus session bus and AT-SPI bus that should be restricted, potentially exposing sensitive information to unauthorized applications. |
Enterprise Linux (RHEL)
|
| CVE-2026-93566 | Sep 18, 2026 |
Netty HTTP Request Smuggling via Chunk-Size Line BypassA flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can lead to HTTP request smuggling, potentially resulting in information disclosure or other unauthorized actions. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-10832 | Sep 18, 2026 |
WildFly Elytron ASN1 DERDecoder DoS via Excessive Memory AllocationA flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER (Distinguished Encoding Rules) payload. The decoder attempts to allocate excessive memory based on an inflated length value without proper validation, leading to Java Virtual Machine (JVM) memory exhaustion. This results in a remote Denial of Service (DoS) for services that process untrusted DER/ASN.1 input, including SASL (Simple Authentication and Security Layer) authentication mechanisms and X.500 certificate principal parsing paths. |
Cryostat
Camel Quarkus
Apache Camel Hawtio
And others... |
| CVE-2026-93565 | Sep 18, 2026 |
Netty RtspDecoder Method-Token Smuggling via RTSP RequestA flaw was found in Netty RtspDecoder. The `RtspMethods.valueOf()` function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol (RTSP) requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. This vulnerability allows an attacker to bypass method-based access controls and can also be used to launder malicious requests through Netty-based RTSP proxies, making them appear legitimate to backend systems. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-93653 | Sep 18, 2026 |
DenialofService in Poppler Splash via tilingpattern overflowA denial of service flaw was found in Poppler's Splash backend. A crafted PDF with tiling-pattern geometry approaching the int32 boundary can cause SplashOutputDev::tilingPatternFill to compute an attacker-controlled repeat count that drives an excessively long loop in the pattern-fill scanline routine, without a corresponding memory allocation. An attacker could exploit this by supplying a malicious PDF to an application that renders it via Poppler's Splash backend, causing the rendering process to consume 100% CPU for an attacker-controlled, extended duration. |
Enterprise Linux (RHEL)
Hummingbird
|
| CVE-2026-93564 | Sep 18, 2026 |
Netty HAProxy PROXY-v2 RefCnt Leak: Remote DoSA flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service (DoS) for the affected system. |
Amq Broker
Camel Quarkus
Camel Spring Boot
And others... |
| CVE-2026-93558 | Sep 18, 2026 |
Netty WebSocketServerExtensionHandler DoS via HTTP/1.1 Pipelining Queue OverflowA flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive memory. Eventually, this can cause the Java Virtual Machine (JVM) to exhaust its heap, resulting in a Denial of Service (DoS) for the affected server. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-93560 | Sep 18, 2026 |
Netty STOMP codec int truncation can cause DoSA flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service (DoS) by exhausting memory and CPU resources. |
Camel Spring Boot
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-93492 | Sep 18, 2026 |
Netty HpackEncoder DoS via oversized SETTINGS MAX_HEADER_TABLE_SIZEA flaw was found in Netty's HTTP/2 HpackEncoder. A remote attacker can exploit this by sending HTTP/2 SETTINGS frames with a very large MAX_HEADER_TABLE_SIZE. This causes the HpackEncoder to store an excessive number of unique headers, leading to increased CPU usage and memory consumption, ultimately resulting in a Denial of Service (DoS). |
Amq Broker
Camel Quarkus
Camel Spring Boot
And others... |
| CVE-2026-93491 | Sep 18, 2026 |
Netty HttpServerCodec DoS via HTTP/1.1 pipelining (before 4.2)A flaw was found in Netty's HttpServerCodec. A remote, unauthenticated attacker can exploit this vulnerability by pipelining HTTP/1.1 requests on a single connection and withholding reads. This action causes the methodOverflowQueue to grow without limit, leading to unbounded heap memory consumption and a denial of service due to memory exhaustion. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-93488 | Sep 18, 2026 |
Netty SpdySessionHandler Unbounded Streams DoSA flaw was found in Netty. SpdySessionHandler accepts an unlimited number of concurrent remote-initiated streams because localConcurrentStreams defaults to Integer.MAX_VALUE and the handler provides no API to change it. A remote peer can open a SPDY connection and send a large number of SYN_STREAM frames with FLAG_FIN=0, causing unbounded heap and direct memory allocation that can lead to JVM OutOfMemoryError and a denial of service. |
Amq Broker
Amq Clients
Camel Quarkus
And others... |
| CVE-2026-93563 | Sep 18, 2026 |
MemEx DoS via Unbounded Multi-line Response in SmtpResponseDecoder (Apache MINA)A flaw was found in Netty's `SmtpResponseDecoder` component. A remote attacker, acting as a malicious or man-in-the-middle (MITM) SMTP server, could exploit this by sending a specially crafted, unbounded multi-line SMTP response without a terminator. This vulnerability leads to unbounded memory accumulation within the client's Java Virtual Machine (JVM) heap, causing an `OutOfMemoryError` and a denial of service (DoS) due to a process crash. |
Camel Spring Boot
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-81627 | Sep 18, 2026 |
Privilege Escalation via VAPIC Alias Overflow in QEMUA flaw was found in QEMU. The VAPIC setup hypercall in hw/i386/vapic.c does not validate that the writable RAM alias remains within the option ROM window. A privileged guest user on a Q35/KVM machine can position this alias over locked SMRAM, bypassing chipset D_LCK protection and injecting code into System Management Mode memory. |
Enterprise Linux (RHEL)
Enterprise Linux Nvidia
Openshift
And others... |
| CVE-2026-93578 | Sep 18, 2026 |
CVE-2026-93578: Missing EKU Check in OCSP Client Allows Revocation BypassA flaw was found in Netty's Online Certificate Status Protocol (OCSP) Client. The client fails to verify the 'id-kp-OCSPSigning' Extended Key Usage (EKU) in OCSP responder certificates. A remote attacker, holding any valid certificate issued by the same Certificate Authority (CA), can exploit this by forging 'GOOD' OCSP responses for revoked certificates. This bypasses certificate revocation checks, allowing applications using Netty's OCSP Client to accept certificates that should have been revoked, leading to an authorization bypass. |
Camel Spring Boot
|
| CVE-2026-93572 | Sep 18, 2026 |
Redisson Java Client Resource Exhaustion via Nested RESP ArraysA flaw was found in Netty's `RedisArrayAggregator` component. A remote attacker can exploit this vulnerability by sending specially crafted nested Redis (RESP) array headers. This can cause the `RedisArrayAggregator` to eagerly preallocate a large amount of heap memory, leading to heap memory exhaustion and a Denial of Service (DoS) for applications using `RedisDecoder` with `RedisArrayAggregator` on untrusted traffic. |
Camel Spring Boot
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-93575 | Sep 18, 2026 |
Netty MQTT Decoder DoS via Property Length ExploitA flaw was found in Netty's MqttDecoder. An unauthenticated remote attacker can exploit this vulnerability by sending a specially crafted MQTT CONNECT packet. The decoder fails to properly validate the 'Properties Length' against the 'Remaining Length', allowing an attacker to bypass size limits. This leads to excessive memory and CPU consumption, resulting in a denial of service (DoS) due to an OutOfMemoryError. |
Amq Broker
Camel Spring Boot
Jboss Fuse
And others... |
| CVE-2026-93561 | Sep 18, 2026 |
RedHat Memcached Binary Codec Signed/Unsigned Type Mismatch Desynchronizes FrameA flaw was found in io.netty/netty-codec-memcache. The Memcache binary protocol codec incorrectly reads `keyLength` and `extrasLength` as signed Java types instead of unsigned, as specified by the protocol. A malicious Memcache server can exploit this type mismatch by sending a specially crafted response. This can lead to frame desynchronization and response smuggling, where one client's data may be inadvertently exposed to another client's response stream in proxy or cache environments. |
Camel Spring Boot
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-87743 | Sep 18, 2026 |
Quarkus HTTP Security Authorization Bypass via Path Normalization DiscrepancyA flaw was found in Quarkus HTTP security. An unauthenticated attacker can exploit a discrepancy in how paths are normalized between the security matcher and HTTP request dispatchers. This allows the attacker to craft a URL that the security matcher considers public, but which is then routed to a protected endpoint, leading to an authorization bypass and potential unauthorized access to sensitive information. |
Exploit Intelligence
Serverless
Camel Quarkus
And others... |
| CVE-2026-93493 | Sep 18, 2026 |
Netty netty-handler-ssl-ocsp: OCSP nextUpdate Missing Skip ValidationA flaw was found in Netty's `netty-handler-ssl-ocsp` component. A remote attacker can exploit this vulnerability by providing an Online Certificate Status Protocol (OCSP) response that omits the optional `nextUpdate` field. This omission causes the OCSP validation to be silently skipped, leading to applications proceeding with an unvalidated certificate. This can result in a bypass of security controls where certificate validation is expected. |
Camel Spring Boot
|
| CVE-2026-93494 | Sep 18, 2026 |
Netty StompSubframeDecoder Memory Leak DoS via Missing Null TerminatorA flaw was found in Netty's StompSubframeDecoder component. A remote attacker can exploit this vulnerability by sending a specially crafted STOMP frame body without its terminating null byte. This causes the decoder to allocate a ByteBuf (a buffer for bytes) that is never released, leading to a permanent memory leak. Over time, this uncontrolled memory consumption can result in a Denial of Service (DoS) for the application using the affected STOMP codec. |
Camel Spring Boot
Jboss Fuse
Jboss Enterprise Application Platform
And others... |
| CVE-2026-89058 | Sep 18, 2026 |
RESTEasy CorsFilter CORS Misconfig Enables Credentialed CrossOrigin AccessA flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin response together with Access-Control-Allow-Credentials: true. This permissive cross-origin policy allows a malicious website to make credentialed cross-origin requests and read authenticated responses from a victim's session, resulting in a loss of confidentiality. |
Camel Quarkus
Apicurio Registry
Debezium
And others... |
| CVE-2026-89059 | Sep 18, 2026 |
RESTEasy IIOImageProv Unbounded Image Dimension DoSA flaw was found in RESTEasy's IIOImageProvider, which decodes attacker-supplied image request bodies without enforcing any limit on the declared image dimensions or pixel count. A remote, unauthenticated attacker can send a small crafted image declaring enormous dimensions to trigger a very large memory allocation, exhausting the JVM heap and resulting in a denial of service. |
Camel Quarkus
Apicurio Registry
Debezium
And others... |
| CVE-2026-76781 | Sep 17, 2026 |
A flaw was found in libxml2A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its mandatory `catalog` attribute, leading to the application crashing and causing a Denial of Service (DoS). |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-87742 | Sep 17, 2026 |
Quarkus WebSockets-Next DoS via Unbounded Message BufferingA flaw was found in quarkus-websockets-next. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by streaming messages over a single connection faster than the application can process them. Due to unbounded message buffering and a lack of read backpressure, this rapidly exhausts heap space, leading to a java.lang.OutOfMemoryError that crashes the Java Virtual Machine (JVM). |
Exploit Intelligence
Quarkus
Enterprise Linux Ai
And others... |
| CVE-2026-81829 | Sep 17, 2026 |
A flaw was found in SmallRye JWT's AwsAlbKeyResolverA flaw was found in SmallRye JWT's AwsAlbKeyResolver, which is used by applications to verify JSON Web Tokens signed by AWS Application Load Balancers. When the AWS_ALB key provider is configured, the resolver constructs the key-fetch URL by directly concatenating the attacker-controlled kid header value from an inbound JWT without sanitizing path traversal characters or query-string separators. This allows an unauthenticated remote attacker to force the application server to issue GET requests to arbitrary paths on the same origin as the configured key endpoint. As a result, non-public endpoints or internal data reachable on that origin may be read by the attacker before JWT signature verification takes place. |
Exploit Intelligence
Apicurio Registry
Quarkus
And others... |
| CVE-2026-92904 | Sep 17, 2026 |
Foreman Remote Exec Plugin: Unchecked Permission Filter Exposes Job InvocationsA flaw was found in the foreman_remote_execution plugin's template invocations controller. The show_template_invocation_by_host action resolves the job invocation by ID without evaluating the caller's view_job_invocations permission filter against the record. An authenticated user whose job invocation visibility is restricted by a permission filter can enumerate job invocation IDs and read the live output, rendered script, and input values for other users' job invocations within their own organizations. |
Satellite
|