Red Hat Linux OS and other open source products
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Red Hat product.
RSS Feeds for Red Hat security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Red Hat Sorted by Most Security Vulnerabilities since 2018
Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.
Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.
Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop
Recent Red Hat Security Advisories
| Advisory | Title | Published |
|---|---|---|
| RHSA-2026:49317 | (RHSA-2026:49317) Red Hat Hardened Images RPMs Security Update | July 31, 2026 |
| RHSA-2026:49212 | (RHSA-2026:49212) Important: kernel security update | July 31, 2026 |
| RHSA-2026:49213 | (RHSA-2026:49213) Important: kernel-rt security update | July 31, 2026 |
| RHSA-2026:49214 | (RHSA-2026:49214) Important: kernel security update | July 31, 2026 |
| RHSA-2026:49033 | (RHSA-2026:49033) Important: kernel security update | July 31, 2026 |
| RHSA-2026:48961 | (RHSA-2026:48961) Important: hplip security update | July 30, 2026 |
| RHSA-2026:48960 | (RHSA-2026:48960) Important: hplip security update | July 30, 2026 |
| RHSA-2026:48959 | (RHSA-2026:48959) Important: hplip security update | July 30, 2026 |
| RHSA-2026:48933 | (RHSA-2026:48933) Red Hat Quay 3.15.7 | July 30, 2026 |
| RHSA-2026:48913 | (RHSA-2026:48913) Important: RHACS 4.10.6 security and bug fix update | July 30, 2026 |
By the Year
In 2026 there have been 2440 vulnerabilities in Red Hat with an average score of 7.2 out of ten. Last year, in 2025 Red Hat had 1166 security vulnerabilities published. That is, 1274 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.41.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 2440 | 7.21 |
| 2025 | 1166 | 6.80 |
| 2024 | 1690 | 6.57 |
| 2023 | 1206 | 6.75 |
| 2022 | 1362 | 6.96 |
| 2021 | 1123 | 6.61 |
| 2020 | 664 | 6.39 |
| 2019 | 772 | 6.98 |
| 2018 | 760 | 7.16 |
It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-18141 | Jul 31, 2026 |
Unauthenticated mTLS Bypass & Event Injection in Ansible EDA aap-gatewayA flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security (mTLS) authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP Subject header. The system also inadvertently discloses the expected certificate subject in error messages, which simplifies the attack. This vulnerability allows an attacker to inject arbitrary events into EDA, potentially triggering automated workflows. |
Ansible Automation Platform
|
| CVE-2026-18358 | Jul 31, 2026 |
Red Hat GNOME-Remote-Desktop RDP Connection Throttle BypassA flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication connections to the RDP listener. This can accumulate accepted sockets and pending routing-token operations until timeout, exhausting resources and preventing legitimate users from establishing RDP sessions. This issue does not affect the upstream version. |
Enterprise Linux (RHEL)
|
| CVE-2026-11770 | Jul 31, 2026 |
389 DS LDAP Filter Injection via CleanAllRUV Replication Status-CheckA flaw was found in 389 Directory Server. An unauthenticated remote attacker can inject LDAP search filters into the CleanAllRUV replication status-check extended operation. Because the handler performs the search against cn=config with elevated replication plugin privileges and returns a boolean match result, the attacker can extract sensitive server configuration metadata, including replication bind DNs and password storage scheme information. |
Directory Server
Enterprise Linux (RHEL)
|
| CVE-2026-15722 | Jul 31, 2026 |
389 DS LDAP: Stack Buffer Overflow in get_ruvelement_from_bervalA stack buffer overflow flaw was found in 389 Directory Server (389-ds-base). The get_ruvelement_from_berval() function in repl5_ruv.c copies digit characters from a network-supplied RUV berval into a fixed 16-byte stack buffer without bounds checking. A remote unauthenticated attacker can crash the LDAP server by sending a crafted StartNSDS50ReplicationRequest extended operation containing a replica ID field with more than 16 digit characters. The overflow occurs during payload decoding, before any authorization check. Stack protectors limit impact to denial of service. |
Directory Server
Enterprise Linux (RHEL)
|
| CVE-2026-10079 | Jul 31, 2026 |
RHACS Deployment Metadata Bypass via openshift.io LabelA flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). When processing Kubernetes Deployments, ACS replaces deployment identity metadata based on the openshift.io/encoded-deployment-config label. A user with permission to create Deployments can set this label to "null", causing ACS to treat the workload as having empty UID, name and labels and namespace "default". This bypasses deploy-time policy detection and enforcement visibility, prevents correct persistence in Central and breaks violation reporting and compliance correlation for the affected deployment. |
Advanced Cluster Security
|
| CVE-2026-18209 | Jul 31, 2026 |
Keycloak keycloak-services OIDC Param Poll. Reroute Enables Session FixA flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18206 | Jul 31, 2026 |
Keycloak keycloak-services Hostname Validation Flaw Enables Unauth Client ModA flaw was found in the keycloak-services component of Keycloak, which provides identity and access management services. The issue occurs when a realm administrator uses a wildcard domain (like *.example.com) to restrict which hosts can register or update clients. Due to improper validation, the system accepts any hostname that ends with the specified domain suffix, even if it is not a legitimate subdomain. An attacker who can control the reverse DNS of their connection can bypass these host-based restrictions, potentially allowing unauthorized client modifications. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18203 | Jul 31, 2026 |
Keycloak GPI Prefix Check IDOR Enables Admin AccessA flaw was found in the group policy evaluation logic of Keycloak, an identity and access management solution. When a group policy is set to extend permissions to child groups, the system incorrectly uses a simple text-based prefix check to verify group membership. This allows a user who belongs to a different group with a similar starting name to bypass security checks and gain unauthorized access to administrative functions or protected resources. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18214 | Jul 31, 2026 |
Keycloak Token Exchange Bypass: Domain Restriction LapseKeycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where the token exchange feature, which allows swapping a Google token for a Keycloak token, does not check these domain restrictions. This means an attacker with a valid Google account from a different domain could bypass the security check and gain access to the Keycloak realm. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18211 | Jul 31, 2026 |
Keycloak secure-client-uris flaw bypasses redirect URI securityA flaw was found in the secure-client-uris client policy executor within Keycloak core services. This component is responsible for enforcing security requirements on client configurations, such as requiring encrypted connections for redirect URIs. Due to an improper check that only looks at the start of a web address rather than properly verifying the host, an attacker can bypass these security restrictions by using a specially crafted domain name. This could allow an attacker to intercept sensitive authentication codes over unencrypted connections. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18208 | Jul 31, 2026 |
Unauthorized OIDC Introspection Exposure in Keycloak ServicesA flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solution used to secure modern applications and services. The issue occurs when a confidential client, configured to receive signed JWT introspection responses, attempts to introspect a token issued for a different audience. Although the endpoint correctly identifies the token as inactive for that client, it still returns the full set of token claims within a signed JWT field. This allows an unauthorized client to bypass audience-based restrictions and access sensitive information contained in the token. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-16105 | Jul 31, 2026 |
Keycloak RoleContainerResource Authorization Bypass in Admin REST APIA flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properly enforce authorization checks when managing composite roles. This allows a delegated administrator with manage-realm permissions to remove essential child roles from built-in admin roles, potentially disrupting administrative functions within a realm. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18215 | Jul 31, 2026 |
Keycloak Token Exchange Bypass Ignoring Org RestrictionKeycloak provides a way to let users log in using Microsoft accounts while restricting access to a specific organization (tenant). A flaw was discovered where this restriction is ignored when using the token exchange feature. This means an attacker with a valid Microsoft token from a completely different organization could gain access to the Keycloak realm, potentially accessing sensitive data or performing unauthorized actions. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18217 | Jul 31, 2026 |
Keycloak SAML Wildcard URL Injection (CVE-2026-18217)A flaw was found in the SAML protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs when Keycloak handles SAML authentication requests using the HTTP-Redirect binding. If a client is configured with a wildcard redirect URL, an attacker can craft a request that includes malicious parameters. When a user authenticates, Keycloak appends its legitimate response to the attacker's parameters. This can cause some service providers to process the attacker's data instead of the real login information, potentially leading to a user being logged into the wrong account. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18218 | Jul 31, 2026 |
TokenManager revocation bypass in KeycloakA flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific application (client) using a "not-before" policy, the revocation may be silently ignored if the overall security realm already has an older, non-zero revocation policy in place. This issue can allow previously issued tokens to remain valid for refreshing sessions and accessing user information even after an administrator has attempted to invalidate them. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18157 | Jul 31, 2026 |
Yggdrasil-WP Manager: Argument Injection in APT Backend Allows Root RCEA flaw was found in yggdrasil-worker-package-manager. A local attacker with existing access to the system could exploit an argument injection vulnerability in the APT backend. This allows specially crafted package names, which begin with a hyphen, to be misinterpreted as command options by apt-get. Successful exploitation could lead to remote code execution (RCE) with root privileges, enabling the attacker to fully compromise the system's integrity, confidentiality, and availability. |
Enterprise Linux (RHEL)
|
| CVE-2026-68563 | Jul 30, 2026 |
Leapp Collection: Insecure PG Backup Archive Permissions Leak InfoA flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read sensitive archived PostgreSQL data, leading to information disclosure. |
Enterprise Linux (RHEL)
|
| CVE-2026-68562 | Jul 30, 2026 |
RedHat Ansible Leapp Report Manipulation Exposes Controller FilesA flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controller to read its own local files and copy them to the managed node. This vulnerability leads to information disclosure, potentially exposing sensitive controller-side data such as private keys or credentials. |
Enterprise Linux (RHEL)
|
| CVE-2026-58216 | Jul 30, 2026 |
Samba KDC kpasswd OOB Read in ASN.1 Authenticated DoSAn out-of-bounds read flaw was found in Samba's Kerberos Key Distribution Center's (KDC) password change (kpasswd) service. When processing malformed ASN.1-encoded Kerberos password change request, Samba server miscalculates the structure size and attempts to read up to six bytes beyond the end of the allocated buffer. While this out-of-bounds read typically results in a harmless decryption failure, if the read hits unmapped memory, it causes the KDC process to crash. An authenticated attacker can send a specially crafted kpasswd request containing malformed ASN.1 data to trigger the out-of-bounds read, which may cause the KDC process to terminate, resulting in a denial of service. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-58222 | Jul 30, 2026 |
LDAP Filter Injection & PrivEsc in Samba AD DCA security flaw combining LDAP filter injection and improper authorization checks was found in Samba Active Directory Domain Controller (AD DC). When processing LDAP Compare requests, Samba fails to properly validate user-supplied attribute names and executes the resulting internal database search in a trusted context, bypassing normal Access Control List (ACL) enforcement. An authenticated low-privilege domain user can exploit these flaws to disclose confidential Active Directory attributes that would normally be inaccessible. The disclosed information may be leveraged to derive sensitive authentication material, potentially leading to privilege escalation and complete domain compromise. For example: In deployments configured with Group Managed Service Accounts (gMSAs), an attacker can extract the "msKds-RootKeyData" attribute and derive gMSA passwords offline, potentially leading to complete domain compromise if privileged gMSAs are present. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-16308 | Jul 30, 2026 |
IBM Quarkus REST DoS via Unbounded MIME Header Accum (3.27,3.33)IBM Enterprise Build of Quarkus 3.27.1 through 3.27.4.SP2, and 3.33.1 through 3.33.2.SP2 Quarkus REST could allow a remote attacker to cause a denial of service due to unbounded accumulation of multipart MIME part-header bytes. |
|
| CVE-2026-58218 | Jul 30, 2026 |
Samba DNS TKEY Cache DoS via Unauth RegA flaw was found in Samba's internal DNS server where unauthenticated TKEY registration requests were added to the TKEY name cache before being rejected. A remote, unauthenticated attacker can exploit this behavior by sending a large number of TKEY requests with arbitrary names, exhausting the cache and evicting legitimate TKEY entries. This can prevent legitimate TSIG authentication for signed DNS queries, resulting in a denial of service. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-18382 | Jul 30, 2026 |
koku-metrics-operator CR Leak Red Hat SSO Secrets via User-Defined OAuth URLA flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary OAuth token endpoint. When authentication.type is set to service-account, the operator sends the tenant's Red Hat SSO client_id and client_secret to this user-controlled URL, allowing the attacker to obtain the credentials. |
Cost Management
|
| CVE-2026-18378 | Jul 30, 2026 |
Red Hat koku-metrics-operator Exposes Pull-Secret via User-Controlled Upload URLA flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token (the default), the cluster-global Red Hat Cloud pull-secret bearer token is attached to HTTP requests sent to this user-controlled URL, allowing the attacker to obtain the token. |
Cost Management
|
| CVE-2026-18381 | Jul 30, 2026 |
CVE-2026-18381: koku-metrics-operator URL Injection Leaks K8s SA TokenA flaw was found in the koku-metrics-operator for Red Hat OpenShift. The operator's CostManagementMetricsConfig custom resource allows a user able to edit the CR to specify an arbitrary upload URL. The operator attaches its own Kubernetes service-account bearer token to queries sent to this user-controlled URL, allowing the attacker to obtain the token. |
Cost Management
|
| CVE-2026-18369 | Jul 30, 2026 |
Dogtag PKI ACME Responder SSRF via IP literals & redirectsA flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side request forgery (SSRF), making the Dogtag server send HTTP GET requests to internal network services. With the InMemory database backend, the response body of internal targets is disclosed to the attacker through the ACME challenge error. |
Certificate System
Enterprise Linux (RHEL)
|
| CVE-2026-58040 | Jul 30, 2026 |
Node.js HTTPS Agent TLS Session Reuse Skips Hostname VerificationAn incomplete fix has been identified in Node.js: HTTPS Agent TLS session reuse skips hostname verification across identity policies (incomplete fix of CVE-2026-48934). This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. |
|
| CVE-2026-56850 | Jul 30, 2026 |
Node.js HTTPS Agent PFX Key Collision Enables mTLS Identity ReuseA flaw in Node.js HTTPS Agent connection reuse can cause PFX object-array key collisions, allowing mutual TLS (mTLS) client identities to be reused across requests configured with different client certificates. This vulnerability affects Node.js **26.x**, **24.x**, and **22.x**. |
|
| CVE-2026-56847 | Jul 30, 2026 |
Node.js Permission Bypass: trace_events.enable() Logs UnrestrictedA flaw in Node.js Permission Model enforcement allows `trace_events.createTracing().enable()` Writes Trace Logs Outside `--allow-fs-write`. This can lead to confidentiality impact or bypass of the intended security boundary under affected configurations. This vulnerability affects Node.js **22.x**, **24.x**, and **26.x**. |
|
| CVE-2026-58043 | Jul 30, 2026 |
Node.js Permission Model Over-Granting File System AccessA flaw in Node.js Permission Model enforcement can over-grant filesystem access across radix-tree prefix boundaries. Under `--permission`, an attacker who is granted access to one path can abuse boundary handling to read from or write to paths outside the intended filesystem allowlist. This vulnerability affects Node.js **main**, **22.x**, **24.x**, and **26.x**. |
|
| CVE-2026-16531 | Jul 30, 2026 |
RedHat PCP pmproxy Servlet Path Traversal VULNAn unauthenticated remote attacker can exploit a path traversal vulnerability in the PCP pmproxy logger servlet using a crafted hostname. This allows arbitrary file and directory creation, potentially leading to a denial of service. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-16530 | Jul 30, 2026 |
Remote DoS via Bounds Check Bypass in PCP pmproxy (pmLogLoadInDom)A flaw was found in the PCP (Performance Co-Pilot) `pmproxy` service. A remote attacker can exploit a vulnerability in the `pmLogLoadInDom()` function by sending a specially crafted request. This bypasses a critical bounds check, which can lead to the `pmproxy` service crashing, causing a Denial of Service (DoS). Additionally, this flaw may enable the leakage of sensitive information from the system's memory. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-16529 | Jul 30, 2026 |
Red Hat PCP __pmGetPDU Integer Overflow DoSA signed integer overflow in the PCP __pmGetPDU() function can be exploited via crafted network packets during PDU processing or SASL negotiation. This permanently blinds the affected daemon, resulting in a total denial of service (DoS) for subsequent packet reads. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-16527 | Jul 30, 2026 |
Unauth RCE via PCP pmproxy /store (CVE-2026-16527)An unauthenticated remote attacker can bypass access controls by sending crafted requests to the PCP pmproxy /store endpoint. This allows the attacker to overwrite any PMDA metric, leading to arbitrary code execution and system takeover. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-16526 | Jul 30, 2026 |
PCP linux_sockets Module Exposes Unsecured Connection for Privilege EscalationA flaw in the PCP linux_sockets module exposes an unsecured internal connection. An attacker with initial code execution can exploit this to escalate privileges and execute arbitrary commands as root. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-16524 | Jul 30, 2026 |
Command Injection in PCP linux_sockets PMDA via network.persocket.filterA command injection flaw in PCP's linux_sockets PMDA allows malicious shell metacharacters via the network.persocket.filter metric. This failed validation lets attackers execute arbitrary commands as the PMDA user when metrics refresh. |
Enterprise Linux (RHEL)
Openshift
|
| CVE-2026-13346 | Jul 29, 2026 |
pip Arbitrary File Write via Doubly-Encoded URLs in Untrusted Indexpip would incorrectly handle doubly-encoded package URLs from indexes allowing for files to be installed to arbitrary locations on disk even when installing wheels. This vulnerability requires downloading or installing a package from a malicious package index to succeed, malicious packages alone are not able to exploit this vulnerability. Note that this vulnerability only materially impacts users running `pip download` with the `--only-binary` option as installing source distributions from an untrusted index is already an unsafe operation that executes code during install time. |
|
| CVE-2026-62995 | Jul 29, 2026 |
JWT Malleability via Trailing Padding in joserfc 1.7.1 and priorjoserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. in versions 1.7.1 and prior, joserfc accepts JWTs with trailing padding (==) which are not conforming to the JOSE specifications. This leads to malleability of the JWTs when consumed by joserfc. Depending on this application this might or not be an issue. This could lead to bypass of token revocation or anti-replay protection when implemented as a deny list of tokens or a deny list of token hashes. Note that ECDSA JWS are always malleable because of the malleability of ECDSA signatures (first test case in the code bellow). This makes a scheme which assumes that JWTs are not malleable brittle. However for other signatures (or MAC) schemes it might make sense to assume non malleability of the token. This issue has been fixed in version 1.7.2. |
|
| CVE-2026-59898 | Jul 29, 2026 |
Netty WebSocket Upgrade Smuggling (CVE-202659898) before 4.1.136/4.2.16Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, ab attacker can force WebSocket upgrade via the lax V07 (or V08) handshaker by sending `Sec-WebSocket-Version: 7` and omitting `Connection: Upgrade` / `Upgrade: websocket` headers, completing a protocol switch that a proxy would not recognize as an Upgrade request and enabling HTTP request smuggling / protocol-confusion attacks. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. |
|
| CVE-2026-59899 | Jul 29, 2026 |
Netty HttpContentCompressor Resource Exhaustion via Unbounded acceptEncodingQueue < 4.1.136Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, `HttpContentEncoder` (the superclass of the production handler `HttpContentCompressor`) maintains a per-channel `ArrayDeque<CharSequence>` named `acceptEncodingQueue` that accumulates attacker-controlled data without any size limit. The queue is filled on the I/O thread for every inbound HTTP request and drained only when the application later writes a non-1xx response. This creates a resource exhaustion vulnerability when an attacker exploits HTTP/1.1 pipelining to flood the connection with requests faster than the application produces responses. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. |
|
| CVE-2026-59900 | Jul 29, 2026 |
Netty <4.1.136/4.2.16: H2Codec Duplicate Host Header in HTTP/2Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, Netty's HTTP/2-to-HTTP/1.x translation layer (`Http2StreamFrameToHttpObjectCodec` and `InboundHttp2ToHttpAdapter`) fails to deduplicate or validate `Host` headers when an HTTP/2 client supplies both the `:authority` pseudo-header and a literal `host` header in a single HEADERS frame. The translator maps `:authority` to `Host` and separately copies the literal `host` header, producing an `HttpRequest` object containing two `Host` headers with attacker-controlled differing values. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. |
|
| CVE-2026-16729 | Jul 29, 2026 |
undici Cookie Attr Sanitization Flaw (6.27, 7.07.28, 8.08.8)undici's setCookie function does not fully sanitize cookie attributes. In undici before 6.28.0, from 7.0.0 up to before 7.29.0, and from 8.0.0 up to before 8.9.0, a domain value is not checked for semicolons and entries in the unparsed array are not sanitized, so attacker-influenced input can inject additional cookie attributes. For example, a domain value containing a semicolon can append attributes such as SameSite, and an unparsed entry can inject attributes such as HttpOnly, without the caller setting them. Applications that pass user-controlled input to these fields, such as multi-tenant or reverse-proxy servers that scope session cookies to a tenant-supplied domain, can have SameSite CSRF protections bypassed, or the Secure, HttpOnly, and SameSite attributes forced, stripped, or overridden. The issue is fixed in undici 6.28.0, 7.29.0, and 8.9.0. |
|
| CVE-2026-18255 | Jul 29, 2026 |
Quay Read-Only Superuser Token Disclosure via GLOBAL_READONLY_SUPER_USERSA flaw was found in Quay. A user configured in GLOBAL_READONLY_SUPER_USERS is able to view robot account tokens for repositories they are not a member of, allowing an attacker with read-only superuser privileges to impersonate any robot account. |
Quay
|
| CVE-2026-67214 | Jul 29, 2026 |
nanoid (Non-secure) before 5.1.16 DOS via Infinite Loop on Negative Sizenanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition. |
|
| CVE-2026-67213 | Jul 29, 2026 |
DoS via Infinite Loop in nanoid <=5.1.6 CustomAlphabetnanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition. |
|
| CVE-2026-18220 | Jul 29, 2026 |
GNU binutils BFD DLX ELF Backend OOB Write (CVE-2026-18220)An out-of-bounds write vulnerability was found in the BFD library's DLX ELF backend (bfd/elf32-dlx.c) in GNU binutils. The dlx_rtype_to_howto() function maps ELF relocation types to internal howto structures but fails to perform adequate bounds checking on attacker-controlled relocation type values (via ELF32_R_TYPE(r_info)) before indexing into the dlx_elf_howto_table[] array. The DLX relocation type number space is non-contiguous (basic types 0-6, extended types at 0x10000+), but the default case in the switch statement allows arbitrary index values to reach the array access. A specially crafted ELF/DLX object file can trigger this out-of-bounds write when processed by any BFD-consuming tool (objdump, readelf, strip, ld, nm, objcopy). The vulnerability has been demonstrated to achieve arbitrary code execution via a File Stream Oriented Programming (FSOP) attack against glibc FILE structures (stderr), redirecting control flow to system(). Attack scenarios include CI/CD pipelines performing automated binary analysis, developer workstations running objdump/readelf on untrusted binaries, automated security scanning or malware analysis tools invoking binutils, and package build systems processing third-party code. Note: This vulnerability is only exploitable when binutils is built with the DLX backend enabled (typically via --enable-targets=all). |
Enterprise Linux (RHEL)
Hummingbird
Openshift
And others... |
| CVE-2026-18201 | Jul 29, 2026 |
Keycloak Admin API Allows Identity Provider Linking Without Org Admin PrivilegesKeycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions to manage that organization. This could allow an unauthorized administrator to influence how users log into specific organizations. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-18207 | Jul 29, 2026 |
Keycloak Client Policy Bypass via Group Name MatchA flaw was found in the client policy enforcement mechanism of Keycloak. The issue occurs when the system checks group membership by name instead of a unique identifier. An attacker with client management privileges could bypass security policies by joining a group with a matching name in a different part of the group hierarchy, potentially allowing them to register or update clients without following required security hardening profiles. |
Build Keycloak
Jboss Data Grid
Jbosseapxp
And others... |
| CVE-2026-59921 | Jul 28, 2026 |
Netty HttpPostRequestEncoder CRLF Injection <4.1.136 & <4.2.16 FixNetty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and 4.2.16.Final, HttpPostRequestEncoder constructs multipart HTTP request bodies by directly concatenating user-supplied filenames and field names into Content-Disposition MIME headers without validating or sanitizing CRLF characters (\r\n). Since MIME headers are delimited by CRLF, an attacker who controls the filename can inject arbitrary MIME headers into the multipart body part. The root cause is that neither the encoder nor the FileUpload implementations' setFilename() methods, which only check for null, neutralize CRLF characters before the filename is embedded into the header. This issue has been fixed in versions 4.1.136.Final and 4.2.16.Final. |
|
| CVE-2026-18107 | Jul 28, 2026 |
CRIU rseq Credential Spo via Checkpoint/RestoreA flaw was found in CRIU's handling of restartable sequences (rseq) during checkpoint/restore. A malicious process inside a container can register an rseq critical section that hijacks CRIU's parasite code injection during checkpoint, allowing it to spoof the process credentials saved in the checkpoint image. On restore, the container process gains elevated capabilities and zeroed UIDs/GIDs. The practical impact on Red Hat products is limited by several factors: checkpoint/restore requires root privileges (podman) or cluster-admin RBAC (OpenShift) to trigger and cannot be initiated from within the container itself; on OpenShift prior to 4.17 the feature required explicit opt-in, and on 4.17+ the kubelet checkpoint API RBAC is not configured by default; OpenShift enforces user namespaces by default for regular workloads (hostUsers is gated behind admin-only SCCs), which makes the spoofed capabilities namespace-scoped and ineffective for privilege escalation; SELinux type enforcement (container_t) blocks privilege transitions independently of capabilities; seccomp filters persist through checkpoint/restore and cannot be corrupted via the parasite; and kernel mount namespace ownership checks on RHEL 9/10 kernels prevent mount-based container escape even with spoofed capabilities. |
Enterprise Linux (RHEL)
Openshift
|