Red Hat Enterprise Linux 10.

Bluez: bluez: out-of-bounds read in avrcp parse_media_element and parse_media_folder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Io.undertow/undertow: undertow: http response header integrity issue due to character truncation

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 10
• CWE-681

Samba: ctdb fails to do integrity checking of received packets

• Red Hat Ceph Storage 9.2
• Red Hat Enterprise Linux 10
• CWE-353

Libdm: lvm2: libdm: denial of service via uncontrolled recursion in config parser

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Denial of service

Sblim-sfcb: sblim-sfcb: privileged file corruption and denial of service via insecure temporary file handling

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-377

Sblim-sfcb: unsafe deserialization in sblim-sfcb provider-manager ipc allows out-of-bounds memory access via malformed operationhdr

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sblim-cmpi-base: insecure temporary file creation in sblim-cmpi-base provider registration scripts allows local symlink attack

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-377

Open-iscsi: open-iscsi: integer underflow in iscsiuio ipv4 dhcp parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Open-iscsi: open-iscsi: integer underflow in iscsiuio dhcpv6 parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Open-iscsi: open-iscsi: denial of service in iscsiuio router advertisement parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write

• GStreamer gst-plugins-good
• Red Hat Enterprise Linux 10
• Memory corruption

Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing

• GStreamer gst-plugins-good
• Red Hat Enterprise Linux 10
• Memory corruption

Binutils: binutils: multiple use-after-free in add_archive_element via lto plugin processing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

389-ds-base: 389-ds-base: pre-authentication double-free in get_ldapmessage_controls_ext() via critical session tracking control

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Memory corruption

Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Undertow-core: undertow:http request smuggling via oversized chunk-size bit overlap

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• HTTP request smuggling

Dbi: incomplete fix for cve-2026-14380 dbi: arbitrary code execution via caller-influenced profile attribute

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Code injection

Iperf3: unbounded peer-controlled allocation in iperf3 json_read() allows unauthenticated remote memory exhaustion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Iperf3: iperf3 server accepts unbounded peer-controlled json parameters enabling remote denial of service via resource exhaustion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-20

Kbd: local privilege escalation in openvt via incorrect process owner verification allowing passwordless root login

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Insights-core: insights-core: incomplete credential redaction exposes sssd bind passwords and pacemaker fence credentials in uploaded archives

• Pen Drive Powered by Red Hat Lightspeed
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Information disclosure

Qemu-kvm: vhost inflight migration vmstate integer type mismatch causes out-of-bounds access

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-681

Libvirt: swtpm privilege escalation via symlink following

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Libvirt: information disclosure via world-readable storage volume images during clone/convert

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Broken access control

Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libvirt: libvirt: newline injection in network xml dns txt/srv fields allows dnsmasq config directive injection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Other injection

Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die()

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Policycoreutils: policycoreutils: toctou race condition in fixfiles allows arbitrary selinux label manipulation

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Race condition

Udisks2: udisks2: local privilege escalation via as-user option spoofing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Popt-devel: popt-static: size_t underflow in singleoptionhelp

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Rpm: heap buffer overflow in ndb slot table parsing

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Libkcapi: infinite loop denial of service in libkcapi _kcapi_aio_read_all() due to unhandled io_getevents() timeout return

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Denial of service

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Memory corruption

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

• Stephan Muelle libkcapi
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v1

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Stunnel: stack-based out-of-bounds read/write in stunnel s_vlog via oversized log message

• Mobi-Com Polska Sp. z o.o. stunnel
• Red Hat Enterprise Linux 10
• Memory corruption

Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped ipv6 loopback and unspecified addresses allows access to loopback-only services

• Mobi-Com Polska Sp. z o.o. stunnel
• Red Hat Enterprise Linux 10
• Server-side request forgery (SSRF)

Popt-devel: popt-static: off-by-one in poptstuffargs

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Tar: tar: toctou in incremental dumpdir 'x' rename handling allows restore path escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Race condition

389-ds-base: 389-ds-base: sasl plain bind installs connection credentials before account-lock check, allowing continued access as a locked account

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Authentication bypass

Tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Path traversal

Sssd: sssd: nss responder out-of-bounds read via unchecked addrlen in gethostbyaddr

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

• gnome-remote-desktop
• Red Hat Enterprise Linux 10
• Denial of service

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Other injection

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

Yggdrasil-worker-package-manager: yggdrasil-worker-package-manager: remote code execution via apt argument injection

• RedHatInsights yggdrasil-worker-package-manager
• Red Hat Enterprise Linux 10
• Command injection

Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Broken access control

Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-610

Samba: kpasswd service: kpasswd packet that contains malformed asn.1 might cause the server to access 6 bytes of unallocated memory leading server to crash

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Samba: samba ad ldap compare filter injection and trusted-request confusion disclose protected attributes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Other injection

Samba: dns signing dos via tkey name cache exhaustion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-410

Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects

• Red Hat Certificate System 10.4 EUS for RHEL-8
• Red Hat Certificate System 10
• Server-side request forgery (SSRF)

Pcp: pcp: arbitrary file creation via path traversal in pmproxy logger servlet

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal