Red Hat Enterprise Linux 10.

Gdk-pixbuf: gdk-pixbuf: heap out-of-bounds read in uncompress() via crafted icns rle block

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libxml2: double-free/uaf in libxml2 python bindings

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Command injection

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

389-ds-base: 389-ds-base: command injection via unescaped ldap dn in cockpit 389 console ldap editor

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Command injection

389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Authentication bypass

389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet()

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Memory corruption

389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn

• Red Hat Directory Server 11.5 E4S for RHEL 8
• Red Hat Directory Server 11.7 E4S for RHEL 8
• Broken access control

Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Code injection

Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Authentication bypass

Flatpak: flatpak: toctou race condition allows symlink redirection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Race condition

Libtpms: libtpms: heap out-of-bounds read in tpm2 state unmarshalling via unchecked block_skip_read() blocksize

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libsoup: libsoup: http/2 client crash in on_data_source_read_callback when settings initial_window_size shrinks during deferred body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: heap use-after-free in libsoup http/2 client on_data_read() via goaway during body upload

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Jwcrypto: jwcrypto: general json jws kid binding bypass during jwkset verification

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Gstreamer1-plugins-base: gstreamer: null/invalid-pointer dereference in gst_rtsp_message_parse_auth_credentials() when parsing a crafted digest authorization/www-authenticate header

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Rpm: command injection in rpmuncompress via unescaped filenames passed to popen()

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Race condition

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• CWE-775

Freeipa: idm: idm/freeipa web ui - client-side open redirect in reset_password.html

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Open redirect

Gvfs: mtp: out-of-bounds read in do_read()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: afp: heap-based buffer overflow in dsi read path

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: sftp: uninitialized heap disclosure in read_string()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Gvfs: sftp: heap-based buffer overflow in read_reply()

• GNOME gvfs
• Red Hat Enterprise Linux 10
• Memory corruption

Rpm: command execution via macro expansion in `rpmuncompress -x` for crafted `.gem` filenames

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure
• Broken access control

Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure

• Red Hat Certificate System 9
• Red Hat Enterprise Linux 10
• Information disclosure

Popt-devel: popt-static: short realloc in poptconfigfiletostring

• rpm-software-management popt
• Red Hat Hardened Images
• Memory corruption

Gdb: gdb: out-of-bounds write in stabs parser read_member_functions() via crafted elf

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Undertow-core: undertow: websocketcontainer defaults for buffers and timeouts are infinite

• Red Hat build of Apache Camel for Spring Boot 4
• Red Hat Enterprise Linux 10
• Denial of service

Libsolv: libsolv: out-of-bounds write in repo_write() via unvalidated directory id from vertical/paged .solv filelist data

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-129

Jwcrypto: jwcrypto: denial of service via malformed jwe tokens

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Denial of service

Gdk-pixbuf: gdk-pixbuf: invalid write in jpeg icc profile parser on error recovery

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Undertow-core: undertow: denial of service via websocket permessage-deflate processing

• Red Hat JBoss Enterprise Application Platform 8.1.8.GA
• Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 10
• Denial of service

Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Bluez: sdp-xml: bluez 5.86: unprivileged-local and adjacent-le-peer leads to arbitrary code execution as root

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Bluez: stack overflow in name2utf8 causes dos and potential code execution

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libsoup3: libsoup: quadratic cpu denial of service in http range coalescing after cve-2025-32907 fix

• Red Hat Enterprise Linux 10
• Denial of service

Emacs: emacs: command injection via crafted filenames in tramp

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Command injection

Sos: sos: path traversal in sos clean tar extraction via unvalidated symlink/hardlink targets leads to arbitrary file write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

389-ds-base: 389-ds-base: cve-2026-11610 incomplete fix may introduce a connection-stall dos

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Networkmanager: networkmanager: 802-1x ca-path and phase2-ca-path bypass private_user restriction, allowing wpa-enterprise server validation bypass (incomplete fix for cve-2025-9615)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Broken access control

Rpm: rpmbuild gettarspec() crafted tar member name → macro injection

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Code injection

Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates

• Red Hat Certificate System 10
• Red Hat Certificate System 11
• Weak cryptography or TLS

Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Privilege escalation

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-706

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Denial of service

Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: integer truncation in sort_ranges() comparator causes silent omission of http range responses

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-197

Vim: vimscript injection via unescaped filename in netrw s:netrwmarkfile() filter() expression allows arbitrary code execution

• vim
• Red Hat Hardened Images
• Code injection

Cockpit-ws: cockpit: cockpit-ws: unauthenticated remote memory leak via cockpitlang cookie in send_login_html

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Denial of service

Swtpm: swtpm: out-of-bounds read in swtpm_nvram_checkheader due to sizeof(pointer) vs sizeof(struct) mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption