Red Hat Enterprise Linux 7.

389-ds-base: 389-ds-base: starttls plaintext-buffer retention allows on-path attacker to forge an ldap client's authentication result

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• CWE-923

389-ds-base: 389-ds-base: unauthenticated worker-thread-pool exhaustion via completed-operation-then-incomplete-pdu connection requeue

• Red Hat Directory Server 11
• Red Hat Directory Server 12
• Denial of service

Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr uncompressed scanline decoder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libsoup: soupserver: http/1 request smuggling via undrained expect: 100-continue body

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• HTTP request smuggling

Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Libsoup: libsoup: heap buffer overflow via uninitialized length in data-uri base64 decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Flatpak: flatpak: sandboxed app can signal unsandboxed processes in the same process group

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-653

Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-61

Flatpak: flatpak: denial of service via unsanitized keys in exported desktop entry / d-bus service files

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-20

Flatpak: flatpak: world-writable temporary child repositories in system-helper cache path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-378

Flatpak: flatpak: world-readable oci authentication token in system-helper cache path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-378

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-61

Flatpak: flatpak: arbitrary read-access to files in the system-helper context via oci symlink following

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Path traversal

Flatpak: flatpak: extension metadata path traversal file existence oracle

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Path traversal

Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Broken access control

Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Broken access control

Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• CWE-197

Flatpak: flatpak: path traversal issue in oci archive extraction via hardlinks

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Path traversal

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: one-byte out-of-bounds heap read in the uncompressed dds loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: out-of-bounds heap read in the 4bpp tim image loader

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Flatpak: flatpak: arbitrary write in host context via flatpak build-init

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Path traversal

Flatpak: flatpak: arbitrary write access as root via extra-data extraction

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Path traversal

Emacs: emacs: arbitrary code execution in flymake mode

• GNU Emacs
• Red Hat Enterprise Linux 10
• Code injection

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-280

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Gcc: libstdc++ integer overflow in `new` operator

• Red Hat Enterprise Linux 8
• Red Hat Hardened Images
• Memory corruption

Libstoragemgmt: libstoragemgmt: denial of service via stack buffer overflow in scsi vpd page parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Usbredir: usbredir: unbounded iso_packet_desc[] index in usbredirhost_iso_packet() leads to heap out-of-bounds write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Fetchmail: fetchmail: stack-based buffer overflow in ntlm authentication (fetchmail-sa-2026-01)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Cockpit: cockpit: unauthorized modification of login records via integer overflow

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Cockpit: cockpit: denial of service in `cockpit-ws` due to url-root handling without a trailing slash

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Denial of service

Cockpit: cockpit: denial of service via unbounded connection thread spawning

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 10
• Denial of service

Pppd: pppd: buffer overflow in peap response handling leads to data corruption or denial of service.

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-606

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Jwcrypto: jwcrypto: denial of service via o(n^2) duplicate check on unbounded jwk key_ops array

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Denial of service

Gimp: integer overflow when generating a thumbnail preview for a psd file

• GNOME GIMP
• Red Hat Enterprise Linux 8
• Memory corruption

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Command injection

Gnome-shell: gnome-shell: out-of-bounds read in remote search icon rendering due to unvalidated icon-data buffer size

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

• Fedora
• Red Hat Enterprise Linux 9
• Broken access control

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via malformed pam v1 requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Gimp: gimp: heap-based buffer overflow in psp loader due to selection-channel geometry mismatch

• Red Hat Enterprise Linux 6
• Red Hat Enterprise Linux 7
• Memory corruption

Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions

• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 9
• Memory corruption

Device-mapper-multipath: local denial of service via blocking ipc send operations

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-1322

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

• Red Hat Hardened Images
• Red Hat Ceph Storage 4
• Memory corruption

Libvirt: unsafe chown in qemutpmemulatorpreparehost() allows arbitrary file ownership change via symlink

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-61