Red Hat Hardened Images.

Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction

• Red Hat Hardened Images
• Broken access control

Gdb: gdb: stack buffer overflow in parse_tsv_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap buffer overflow in cmd_qtdpsrc via qtdpsrc declared/actual length mismatch

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdbserver: heap disclosure and wild pointer in gdb_parse_agent_expr via untrusted agent-expression length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in parse_tracepoint_definition via stale rs->buf tail

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gdb: gdb: stack buffer overflow in fetch_register_using_p via unchecked p-reply length

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: out-of-bounds read in std::from_chars

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: stack overflow in std::bitset on libstdc++

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gcc: integer wrap in `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Patch: filename validation bypass in reversal fallback allows file creation outside the working directory

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

• Red Hat Confidential Compute Attestation
• Red Hat DPU kit for NVIDIA
• Denial of service

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-409

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-345

Libarchive: libarchive: use-after-free via aliased mac metadata copy

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-1050

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Busybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruption

• Red Hat Hardened Images
• Memory corruption

Busybox: busybox: http request smuggling via pipelined requests in httpd reverse proxy

• Red Hat Hardened Images
• HTTP request smuggling

Busybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flush

• Red Hat Hardened Images
• Path traversal

Busybox: busybox: httpd user existence oracle in non-default shadow-disabled builds

• Red Hat Hardened Images
• Information disclosure

Busybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictions

• Red Hat Hardened Images
• CWE-693

Busybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of service

• Red Hat Hardened Images
• Memory corruption

Busybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fix

• Red Hat Hardened Images
• Red Hat Enterprise Linux 6
• Path traversal

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

• Red Hat Build of Podman Desktop
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Path traversal

Cups: null pointer dereference via embedded job ticket comments allows remote denial of service

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass

• Red Hat Hardened Images
• Red Hat Satellite 6
• Broken access control

Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

• Red Hat Hardened Images
• Red Hat Satellite 6
• Broken access control

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Ansible: ansible-ui: ansible ui dom xss in /redirect next parameter

• Red Hat Ansible Automation Platform 2
• Red Hat Hardened Images
• Cross-site scripting (XSS)

Cups: cups: argument injection in mailto notifier via notify-recipient-uri

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Command injection

Freetype: freetype: denial of service via repeated subroutine allocations in cid font loader

• Red Hat Hardened Images
• Red Hat build of OpenJDK 11 ELS
• Denial of service

Rpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tag

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Rpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packages

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Rpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpm

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Rpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Busybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthello

• Red Hat Hardened Images
• Memory corruption

Busybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpoint

• Red Hat Hardened Images
• Memory corruption

Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

• Red Hat Hardened Images
• CWE-305

Busybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packages

• Red Hat Hardened Images
• Memory corruption

Busybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengths

• Red Hat Hardened Images
• CWE-636

Busybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflow

• Red Hat Hardened Images
• Memory corruption

Busybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflow

• Red Hat Hardened Images
• Memory corruption

Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Broken access control

Gcc: libstdc++ integer overflow in `new` operator

• Red Hat Enterprise Linux 8
• Red Hat Hardened Images
• Memory corruption

Poppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-606

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Redis: redis: out-of-bounds read via crafted cluster bus packets

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Podman: arbitrary file write when importing oci archive

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-277

Tftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engine

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Path traversal

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

• Red Hat Hardened Images
• Red Hat Ansible Automation Platform 2
• Path traversal

Environment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharacters

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Command injection

Libtiff: libtiff: heap-buffer overflow via numeric truncation in the jpeg raw passthrough

• Red Hat Hardened Images
• Red Hat Ceph Storage 4
• Memory corruption