Red Hat OpenShift Container Platform 4.

Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-548

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Gcc: out-of-bounds read in std::from_chars

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: stack overflow in std::bitset on libstdc++

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gcc: integer wrap in `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-667

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-494

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Broken access control

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-672

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Denial of service

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-345

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

• Samba
• Red Hat Enterprise Linux 10
• CWE-178

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Information disclosure

Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-61

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

• Red Hat Confidential Compute Attestation
• Red Hat DPU kit for NVIDIA
• Denial of service

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-409

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-345

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Libtirpc: libtirpc: denial of service via unbounded memory allocation during portmapper response decoding

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-1050

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Luksmeta: missing slot-range validation permits out-of-gap device i/o

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-1285

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2.7
• Code injection

Dpdk: dpdk: integer overflow combined with missing validation leads to host buffer overflow in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: stack and heap buffer overflow in nfp vdpa driver

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can trigger infinite loop in vhost-crypto writeback chain cleanup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can trigger out-of-bounds write by controlling avail ring index in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest-triggered use-after-free and type confusion in vhost-crypto session cleanup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest with runt rx descriptors underflows copy length in vhost enqueue (split and packed rings)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: time-of-check/time-of-use vulnerability allowing guest-triggered out-of-bounds write in vhost-crypto

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Dpdk: dpdk: vduse handler fails to invalidate vring pointers when iotlb is invalidated, leading to use-after-unmap

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: heap out-of-bounds read/write in gso header copy

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: guest can desynchronize virtqueue size from inflight descriptor table size, causing out-of-bounds write

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: double offset bug in vhost log mapping calculation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Memory corruption

Dpdk: dpdk: control-queue descriptor double-fetch overflows host heap in dpdk vhost (vduse)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Dpdk: dpdk: missing memory size validation before mmap in vhost memory region setup

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Denial of service

Dpdk: dpdk: guest-triggered out-of-bounds walk via vhost indirect descriptor length toctou

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• Race condition

Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-214

Clevis: clevis: pkcs#11 token pin written to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Authentication bypass

Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

• Red Hat Build of Podman Desktop
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Path traversal

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Red Hat Migration Toolkit for Applications 8
• Red Hat Migration Toolkit for Virtualization
• Path traversal

Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-1284

Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

• Red Hat OpenShift Container Platform 4.19
• Red Hat OpenShift Container Platform 4.20
• Privilege escalation

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

• Red Hat OpenShift Serverless
• Red Hat OpenShift Source-to-Image (S2I)
• CWE-61