Red Hat OpenShift Container Platform 4.

Sssd: sssd-kcm: local denial of service via excessive memory preallocation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via race condition in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via incomplete identity provider authentication requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-1025

Sssd: sssd: information disclosure via query injection in entra id lookups

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-140

Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass

• Red Hat OpenShift Container Platform 4
• Path traversal

Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via crafted passkey kerberos authentication request

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via undersized packet parsing in nss responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via out-of-bounds read in pam responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via unbounded negative cache growth

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: information disclosure via odata injection in entra id lookups

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-140

Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via missing sid extension in certificate mapping

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via packet length underflow in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: access control bypass via premature ldap access rule evaluation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-393

Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via memory exhaustion in kcm responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via use-after-free in kcm ticket renewal

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: access control bypass via improper ldap shadow expiration check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-193

Sssd: sssd: denial of service via unprivileged autofs cache invalidation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-408

Sssd: sssd: denial of service via memory exhaustion in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via out-of-bounds read in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via out-of-bounds read during passkey parsing

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Oc-mirror: oc-mirror: path traversal / arbitrary file write in operator catalog image extraction

• Assisted Installer for Red Hat OpenShift Container Platform 2
• Red Hat OpenShift Container Platform 4
• Path traversal

Gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_if

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Qemu-kvm: 9pfs: use-after-free race in tlcreate/twalk allows vm guest escape

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Openshift/console: openshift/console: unauthenticated reverse proxy to in-cluster catalogd service with session token forwarding

• Red Hat OpenShift Container Platform 4.17
• Red Hat OpenShift Container Platform 4.18
• CWE-441

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-280

Rpcbind: unbounded memory allocation in rpcbind statistics tracking allows unauthenticated remote denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Gcc: libstdc++ integer overflow in `new` operator

• Red Hat Enterprise Linux 8
• Red Hat Hardened Images
• Memory corruption

Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Openshift/oc-mirror: release signature verification: openpgp signatureerror checked before signed body is consumed

• Red Hat OpenShift Container Platform 4.18
• Red Hat OpenShift Container Platform 4
• Weak cryptography or TLS

Cri-o: cri-o checkpoint restore bypasses destination security context

• Red Hat Confidential Compute Attestation
• Red Hat Enterprise Linux 8
• Privilege escalation

Cri-o: cri-o: insufficient validation during container checkpoint restore

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• Path traversal

Qemu-kvm: vapic writable rom alias can escape the option-rom window and expose locked smram

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Sequoia-openpgp: sequoia-openpgp: cryptographic integrity compromise via key flag confusion

• Red Hat Ansible Automation Platform 2.6 for RHEL 9
• Red Hat Enterprise Linux 10
• Weak cryptography or TLS

Podman: arbitrary file write when importing oci archive

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 9
• CWE-277

Podman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directory

• Red Hat Ansible Automation Platform 2
• Red Hat Enterprise Linux 10
• Path traversal

Podman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callers

• Red Hat Hardened Images
• Red Hat Ansible Automation Platform 2
• Path traversal

Sssd: sssd: denial of service in nss responder via crafted zero-length requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: local denial of service due to null pointer dereference in pam responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via malformed pam v1 requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Device-mapper-multipath: local denial of service via blocking ipc send operations

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-1322

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Broken access control

Crun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chown

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Crun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfs

• containers crun
• Red Hat Hardened Images
• Path traversal

Crun: crun: rootful krun with passt executes container payload as host root

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Privilege escalation

Cups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• CWE-178

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Sssd: sssd: idp authentication prefix comparison allows cross-user impersonation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-187

Dpdk: dpdk: missing length validation before reading command_data in virtio-net control queue handler

• Red Hat Fast Datapath for RHEL 10
• Red Hat Fast Datapath for RHEL 8
• Memory corruption

Glib2: toctou symlink race in `g_file_create_replace_destination` fallback path

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Path traversal

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 10.0 Extended Update Support
• Memory corruption

Util-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinks

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Path traversal

Util-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirection

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• Race condition

Util-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authority

• Red Hat Enterprise Linux 10
• Red Hat Cost Management On-Premise 1
• CWE-775