Red Hat OpenShift Container Platform 5.

Image-customization-controller: unauthenticated plaintext image server with directory listing exposes ignition images containing cluster pull secret

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-548

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Denial of service

Gcc: out-of-bounds read in std::from_chars

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: stack overflow in std::bitset on libstdc++

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Gcc: integer wrap in `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-667

Openshift-ansible: openshift-ansible: installer container downloads and executes remote inventory script without integrity verification

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-494

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Broken access control

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-672

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Denial of service

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• Memory corruption

Dnsmasq: dnsmasq: out-of-bailiwick cache injection through cname chase in split-dns configurations

• Red Hat Ceph Storage 9
• Red Hat Enterprise Linux 10
• CWE-345

Polkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflow

• Red Hat Hardened Images
• Red Hat Enterprise Linux 10
• Memory corruption

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

• Samba
• Red Hat Enterprise Linux 10
• CWE-178

Gssproxy: gssproxy: null pointer dereference in gssx_init_sec_context crashes daemon

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Oc: oc: symlink/hardlink target validation bypass in oc image extract allows file write outside destination

• Red Hat OpenShift Container Platform 4
• Red Hat OpenShift Container Platform 5
• CWE-61

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

• Red Hat Confidential Compute Attestation
• Red Hat DPU kit for NVIDIA
• Denial of service

Libmodulemd: libmodulemd: out-of-bounds read when emitting rpm-map artifacts

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Memory corruption

Libmodulemd: libmodulemd: unbounded recursion when parsing nested xmd yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• Denial of service

Libmodulemd: libmodulemd: missing decompressed-size limit when parsing compressed yaml

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-409

Device-mapper-multipath: device-mapper-multipath: information disclosure via malformed format string

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Bootc: ostree: bootc/ostree: staged deployments not revalidated against container signature policy before finalization

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 8
• CWE-345

Libtirpc: libtirpc: denial of service via unbounded memory allocation during rpcsec_gss decoding

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Luksmeta: missing slot-range validation permits out-of-gap device i/o

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-1285

Cifs-utils: mount.cifs credential-file option injection allows local privilege boundary bypass

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Command injection

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

• Red Hat Ansible Automation Platform 2.6
• Red Hat Ansible Automation Platform 2.7
• Code injection

Clevis: clevis: pkcs#11 luks passphrase logged in plaintext to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Insights-runtime-extractor: insights-runtime-extractor: container escape via privileged binary execution

• Red Hat OpenShift Container Platform 4.19
• Red Hat OpenShift Container Platform 4.20
• Privilege escalation

Clevis: clevis: pkcs#11 token pin exposed on command line via pkcs11-tool

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-214

Clevis: clevis: pkcs#11 token pin written to world-readable file

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Information disclosure

Clevis: clevis: no authentication on pkcs#11 af_unix sockets allows key injection under permissive umask

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Authentication bypass

Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• Memory corruption

Openshift/console: openshift/console: authenticated ssrf via helm chart url fetch

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.14
• Server-side request forgery (SSRF)

Gvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /expose

• Red Hat Build of Podman Desktop
• Red Hat Certification Program for Red Hat Enterprise Linux 9
• Path traversal

Ansible-core: ansible-core: ansible-galaxy collection install symlink path escape allows arbitrary file write / code execution

• Red Hat Migration Toolkit for Applications 8
• Red Hat Migration Toolkit for Virtualization
• Path traversal

Luksmeta: incomplete gap-boundary and overlap checks in luks1 metadata allocator allow data corruption

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 7
• CWE-1284

Insights-operator: gather serviceaccount has cluster-wide secret read plus nodes/proxy and cluster-reader

• Red Hat OpenShift Container Platform 4.12
• Red Hat OpenShift Container Platform 4.14
• Privilege escalation

Cluster-samples-operator: role reads all secrets in openshift-config, not just pull-secret

• Red Hat OpenShift Container Platform 4.19
• Red Hat OpenShift Container Platform 4.20
• Privilege escalation

Cyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clients

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via race condition in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via incomplete identity provider authentication requests

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-1025

Sssd: sssd: information disclosure via query injection in entra id lookups

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-140

Sssd: sssd: denial of service via crafted passkey kerberos authentication request

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via undersized packet parsing in nss responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via out-of-bounds read in pam responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via unbounded negative cache growth

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: information disclosure via odata injection in entra id lookups

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-140

Sssd: sssd: denial of service via stale connection state reuse in pam gssapi responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via missing sid extension in certificate mapping

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via packet length underflow in autofs responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via out-of-bounds write in nfs idmap plugin

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: denial of service via memory exhaustion in kcm responder

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Denial of service

Sssd: sssd: denial of service via use-after-free in kcm ticket renewal

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• Memory corruption

Sssd: sssd: access control bypass via improper ldap shadow expiration check

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-193

Sssd: sssd: denial of service via unprivileged autofs cache invalidation

• Red Hat Enterprise Linux 10
• Red Hat Enterprise Linux 6
• CWE-408