Red Hat
Monthly
Local privilege escalation in libinput affects Red Hat Enterprise Linux 7, 8, 9, and 10 by allowing a local attacker with access to /dev/uinput to inject arbitrary udev properties via the libinput-device-group helper. Exploitation can result in root code execution through abuse of udev REMOVE_CMD properties that are run when a device is removed, mapping to CWE-78 (OS Command Injection). No public exploit identified at time of analysis, but the issue is vendor-confirmed by Red Hat.
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to crash the daemon or potentially execute arbitrary code by sending an oversized CREATE request. The flaw is tracked under CWE-121 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L), reported by Red Hat against RHEL 6 through 10, and there is no public exploit identified at time of analysis.
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
Authentication bypass in Red Hat OpenShift Container Platform 4 Router allows remote unauthenticated attackers to impersonate TLS client certificate identities by injecting X-SSL-Client-* headers over plain HTTP. The flaw affects Routes configured with insecureEdgeTerminationPolicy set to Allow, where the HTTP frontend fails to strip these trusted headers from inbound requests. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC marks exploitation status as none with total technical impact.
Arbitrary file read in KubeVirt's virt-exportserver component allows authenticated namespace users to exfiltrate sensitive files from the exporter pod via symlink-based path traversal in the VMExport directory endpoint. The flaw, reported by Red Hat and impacting Red Hat OpenShift Virtualization 4, carries a CVSS 7.7 score driven by scope change and high confidentiality impact, though no public exploit identified at time of analysis.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows an administrator with only limited client-management rights to attach arbitrary realm roles - including highly privileged ones - to a client's scope mappings, causing those roles to be injected into user authentication tokens that traverse the modified client. The flaw affects the Red Hat Build of Keycloak per the vendor advisory and has no public exploit identified at time of analysis, but the high-privilege admin pivot makes it operationally significant in multi-tenant identity deployments.
Signature verification bypass in Red Hat Build of Keycloak exposes OIDC authorization flows to unauthorized claim injection via JWE-encrypted request objects. When a JWE-encrypted request object is submitted and its decrypted payload is raw JSON rather than a signed JWT, Keycloak processes the claims without enforcing the configured signature policy, violating both OIDC Core and Financial-grade API (FAPI) signing requirements. An unauthenticated remote attacker can exploit this to submit forged claims into the authorization flow, achieving high integrity impact against affected deployments; no public exploit has been identified at time of analysis, and a redirect URI allowlist serves as a partial compensating control.
Certificate validation bypass in GnuTLS (as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images) lets a remote attacker defeat hostname verification: when a certificate carries an oversized Subject Alternative Name, the library incorrectly abandons SAN matching and falls back to the legacy Common Name field, accepting certificates it should reject. An attacker positioned to intercept traffic can present such a certificate to impersonate a trusted server and conduct spoofing or man-in-the-middle attacks against TLS clients that rely on GnuTLS. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data.
Improper certificate validation in GnuTLS (CWE-295) lets a remote attacker defeat TLS hostname verification by presenting a certificate that carries URI or SRV Subject Alternative Names, causing GnuTLS to incorrectly fall back to matching the connection's DNS hostname against the certificate's Common Name (CN) and enabling service spoofing or man-in-the-middle interception of sensitive data. The flaw was reported by Red Hat against GnuTLS as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, and carries a CVSS 3.1 base score of 7.1 driven by high integrity impact. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim to initiate a connection to attacker-controlled infrastructure (UI:R).
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Privilege escalation to cluster-wide control in KubeVirt's virt-handler component (as shipped in Red Hat OpenShift Virtualization 4) allows a namespace-scoped OpenShift user with edit permissions to hijack the virt-handler's privileged Unix socket connection via a symlink swap on a virtual machine console socket. Successful exploitation leads to interaction with arbitrary host Unix sockets, including CRI-O, enabling node takeover and cluster compromise. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.12%, 30th percentile), but CVSS is 9.9 with a scope change reflecting the host/cluster blast radius.
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstream Identity Provider to hijack a victim's local account through the cross-session account-linking flow. The cross-session verification proof is keyed only by the tuple of local userId and idpAlias without binding to the specific upstream identity that was actually verified, so the proof can be replayed against a different upstream account on the same IdP. EPSS is currently 0.03% (8th percentile) and no public exploit identified at time of analysis, but technical impact is rated total by CISA SSVC.
Implicit flow bypass in Red Hat Build of Keycloak allows a low-privileged authenticated user who already knows another user's credentials and a client ID to obtain OIDC access tokens from clients where the implicit flow was explicitly disabled. Beyond the unauthorized token issuance, the resulting tokens can be written to server logs, proxy logs, and HTTP Referer headers, broadening the disclosure surface. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take over accounts, including highly privileged administrative ones. Exploitation requires the victim to click an attacker-crafted link, after which an existing SSO session causes transparent authentication into the attacker-controlled flow. No public exploit identified at time of analysis, but Red Hat has confirmed the flaw in Red Hat Build of Keycloak.
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abusing a parser discrepancy between Keycloak and Java's URI implementation during redirect URL validation. The flaw applies only to clients configured with a wildcard ('*') in the 'Valid Redirect URIs' field and requires the victim to click a crafted link, with no public exploit identified at time of analysis.
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads by submitting specially crafted XML payloads to the SAML endpoint. The flaw renders the identity provider unavailable, disrupting authentication for all downstream applications relying on it. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Cockpit's system logs UI allows authenticated users to inject shell metacharacters into unsanitized URL parameters, executing arbitrary commands on RHEL 7/8/9/10 hosts. Attack requires low-complexity exploitation by a logged-in user who can craft malicious links targeting the logs interface. No public exploit identified at time of analysis, though the vulnerable code section is publicly accessible on GitHub. EPSS data not available; CVSS 8.0 reflects high impact across confidentiality, integrity, and availability if user interaction occurs.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Out-of-bounds reads in the X.Org X server's XKB (X Keyboard Extension) modifier-map handling allow an authenticated X11 client to drive memory reads past the intended buffer, disclosing server memory or crashing the server for a denial of service. Affected deployments include the upstream X.Org X server and the Red Hat Enterprise Linux 6, 7, 8, 9 and 10 streams plus SUSE Linux Enterprise packages covered by the SUSE-SU-2026 advisories. Exposure is gated by reachability: on default modern RHEL and SUSE installations the X server does not listen on TCP, so realistic attackers are local users, already-authorized X sessions, or malicious/compromised X clients rather than a remote unauthenticated network actor; no integrity or code-execution impact is indicated. EPSS is 0.01% (2nd percentile) and SSVC records no exploitation, so no public exploit has been identified at time of analysis, while vendor errata are already published and the provider priority label is act_now.
An out-of-bounds read in the X.Org X server's XKB geometry handling, specifically in CheckSetGeom() and XkbAddGeomKeyAlias(), allows an attacker who can open an X11 client connection to the server to read uninitialized or out-of-bounds memory or to crash the X server. Affected builds are those shipped in Red Hat Enterprise Linux 6 through 10 and the SUSE products covered by the SUSE-SU-2026:1328 through 1335 and SUSE-SU-2026:21211 updates; the supplied CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/A:H), while our assessment lowers privileges required to low because a connection must ordinarily clear X authorization such as an xauth cookie before reaching the vulnerable code. No public exploit code was identified at time of analysis (EPSS 0.01%, 2nd percentile; SSVC exploitation: none), but the vuln.today decision label is act_now, so the divergent signals should be weighed together rather than on the base score alone.
Authentication bypass in Red Hat Ansible Automation Platform 2.6 allows authenticated attackers to hijack arbitrary user accounts, including administrator accounts, via email-based identity provider linking manipulation. The AAP gateway's user auto-link feature matches external IDP identities to existing accounts by email without ownership verification, enabling account takeover when an attacker controls an IDP account with a victim's email address. Red Hat has released patch RHSA-2026:13508. EPSS and KEV data not provided, but the low attack complexity (AC:L) and high confidentiality/integrity impact make this a critical authentication control failure requiring immediate remediation in environments using external identity providers.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Remote code execution in InstructLab affects Red Hat Enterprise Linux AI 3 when users download or train models from HuggingFace Hub. The linux_train.py script hardcodes trust_remote_code=True, allowing attackers to execute arbitrary Python code by hosting malicious models on HuggingFace and convincing users to run ilab train, download, or generate commands. This configuration weakness enables complete system compromise through social engineering attacks. CVSS 8.8 with network vector but requires user interaction, reducing automatic exploitation risk. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary code via unsafe deserialization in ProtoStream remote aggregation repository. Exploiting this vulnerability requires network access and low-privilege credentials but grants full system compromise affecting confidentiality, integrity, and availability. The attack complexity is rated high (AC:H), suggesting specific configuration or timing requirements. No active exploitation confirmed at time of analysis (not in CISA KEV), and public exploit code status is unknown.
Path traversal in InstructLab's chat session handler enables local authenticated attackers to write files to arbitrary filesystem locations by manipulating the logs_dir parameter. Red Hat Enterprise Linux AI 3 deployments are confirmed affected. CVSS 7.1 (High) reflects significant confidentiality and integrity impact, though exploitation requires local access and low-level privileges. No active exploitation (CISA KEV) or public proof-of-concept identified at time of analysis. EPSS data not available, suggesting limited immediate widespread exploitation risk despite high severity rating.
Red Hat Quay 3 bypasses password re-verification for sensitive operations such as token generation and robot account creation, allowing users with timed-out or idle authenticated sessions to perform privileged actions without providing valid credentials. An attacker with access to an abandoned browser session can execute sensitive operations despite the UI displaying authentication errors, resulting in unauthorized token creation, robot account manipulation, and information disclosure. CVSS 5.4 reflects moderate risk with network attack vector and low privilege requirements.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Privilege escalation in ArgoCD Image Updater allows authenticated low-privileged users in a multi-tenant Red Hat OpenShift GitOps environment to update container images of applications in other namespaces. This cross‑namespace attack bypasses access controls, leading to unauthorized image changes and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is very low.
Buffer overflow in GIMP's GIF image loading component allows arbitrary code execution when a victim opens a specially crafted GIF file. This local‑attack vulnerability (CVSS 3.1: AV:L/PR:N/UI:R) can lead to full compromise of the user's session. No public exploit has been identified, and EPSS exploitation probability is very low (0.01 %).
GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authenticated low-privileged user retrieve SA tokens via an exposed NodeJS endpoint, then reuse them to reach Kubernetes resources beyond the dashboard's intended scope. Rated CVSS 9.9 with a changed scope, the flaw effectively converts limited dashboard access into broad cluster access. There is no public exploit identified at time of analysis and EPSS is very low (0.06%), but a vendor patch is already available via Red Hat errata.
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deserialization (CWE-502) of resumable container image layer upload state stored in the database. An attacker with the privileges needed to initiate image uploads can tamper with intermediate upload data to execute arbitrary code on the Quay server. No public exploit identified at time of analysis; EPSS is low (0.06%) and CISA SSVC marks exploitation status as none, though technical impact is rated total.
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concurrent uploads by other users across the entire registry, enabling unauthorized read, modification, or cancellation of in-progress uploads in repositories they cannot access. This cross-repository attack vector affects Red Hat Quay 3.x and Mirror Registry deployments. EPSS score of 0.03% (8th percentile) indicates low predicted exploitation probability in the wild, and CISA SSVC framework rates this as non-automatable with no known exploitation, suggesting targeted risk rather than widespread threat despite the 7.4 CVSS score.
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the host system by injecting malicious SSH options through the login endpoint. Affecting Red Hat Enterprise Linux versions 7 through 10, this critical pre-authentication vulnerability (CVSS 9.8) requires no credentials and executes code before any authentication checks occur. EPSS data not available; no confirmed active exploitation (CISA KEV) at time of analysis, though the pre-authentication nature and command injection vector present severe risk for internet-exposed Cockpit instances.
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows managed cluster administrators with high-level local access to forge client certificates, achieving cross-cluster privilege escalation to other managed clusters including the hub cluster. The CVSS 8.2 rating reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires existing high-privilege local access (PR:H) and local attack vector (AV:L). No public exploit code or CISA KEV listing identified at time of analysis, though technical details are publicly documented in researcher blog post.
Heap-based out-of-bounds read in libtheora's AVI parser allows local attackers with limited privileges to trigger application crashes or leak heap memory via specially crafted AVI files with truncated header sub-chunks. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and requires user interaction (opening a malicious file), with real-world impact limited to denial-of-service and potential information disclosure rather than code execution.
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gain unauthorized access to victim-owned resources. The vulnerability (confirmed actively exploited - CISA KEV) enables attackers to inject arbitrary resource identifiers during policy creation, obtaining Requesting Party Tokens for resources they do not own. With CVSS 8.1 (High), network-accessible attack vector, and low complexity, this represents a significant access control bypass in enterprise identity management deployments. EPSS data and public exploit status not confirmed from available data.
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by submitting specially crafted POST requests with excessively long scope parameters to the OpenID Connect token endpoint. No public exploit identified at time of analysis, but CVSS 7.5 (High) with network attack vector and low complexity indicates straightforward exploitation. Authentication requirements: unauthenticated (CVSS PR:N). The vulnerability stems from improper resource management (CWE-1050), enabling attackers to cause prolonged processing times and service disruption without any authentication or user interaction.
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level access tokens. The SingleUseObjectProvider's lack of type and namespace isolation permits attackers to forge valid authorization codes remotely, though exploitation requires high complexity (AC:H). No public exploit identified at time of analysis, with CVSS 7.4 indicating high confidentiality and integrity impact but no availability disruption.
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web server to bypass wildcard-based redirect URI validation and steal OAuth access tokens. Attack requires low complexity and user interaction (CVSS 7.3). EPSS and KEV status not available; no public exploit identified at time of analysis. This CWE-601 flaw enables token theft through maliciously crafted redirect flows, posing significant risk to SSO deployments where Keycloak shares a web server with attacker-controllable content.
Remote denial of service via integer overflow in Corosync cluster engine affects Red Hat Enterprise Linux 7-10 and OpenShift Container Platform 4. Unauthenticated attackers can send crafted UDP packets to crash Corosync services running in totemudp/totemudpu mode (CVSS 7.5, AV:N/PR:N). EPSS data not provided; no public exploit identified at time of analysis. Impacts high-availability cluster deployments where Corosync provides quorum and messaging services.
Out-of-bounds read in Corosync allows unauthenticated remote attackers to crash cluster nodes and potentially leak memory via malformed UDP packets. Affects default totemudp/totemudpu configurations across Red Hat Enterprise Linux 7/8/9/10 and OpenShift Container Platform 4. CVSS 8.2 (High) with network attack vector, low complexity, and no authentication required. EPSS and exploitation status data not available; no public exploit identified at time of analysis. Impacts high-availability clustering infrastructure commonly used in enterprise production environments.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
Command injection in Foreman's WebSocket proxy, as shipped in Red Hat Satellite 6, allows a malicious compute-resource provider to achieve remote code execution on the Satellite/Foreman server when a user opens a VM VNC console. The CVSS vector shows network access with no privileges (PR:N) but requires user interaction (UI:R), and practical exploitation depends on the attacker already controlling a registered compute resource that returns a crafted hostname; publicly available exploit code exists, while EPSS remains low at 0.12%.
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
The Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenticated remote attackers to read arbitrary files accessible to the server process, including sensitive system files, application configurations, and credentials. Red Hat OpenShift AI (RHOAI) deployments are confirmed affected across multiple versions. The vulnerability is rated 7.5 (High) with network-based exploitation requiring no authentication or user interaction, though no active exploitation (KEV) or public proof-of-concept is currently documented.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Keycloak contains an authentication bypass vulnerability in its SAML broker functionality that allows remote attackers with low-level privileges to complete IdP-initiated broker logins even when the SAML Identity Provider has been administratively disabled. Red Hat Build of Keycloak versions 26.2 and 26.4 are affected, with patches available in versions 26.2-16, 26.2.14-1, 26.4-12, and 26.4.10-1. The CVSS score of 8.1 reflects high confidentiality and integrity impact, though no evidence of active exploitation (KEV) or public proof-of-concept has been reported at this time.
Keycloak's SAML broker endpoint contains a validation flaw that allows attackers with a valid signed SAML assertion to inject encrypted assertions for arbitrary principals when the overall SAML response is unsigned. This leads to authentication bypass and unauthorized access to protected resources. Red Hat build of Keycloak versions 26.2 and 26.4 are affected, with patches available in versions 26.2-16, 26.2.14-1, 26.4-12, and 26.4.10-1. No evidence of active exploitation (not in CISA KEV) has been reported.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
Stack exhaustion in the Ickle query parser shipped in Infinispan and its Red Hat product builds lets an authenticated user who holds the BULK_READ permission submit a cache query with deeply nested predicates, driving recursive parsing until the Java thread stack is exhausted and an uncaught StackOverflowError is thrown. Impact is limited to availability (CVSS 4.3, A:L) - there is no data exposure or modification - and the attacker must already possess a valid account plus the specific BULK_READ grant. A public PoC reference exists in the form of the Red Hat Bugzilla record; no public exploit code has been confirmed and no EPSS score was supplied, and the vuln.today decision label places this in the this_month queue rather than an emergency response.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
Prefix-matching defects in the Kroxylicious ACL authorizer can let an authenticated Kafka client read topics that configured ACL rules are intended to deny when overlapping prefix rules or mixed principal types are present. The issue affects Red Hat Streams for Apache Kafka 2 and 3 deployments that use the Kroxylicious ACL authorizer and carries a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid Kafka client authentication plus an ACL configuration with overlapping or cross-type prefixes, so deployments without that layout are not exposed; no public exploit was identified at time of analysis.
Out-of-bounds read in Eye of GNOME (eog) when parsing a crafted PNG with malformed ICC color-profile metadata allows an attacker who convinces a user to open the image to crash the viewer and potentially expose limited memory contents. Affected deployments are GNOME desktop systems, including the Red Hat Enterprise Linux 6 through 9 package scope identified in CPE data; headless servers without eog installed are not exposed. Exploitation requires user interaction via a local vector, and no public exploit or CISA KEV confirmation was identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Request smuggling in Undertow's ChunkReader lets a remote attacker bypass the chunk-size limit using a crafted 15-digit chunk length, overflow internal state flags, and force the server to end a request body early so the trailing bytes are reinterpreted as a second, smuggled request. Red Hat ships the affected Undertow code in JBoss Enterprise Application Platform 7 and 8, Fuse 7, Red Hat Single Sign-On 7, the Red Hat build of Apache Camel for Spring Boot 4, and Red Hat Enterprise Linux 8 and 9, scored CVSS 3.1 6.5 with low integrity and availability impact and no confidentiality impact. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; real-world consequence is concentrated in deployments where Undertow shares connections with, or sits behind, a front-end proxy or load balancer whose parser disagrees on message boundaries, while standalone deployments without connection reuse are largely limited to premature termination of the attacker's own request.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
Mandatory required-action challenges in Keycloak - as shipped in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 - can be skipped when an authorization request carries a kc_action query parameter set to a required action that is already pending on the account, such as profile verification (VERIFY_PROFILE) or terms-and-conditions acceptance. The attacker must be an authenticated user (CVSS PR:L) whose administrator has already assigned that mandatory action; the broken application-initiated-action handling then lets the authorization code be issued without the challenge being completed, so the user reaches the application while bypassing onboarding and compliance gates. The exposure is confined to defeating that mandatory-action control (integrity impact only, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.4 medium) and does not escalate the user beyond their own granted access; no public exploit code or CISA KEV confirmation was identified at time of analysis.
Local privilege escalation in libinput affects Red Hat Enterprise Linux 7, 8, 9, and 10 by allowing a local attacker with access to /dev/uinput to inject arbitrary udev properties via the libinput-device-group helper. Exploitation can result in root code execution through abuse of udev REMOVE_CMD properties that are run when a device is removed, mapping to CWE-78 (OS Command Injection). No public exploit identified at time of analysis, but the issue is vendor-confirmed by Red Hat.
HAProxy configuration injection in Red Hat OpenShift Container Platform 4 allows a low-privileged tenant with permission to create or modify Route resources to inject controlled directives into the cluster ingress configuration via the spec.path field. No public exploit identified at time of analysis, but the CVSS 8.8 score with scope change (S:C) reflects the ability to break out of the tenant boundary and impact the shared HAProxy router serving the entire cluster.
Stack-based buffer overflow in rrdcached (the caching daemon for rrdtool) allows a local attacker with socket access to crash the daemon or potentially execute arbitrary code by sending an oversized CREATE request. The flaw is tracked under CWE-121 with a CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L), reported by Red Hat against RHEL 6 through 10, and there is no public exploit identified at time of analysis.
Local code execution in Poppler's Splash rendering backend allows attackers to compromise applications that open attacker-supplied PDFs by triggering an integer overflow in tilingPatternFill that produces an undersized heap allocation and a subsequent out-of-bounds write. The flaw affects Poppler as shipped across Red Hat Enterprise Linux 6 through 10 and Red Hat Hardened Images, with impact including arbitrary code execution, information disclosure, or denial of service in the rendering process. No public exploit identified at time of analysis, and the CVSS 7.8 vector requires user interaction to open a malicious PDF.
Authentication bypass in Red Hat OpenShift Container Platform 4 Router allows remote unauthenticated attackers to impersonate TLS client certificate identities by injecting X-SSL-Client-* headers over plain HTTP. The flaw affects Routes configured with insecureEdgeTerminationPolicy set to Allow, where the HTTP frontend fails to strip these trusted headers from inbound requests. No public exploit identified at time of analysis, EPSS is very low (0.03%), and CISA SSVC marks exploitation status as none with total technical impact.
Arbitrary file read in KubeVirt's virt-exportserver component allows authenticated namespace users to exfiltrate sensitive files from the exporter pod via symlink-based path traversal in the VMExport directory endpoint. The flaw, reported by Red Hat and impacting Red Hat OpenShift Virtualization 4, carries a CVSS 7.7 score driven by scope change and high confidentiality impact, though no public exploit identified at time of analysis.
Command injection in the rpmuncompress utility of RPM allows local attackers to execute arbitrary commands when a victim extracts a maliciously crafted ZIP, 7z, or GEM archive whose top-level folder name contains shell metacharacters. The flaw affects Red Hat Enterprise Linux 6 through 10 and downstream products including OpenShift Container Platform 4, Satellite 6, Red Hat Hardened Images, and Quarkus Native Builder. No public exploit identified at time of analysis, and the issue requires user interaction with an attacker-supplied archive, but successful exploitation yields full code execution under the extracting user's identity.
Privilege escalation in Keycloak's Fine-Grained Admin Permissions v2 (FGAPv2) allows an administrator with only limited client-management rights to attach arbitrary realm roles - including highly privileged ones - to a client's scope mappings, causing those roles to be injected into user authentication tokens that traverse the modified client. The flaw affects the Red Hat Build of Keycloak per the vendor advisory and has no public exploit identified at time of analysis, but the high-privilege admin pivot makes it operationally significant in multi-tenant identity deployments.
Signature verification bypass in Red Hat Build of Keycloak exposes OIDC authorization flows to unauthorized claim injection via JWE-encrypted request objects. When a JWE-encrypted request object is submitted and its decrypted payload is raw JSON rather than a signed JWT, Keycloak processes the claims without enforcing the configured signature policy, violating both OIDC Core and Financial-grade API (FAPI) signing requirements. An unauthenticated remote attacker can exploit this to submit forged claims into the authorization flow, achieving high integrity impact against affected deployments; no public exploit has been identified at time of analysis, and a redirect URI allowlist serves as a partial compensating control.
Certificate validation bypass in GnuTLS (as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images) lets a remote attacker defeat hostname verification: when a certificate carries an oversized Subject Alternative Name, the library incorrectly abandons SAN matching and falls back to the legacy Common Name field, accepting certificates it should reject. An attacker positioned to intercept traffic can present such a certificate to impersonate a trusted server and conduct spoofing or man-in-the-middle attacks against TLS clients that rely on GnuTLS. There is no public exploit identified at time of analysis, no CISA KEV listing, and no EPSS score in the provided data.
Improper certificate validation in GnuTLS (CWE-295) lets a remote attacker defeat TLS hostname verification by presenting a certificate that carries URI or SRV Subject Alternative Names, causing GnuTLS to incorrectly fall back to matching the connection's DNS hostname against the certificate's Common Name (CN) and enabling service spoofing or man-in-the-middle interception of sensitive data. The flaw was reported by Red Hat against GnuTLS as shipped in Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images, and carries a CVSS 3.1 base score of 7.1 driven by high integrity impact. No public exploit has been identified at time of analysis and the issue is not listed in CISA KEV; exploitation requires the victim to initiate a connection to attacker-controlled infrastructure (UI:R).
Information disclosure and denial of service in GnuTLS (libgnutls) let a remote, unauthenticated attacker trigger a heap overread against TLS servers that perform legacy RSA key exchange using a private key backed by a PKCS#11 token. By sending an abnormally short premaster secret, the attacker causes the library to read beyond an allocated buffer (CWE-1284), which can leak a small amount of adjacent heap memory and, per the CVSS vector, more strongly impacts availability (A:H). No public exploit has been identified at time of analysis and the issue is not in CISA KEV; EPSS and SSVC data were not provided.
Heap buffer overflow in libsolv allows local attackers to corrupt memory when a vulnerable application processes a maliciously crafted .solv repository metadata file. The flaw stems from insufficient input validation during decompression of attacker-controlled data, enabling information disclosure, control-flow alteration, or denial of service across multiple Red Hat Enterprise Linux releases and SUSE distributions. SSVC marks exploitation as PoC-level with total technical impact, while EPSS remains very low at 0.01%, indicating limited probability of widespread exploitation despite high severity.
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via crafted print job descriptions. The flaw stems from unescaped expansion of the client-controlled '%J' substitution token into the configured 'print command', enabling shell metacharacter injection. No public exploit has been identified at time of analysis, and EPSS scores exploitation probability at only 0.08%, but CVSS 9.0 with scope change reflects high potential impact on any Samba host exposing print services.
Privilege escalation to cluster-wide control in KubeVirt's virt-handler component (as shipped in Red Hat OpenShift Virtualization 4) allows a namespace-scoped OpenShift user with edit permissions to hijack the virt-handler's privileged Unix socket connection via a symlink swap on a virtual machine console socket. Successful exploitation leads to interaction with arbitrary host Unix sockets, including CRI-O, enabling node takeover and cluster compromise. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.12%, 30th percentile), but CVSS is 9.9 with a scope change reflecting the host/cluster blast radius.
Identity linking bypass in Red Hat build of Keycloak allows an attacker controlling a second account on the same upstream Identity Provider to hijack a victim's local account through the cross-session account-linking flow. The cross-session verification proof is keyed only by the tuple of local userId and idpAlias without binding to the specific upstream identity that was actually verified, so the proof can be replayed against a different upstream account on the same IdP. EPSS is currently 0.03% (8th percentile) and no public exploit identified at time of analysis, but technical impact is rated total by CISA SSVC.
Implicit flow bypass in Red Hat Build of Keycloak allows a low-privileged authenticated user who already knows another user's credentials and a client ID to obtain OIDC access tokens from clients where the implicit flow was explicitly disabled. Beyond the unauthorized token issuance, the resulting tokens can be written to server logs, proxy logs, and HTTP Referer headers, broadening the disclosure surface. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Session fixation in Keycloak's login-actions endpoints allows remote attackers to hijack authenticated sessions and take over accounts, including highly privileged administrative ones. Exploitation requires the victim to click an attacker-crafted link, after which an existing SSO session causes transparent authentication into the attacker-controlled flow. No public exploit identified at time of analysis, but Red Hat has confirmed the flaw in Red Hat Build of Keycloak.
Open redirect in Red Hat build of Keycloak permits remote attackers to send victims to attacker-controlled hosts by abusing a parser discrepancy between Keycloak and Java's URI implementation during redirect URL validation. The flaw applies only to clients configured with a wildcard ('*') in the 'Valid Redirect URIs' field and requires the victim to click a crafted link, with no public exploit identified at time of analysis.
Denial of service in Red Hat build of Keycloak allows remote unauthenticated attackers to exhaust CPU and worker threads by submitting specially crafted XML payloads to the SAML endpoint. The flaw renders the identity provider unavailable, disrupting authentication for all downstream applications relying on it. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Remote code execution in Cockpit's system logs UI allows authenticated users to inject shell metacharacters into unsanitized URL parameters, executing arbitrary commands on RHEL 7/8/9/10 hosts. Attack requires low-complexity exploitation by a logged-in user who can craft malicious links targeting the logs interface. No public exploit identified at time of analysis, though the vulnerable code section is publicly accessible on GitHub. EPSS data not available; CVSS 8.0 reflects high impact across confidentiality, integrity, and availability if user interaction occurs.
Certificate validation in GnuTLS can be bypassed when a certificate chain contains Certificate Authorities with only excluded name constraints followed by CAs with permitted name constraints. Remote attackers can exploit this flaw (CVSS 7.4, AV:N/AC:H) to present invalid certificates that pass validation, enabling man-in-the-middle attacks or service impersonation against TLS-protected communications. The vulnerability affects Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images. No public exploit or active exploitation confirmed at time of analysis, though the technical nature suggests targeted attacks against high-value certificate infrastructure are feasible.
Out-of-bounds reads in the X.Org X server's XKB (X Keyboard Extension) modifier-map handling allow an authenticated X11 client to drive memory reads past the intended buffer, disclosing server memory or crashing the server for a denial of service. Affected deployments include the upstream X.Org X server and the Red Hat Enterprise Linux 6, 7, 8, 9 and 10 streams plus SUSE Linux Enterprise packages covered by the SUSE-SU-2026 advisories. Exposure is gated by reachability: on default modern RHEL and SUSE installations the X server does not listen on TCP, so realistic attackers are local users, already-authorized X sessions, or malicious/compromised X clients rather than a remote unauthenticated network actor; no integrity or code-execution impact is indicated. EPSS is 0.01% (2nd percentile) and SSVC records no exploitation, so no public exploit has been identified at time of analysis, while vendor errata are already published and the provider priority label is act_now.
An out-of-bounds read in the X.Org X server's XKB geometry handling, specifically in CheckSetGeom() and XkbAddGeomKeyAlias(), allows an attacker who can open an X11 client connection to the server to read uninitialized or out-of-bounds memory or to crash the X server. Affected builds are those shipped in Red Hat Enterprise Linux 6 through 10 and the SUSE products covered by the SUSE-SU-2026:1328 through 1335 and SUSE-SU-2026:21211 updates; the supplied CVSS 3.1 score is 9.1 (AV:N/AC:L/PR:N/UI:N/C:H/A:H), while our assessment lowers privileges required to low because a connection must ordinarily clear X authorization such as an xauth cookie before reaching the vulnerable code. No public exploit code was identified at time of analysis (EPSS 0.01%, 2nd percentile; SSVC exploitation: none), but the vuln.today decision label is act_now, so the divergent signals should be weighed together rather than on the base score alone.
Authentication bypass in Red Hat Ansible Automation Platform 2.6 allows authenticated attackers to hijack arbitrary user accounts, including administrator accounts, via email-based identity provider linking manipulation. The AAP gateway's user auto-link feature matches external IDP identities to existing accounts by email without ownership verification, enabling account takeover when an attacker controls an IDP account with a victim's email address. Red Hat has released patch RHSA-2026:13508. EPSS and KEV data not provided, but the low attack complexity (AC:L) and high confidentiality/integrity impact make this a critical authentication control failure requiring immediate remediation in environments using external identity providers.
Heap buffer overflow in GnuTLS DTLS handshake allows remote unauthenticated attackers to crash applications or corrupt memory. The vulnerability stems from inconsistent fragment validation in merge_handshake_packet(), where attackers can send crafted DTLS fragments with conflicting message_length values to trigger out-of-bounds writes. Red Hat reported this affecting RHEL 6-10 and OpenShift Container Platform 4. CVSS 7.5 (High) reflects network-accessible denial of service, though memory corruption may enable further exploitation. No EPSS data, KEV status, or POC availability reported at time of analysis, but the remote unauthenticated attack vector (AV:N/PR:N) and low complexity (AC:L) make this a priority for systems using DTLS.
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an integer underflow by sending malformed handshake fragments with zero length and a non-zero offset, enabling information disclosure or denial of service against Red Hat-shipped GnuTLS (RHEL 6 through 10, OpenShift Container Platform 4, and Red Hat Hardened Images). Reported by Red Hat with a vendor patch available and errata released; no public exploit identified at time of analysis, and EPSS is very low (0.04%, 11th percentile) with SSVC exploitation status 'none'. CVSS 9.1 reflects high confidentiality and availability impact over the network at low complexity without authentication.
Certificate name-constraints bypass in GnuTLS allows a remote attacker to craft a leaf certificate whose Subject Alternative Name differs only in letter casing from a constrained dNSName or rfc822Name, causing GnuTLS to accept a certificate that its excludedSubtrees/permittedSubtrees policy should reject. The flaw stems from case-sensitive comparison of name-constraint labels and enables unauthorized access, impersonation, or information disclosure across software (notably Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4) that relies on GnuTLS for X.509 validation. SSVC notes a public proof-of-concept exists, though EPSS exploitation probability is very low (0.03%, 9th percentile) and the issue is not in CISA KEV.
Denial of service in libxml2 allows a remote attacker to crash any application that uses the library to XSD-validate an attacker-supplied XML document containing an internal entity reference. The flaw is a CWE-843 type confusion triggered during schema validation, affecting a wide range of Red Hat products that ship libxml2. No public exploit identified at time of analysis, and EPSS is very low (0.01%, 3rd percentile), consistent with SSVC exploitation status of 'none'.
Out-of-bounds memory read in the X.Org X server's XKB key types request handling allows a local, authenticated client to disclose adjacent server memory or crash the server (DoS), with higher-impact outcomes possible in certain configurations. The flaw affects the X server component shipped across Red Hat Enterprise Linux 6 through 10 and corresponding SUSE releases, and stems from missing bounds validation on an XKB request. There is no public exploit identified at time of analysis, EPSS is negligible (0.01%), and CISA/SSVC records no known exploitation.
Local privilege-relevant memory corruption in the X.Org X server arises from a use-after-free in the XSYNC fence-triggering path (miSyncTriggerFence()), letting any client with a connection to the display crash the server or corrupt heap memory without user interaction. Rated CVSS 7.8 with total technical impact per CISA SSVC, it currently shows no public exploit identified at time of analysis, no CISA KEV listing, and a very low EPSS of 0.01% (3rd percentile). Because the X server frequently runs with elevated privileges, successful memory corruption could escalate beyond denial of service.
Memory-disclosure and denial-of-service in the X.Org X server arises from an integer underflow (CWE-191) in the XKB compatibility map handling, which lets a client with local or remote X11 access trigger an out-of-bounds buffer read. Any attacker able to open a connection to the display server can crash it or read adjacent server memory, with Red Hat and SUSE rating the technical impact as total; no public exploit identified at time of analysis and EPSS is negligible (0.01%, 2nd percentile). This was reported by Red Hat and affects the X server shipped across Red Hat Enterprise Linux 6 through 10.
Remote code execution in InstructLab affects Red Hat Enterprise Linux AI 3 when users download or train models from HuggingFace Hub. The linux_train.py script hardcodes trust_remote_code=True, allowing attackers to execute arbitrary Python code by hosting malicious models on HuggingFace and convincing users to run ilab train, download, or generate commands. This configuration weakness enables complete system compromise through social engineering attacks. CVSS 8.8 with network vector but requires user interaction, reducing automatic exploitation risk. No active exploitation (CISA KEV) or public POC identified at time of analysis.
Remote code execution in Red Hat Apache Camel Infinispan component allows low-privileged attackers to execute arbitrary code via unsafe deserialization in ProtoStream remote aggregation repository. Exploiting this vulnerability requires network access and low-privilege credentials but grants full system compromise affecting confidentiality, integrity, and availability. The attack complexity is rated high (AC:H), suggesting specific configuration or timing requirements. No active exploitation confirmed at time of analysis (not in CISA KEV), and public exploit code status is unknown.
Path traversal in InstructLab's chat session handler enables local authenticated attackers to write files to arbitrary filesystem locations by manipulating the logs_dir parameter. Red Hat Enterprise Linux AI 3 deployments are confirmed affected. CVSS 7.1 (High) reflects significant confidentiality and integrity impact, though exploitation requires local access and low-level privileges. No active exploitation (CISA KEV) or public proof-of-concept identified at time of analysis. EPSS data not available, suggesting limited immediate widespread exploitation risk despite high severity rating.
Red Hat Quay 3 bypasses password re-verification for sensitive operations such as token generation and robot account creation, allowing users with timed-out or idle authenticated sessions to perform privileged actions without providing valid credentials. An attacker with access to an abandoned browser session can execute sensitive operations despite the UI displaying authentication errors, resulting in unauthorized token creation, robot account manipulation, and information disclosure. CVSS 5.4 reflects moderate risk with network attack vector and low privilege requirements.
Heap buffer overflow in GNU Binutils XCOFF linker allows arbitrary code execution when a local user processes a malicious object file. Red Hat Enterprise Linux versions 6 through 10 are confirmed affected via CPE data. CVSS 7.8 reflects local attack vector requiring user interaction (opening/linking the crafted file). No active exploitation confirmed (not in CISA KEV), and no public proof-of-concept identified at time of analysis. Real-world risk depends heavily on whether development workflows involve linking untrusted XCOFF files, which is uncommon outside AIX/PowerPC cross-compilation scenarios.
Out-of-bounds write in dnsmasq's DHCP split-relay handler allows remote unauthenticated denial of service via crafted BOOTREPLY packets. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4 when dnsmasq runs with the --dhcp-split-relay option enabled. CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) indicates trivial network exploitation, but real-world risk is mitigated by the non-default configuration requirement. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CWE-787 (out-of-bounds write) primitives are well-understood by attackers.
Privilege escalation in ArgoCD Image Updater allows authenticated low-privileged users in a multi-tenant Red Hat OpenShift GitOps environment to update container images of applications in other namespaces. This cross‑namespace attack bypasses access controls, leading to unauthorized image changes and integrity compromise. No public exploit or active exploitation has been identified, and the EPSS score is very low.
Buffer overflow in GIMP's GIF image loading component allows arbitrary code execution when a victim opens a specially crafted GIF file. This local‑attack vulnerability (CVSS 3.1: AV:L/PR:N/UI:R) can lead to full compromise of the user's session. No public exploit has been identified, and EPSS exploitation probability is very low (0.01 %).
GIMP is vulnerable to a heap buffer over-read in the icns_slurp() function when processing malicious ICNS image files, potentially leading to application crashes or information disclosure. An attacker must trick a local user into opening a specially crafted file, with no known public exploit or active exploitation at this time. A vendor patch is available from Red Hat for affected RHEL distributions.
GIMP's FITS image loader contains an integer overflow that can be triggered by a specially crafted file, leading to a heap buffer overflow and potential denial of service or arbitrary code execution. The vulnerability is patched by the vendor, and no active exploitation or public exploit code has been identified.
Kubernetes Service Account token disclosure in the odh-dashboard component of Red Hat OpenShift AI (RHOAI) lets an authenticated low-privileged user retrieve SA tokens via an exposed NodeJS endpoint, then reuse them to reach Kubernetes resources beyond the dashboard's intended scope. Rated CVSS 9.9 with a changed scope, the flaw effectively converts limited dashboard access into broad cluster access. There is no public exploit identified at time of analysis and EPSS is very low (0.06%), but a vendor patch is already available via Red Hat errata.
Remote unauthenticated attackers can crash GnuTLS servers by sending malformed TLS handshake messages containing invalid Pre-Shared Key binder values, triggering a NULL pointer dereference. Red Hat Enterprise Linux versions 6-10, OpenShift Container Platform 4, and Red Hat Hardened Images are affected. Vendor patches are available. EPSS score of 0.08% (24th percentile) suggests low current exploitation probability despite network-accessible attack vector. SSVC framework classifies this as automatable with partial technical impact but no known exploitation, making this a medium-priority patching target focused on preventing service disruption rather than data breach.
Local privilege escalation in libcap's cap_set_file() function affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4, where a TOCTOU race condition allows an unprivileged user with write access to a parent directory to redirect file capability updates onto an attacker-controlled file. Successful exploitation can inject or strip Linux file capabilities on arbitrary executables, yielding full privilege escalation on the host. No public exploit identified at time of analysis and EPSS is 0.01%, but a vendor patch is available.
Authenticated remote code execution in Red Hat Quay 3 and Mirror Registry for Red Hat OpenShift arises from unsafe deserialization (CWE-502) of resumable container image layer upload state stored in the database. An attacker with the privileges needed to initiate image uploads can tamper with intermediate upload data to execute arbitrary code on the Quay server. No public exploit identified at time of analysis; EPSS is low (0.06%) and CISA SSVC marks exploitation status as none, though technical impact is rated total.
Red Hat Quay's container image upload mechanism allows authenticated users with push privileges to interfere with concurrent uploads by other users across the entire registry, enabling unauthorized read, modification, or cancellation of in-progress uploads in repositories they cannot access. This cross-repository attack vector affects Red Hat Quay 3.x and Mirror Registry deployments. EPSS score of 0.03% (8th percentile) indicates low predicted exploitation probability in the wild, and CISA SSVC framework rates this as non-automatable with no known exploitation, suggesting targeted risk rather than widespread threat despite the 7.4 CVSS score.
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the host system by injecting malicious SSH options through the login endpoint. Affecting Red Hat Enterprise Linux versions 7 through 10, this critical pre-authentication vulnerability (CVSS 9.8) requires no credentials and executes code before any authentication checks occur. EPSS data not available; no confirmed active exploitation (CISA KEV) at time of analysis, though the pre-authentication nature and command injection vector present severe risk for internet-exposed Cockpit instances.
Improper certificate validation in Red Hat's Open Cluster Management (OCM) and Multicluster Engine for Kubernetes allows managed cluster administrators with high-level local access to forge client certificates, achieving cross-cluster privilege escalation to other managed clusters including the hub cluster. The CVSS 8.2 rating reflects high impact across confidentiality, integrity, and availability with scope change, though exploitation requires existing high-privilege local access (PR:H) and local attack vector (AV:L). No public exploit code or CISA KEV listing identified at time of analysis, though technical details are publicly documented in researcher blog post.
Heap-based out-of-bounds read in libtheora's AVI parser allows local attackers with limited privileges to trigger application crashes or leak heap memory via specially crafted AVI files with truncated header sub-chunks. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and requires user interaction (opening a malicious file), with real-world impact limited to denial-of-service and potential information disclosure rather than code execution.
Authenticated users with uma_protection role in Red Hat Keycloak can bypass User-Managed Access policy validation to gain unauthorized access to victim-owned resources. The vulnerability (confirmed actively exploited - CISA KEV) enables attackers to inject arbitrary resource identifiers during policy creation, obtaining Requesting Party Tokens for resources they do not own. With CVSS 8.1 (High), network-accessible attack vector, and low complexity, this represents a significant access control bypass in enterprise identity management deployments. EPSS data and public exploit status not confirmed from available data.
Denial of Service in Red Hat Build of Keycloak allows unauthenticated remote attackers to exhaust server resources by submitting specially crafted POST requests with excessively long scope parameters to the OpenID Connect token endpoint. No public exploit identified at time of analysis, but CVSS 7.5 (High) with network attack vector and low complexity indicates straightforward exploitation. Authentication requirements: unauthenticated (CVSS PR:N). The vulnerability stems from improper resource management (CWE-1050), enabling attackers to cause prolonged processing times and service disruption without any authentication or user interaction.
Authorization code forgery in Red Hat Keycloak enables unauthenticated attackers to escalate privileges to admin-level access tokens. The SingleUseObjectProvider's lack of type and namespace isolation permits attackers to forge valid authorization codes remotely, though exploitation requires high complexity (AC:H). No public exploit identified at time of analysis, with CVSS 7.4 indicating high confidentiality and integrity impact but no availability disruption.
Open redirect in Red Hat Build of Keycloak allows authenticated attackers with control over another path on the same web server to bypass wildcard-based redirect URI validation and steal OAuth access tokens. Attack requires low complexity and user interaction (CVSS 7.3). EPSS and KEV status not available; no public exploit identified at time of analysis. This CWE-601 flaw enables token theft through maliciously crafted redirect flows, posing significant risk to SSO deployments where Keycloak shares a web server with attacker-controllable content.
Remote denial of service via integer overflow in Corosync cluster engine affects Red Hat Enterprise Linux 7-10 and OpenShift Container Platform 4. Unauthenticated attackers can send crafted UDP packets to crash Corosync services running in totemudp/totemudpu mode (CVSS 7.5, AV:N/PR:N). EPSS data not provided; no public exploit identified at time of analysis. Impacts high-availability cluster deployments where Corosync provides quorum and messaging services.
Out-of-bounds read in Corosync allows unauthenticated remote attackers to crash cluster nodes and potentially leak memory via malformed UDP packets. Affects default totemudp/totemudpu configurations across Red Hat Enterprise Linux 7/8/9/10 and OpenShift Container Platform 4. CVSS 8.2 (High) with network attack vector, low complexity, and no authentication required. EPSS and exploitation status data not available; no public exploit identified at time of analysis. Impacts high-availability clustering infrastructure commonly used in enterprise production environments.
Heap-based buffer overflow in gdk-pixbuf's JPEG image loader enables remote denial of service through malformed JPEG images without user interaction. The vulnerability triggers during automated image processing operations like thumbnail generation across Red Hat Enterprise Linux 6 through 10, allowing unauthenticated network attackers to crash applications that process JPEG images. EPSS score of 0.09% (25th percentile) suggests low observed exploitation activity, consistent with SSVC assessment showing no active exploitation despite the vulnerability being fully automatable.
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via specially crafted ISO9660 images. The vulnerability affects Red Hat Enterprise Linux versions 6 through 10 and OpenShift Container Platform 4, with vendor patches released across multiple RHSA advisories. Despite the CVSS 7.5 score and network attack vector, EPSS exploitation probability is low (0.05%, 16th percentile) and no public exploit is identified at time of analysis, though SSVC classifies the vulnerability as automatable with total technical impact.
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel for Spring Boot) allows remote unauthenticated attackers to bypass front-end security controls by prepending whitespace to header lines. Undertow strips leading spaces from the first header line in violation of RFC 7230, creating a parser discrepancy between upstream proxies and the application server. No public exploit identified at time of analysis, and EPSS sits at 0.13% (32nd percentile), but the CVSS 9.1 and broad Red Hat middleware exposure make this a high-value target for chained attacks.
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator, which can desynchronize parsing when Undertow sits behind specific intermediaries such as older Apache Traffic Server or Google Cloud Classic Application Load Balancer. The flaw affects numerous Red Hat distributions of Undertow (JBoss EAP 7/8, Data Grid 8, Fuse 7, Camel for Spring Boot 4, RHEL 8/9/10) and carries a CVSS 9.1, though EPSS is only 0.04% and there is no public exploit identified at time of analysis.
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls by exploiting parsing discrepancies between Undertow and upstream proxies when handling crafted header names. The flaw (CWE-444) affects Undertow embedded in multiple Red Hat products including JBoss EAP 7/8, Data Grid 8, Fuse 7, and Apache Camel for Spring Boot 4, with Red Hat issuing patches via RHSA-2026:25125 and RHSA-2026:25126. There is no public exploit identified at time of analysis and EPSS is low (0.10%), but CVSS 9.1 and SSVC 'total' technical impact warrant prompt patching of internet-facing deployments.
Remote denial-of-service in libssh 0.11.x and earlier allows unauthenticated attackers to crash SSH server daemon processes via malformed GSSAPI authentication OID payloads. The vulnerability affects the ssh_get_hexa() API function when processing zero-length input, exploitable remotely when GSSAPI authentication is enabled and logging verbosity is set to SSH_LOG_PATCH (level 3) or higher. Red Hat, Ubuntu, SUSE, and Debian have released patches (libssh 0.11.4 and 0.12.0). EPSS score of 0.09% and SSVC assessment indicate low real-world exploitation likelihood despite network attack vector, with no active exploitation confirmed. Ubuntu classified this as low priority, and CISA SSVC notes exploitation as 'none' but 'automatable' with partial impact.
Denial of service in p11-kit's PKCS#11 RPC client allows a malicious remote token to trigger a NULL pointer dereference or undefined behavior in applications consuming derive-key operations. The flaw is reachable when an application calls C_DeriveKey against a remote token using IBM Kyber or IBM BTC derive mechanisms whose parameters are NULL, with the RPC client returning an uninitialized value. EPSS is low (0.10%) and no public exploit identified at time of analysis; SSVC marks exploitation as none but automatable.
Command injection in Foreman's WebSocket proxy, as shipped in Red Hat Satellite 6, allows a malicious compute-resource provider to achieve remote code execution on the Satellite/Foreman server when a user opens a VM VNC console. The CVSS vector shows network access with no privileges (PR:N) but requires user interaction (UI:R), and practical exploitation depends on the attacker already controlling a registered compute resource that returns a crafted hostname; publicly available exploit code exists, while EPSS remains low at 0.12%.
Heap buffer over-read in GIMP's PCX image loader allows a remote attacker who can convince a user to open a crafted PCX file to disclose adjacent heap memory and crash the application. The flaw stems from an off-by-one error (CWE-193) and is tracked across Red Hat Enterprise Linux 6 through 9. No public exploit identified at time of analysis and EPSS is very low (0.06%, 19th percentile), with CISA SSVC rating exploitation as 'none'.
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to out-of-bounds heap writes through incorrect memory pointer calculations. Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10 are confirmed affected. An attacker can exploit this by tricking a user into opening a specially crafted TIFF file, potentially achieving arbitrary code execution or causing application crashes.
The antchfx/xpath component in Debian is vulnerable to denial of service when processing specially crafted Boolean XPath expressions, which trigger an infinite loop in the logicalQuery.Select function consuming 100% CPU resources. Unauthenticated remote attackers can exploit this over the network without user interaction to disable affected systems. No patch is currently available.
The Feast Feature Server contains a path traversal vulnerability in its `/read-document` endpoint that allows unauthenticated remote attackers to read arbitrary files accessible to the server process, including sensitive system files, application configurations, and credentials. Red Hat OpenShift AI (RHOAI) deployments are confirmed affected across multiple versions. The vulnerability is rated 7.5 (High) with network-based exploitation requiring no authentication or user interaction, though no active exploitation (KEV) or public proof-of-concept is currently documented.
Heap memory disclosure in libarchive allows remote unauthenticated attackers to read sensitive heap data by submitting a malformed RAR archive. The flaw affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4, with vendor patches available per multiple RHSA advisories (RHSA-2026:8492 through RHSA-2026:8908). Despite the HIGH CVSS score of 7.5 and network-exploitable vector requiring no authentication, the EPSS score of 0.14% (35th percentile) indicates low observed exploitation probability. No public exploit code identified at time of analysis, and not listed in CISA KEV, suggesting this remains a patch-and-monitor priority rather than emergency response.
Keycloak contains an authentication bypass vulnerability in its SAML broker functionality that allows remote attackers with low-level privileges to complete IdP-initiated broker logins even when the SAML Identity Provider has been administratively disabled. Red Hat Build of Keycloak versions 26.2 and 26.4 are affected, with patches available in versions 26.2-16, 26.2.14-1, 26.4-12, and 26.4.10-1. The CVSS score of 8.1 reflects high confidentiality and integrity impact, though no evidence of active exploitation (KEV) or public proof-of-concept has been reported at this time.
Keycloak's SAML broker endpoint contains a validation flaw that allows attackers with a valid signed SAML assertion to inject encrypted assertions for arbitrary principals when the overall SAML response is unsigned. This leads to authentication bypass and unauthorized access to protected resources. Red Hat build of Keycloak versions 26.2 and 26.4 are affected, with patches available in versions 26.2-16, 26.2.14-1, 26.4-12, and 26.4.10-1. No evidence of active exploitation (not in CISA KEV) has been reported.
Information disclosure and denial-of-service in GNU Binutils' BFD linker (ld) arises from an out-of-bounds heap read when parsing malformed XCOFF object files. A local attacker who convinces a user to link or otherwise process a specially crafted XCOFF file can leak adjacent heap memory (CWE-125) or crash the linking process. Tracked by Red Hat across RHEL 6 through 10 and OpenShift 4; no public exploit is identified and EPSS exploitation probability is negligible (0.01%, 2nd percentile).
Out-of-bounds heap read in the BFD linker (ld) component of GNU Binutils allows information disclosure or an application-level crash when a victim is induced to process a crafted XCOFF object file. Affected across Red Hat Enterprise Linux 6 through 10 (and OpenShift Container Platform 4), exploitation requires user interaction and local file processing - there is no public exploit identified at time of analysis, and the EPSS probability is negligible (0.01%, 2nd percentile).
Infinite loop in libarchive's RAR5 decompression (archive_read_data) allows remote unauthenticated denial-of-service via malformed archive that passes checksum validation. Affects Red Hat Enterprise Linux 6-10 and OpenShift Container Platform 4. EPSS 0.04% (11th percentile) suggests low exploitation probability despite CVSS 7.5. Vendor patches available from Red Hat and Ubuntu. Upstream fix in libarchive PR#2877. No active exploitation confirmed (not in CISA KEV).
GStreamer's gst-plugins-base MicroDVD subtitle parser can crash the consuming media application when it processes a malformed .sub subtitle file, resulting in a NULL pointer dereference (CWE-476). Affected deployments include Red Hat Enterprise Linux 6, 7, 8, 9, and 10 packages, and the issue requires the victim to open or play media with the crafted subtitle, so exploitation depends on user interaction and is availability-only. No public exploit was identified at time of analysis; upstream fix references are available, but a released patched version is not independently confirmed from the supplied data.
Heap-based memory corruption in GStreamer's gst-plugins-bad H.265 parser allows unauthenticated remote attackers to crash applications that decode attacker-supplied HEVC media, giving a denial-of-service impact only with no confidentiality or integrity effect. The victim must actively open or play the crafted bitstream (CVSS UI:R), and the flaw is limited to a fixed-size array overrun triggered when the parser mishandles Screen Content Coding palette predictor initializer values. No public exploit code or confirmed active exploitation was identified at time of analysis, and the issue is rated moderate for routine patching rather than emergency response.
GStreamer's AV1 LEB128 parser can overflow when it processes a crafted AV1 bitstream, causing applications that decode or preview the media to crash. An unauthenticated remote attacker can trigger the overflow by supplying malformed AV1 content, but a user or application must open or preview it, and impact is limited to denial of service on Red Hat Enterprise Linux 6, 7, 8, 9, and 10 deployments. No public exploit has been identified at time of analysis.
NULL pointer dereference in the H.264 parser of gst-plugins-bad lets a crafted Multiview (MVC) H.264 file cause a parse failure whose cleanup path dereferences NULL, crashing the GStreamer-based application and causing a denial of service. The issue is medium severity (CVSS 5.5) with a local attack vector, no privileges required, and user interaction needed to get the crafted file ingested; affected deployments include gst-plugins-bad on Red Hat Enterprise Linux 6 through 10. No public exploit identified at time of analysis.
Stack exhaustion in the Ickle query parser shipped in Infinispan and its Red Hat product builds lets an authenticated user who holds the BULK_READ permission submit a cache query with deeply nested predicates, driving recursive parsing until the Java thread stack is exhausted and an uncaught StackOverflowError is thrown. Impact is limited to availability (CVSS 4.3, A:L) - there is no data exposure or modification - and the attacker must already possess a valid account plus the specific BULK_READ grant. A public PoC reference exists in the form of the Red Hat Bugzilla record; no public exploit code has been confirmed and no EPSS score was supplied, and the vuln.today decision label places this in the this_month queue rather than an emergency response.
An out-of-bounds read exists in GCC's libstdc++ implementation of std::from_chars(), which is reached when a program passes a character buffer that is not null-terminated. Only programs that link libstdc++ and call std::from_chars() on attacker-influenced, unterminated input are exposed; the GCC compiler and standalone toolchain are not themselves triggerable. The consequence is limited to availability - a crash or an invalid parse result - and the high attack complexity reflects the dependence on that specific calling pattern; no public exploit code or active exploitation has been identified at time of analysis, and the priority decision is monitor.
Denial of service in GCC libstdc++ occurs when an affected application extracts data into a std::bitset from a wide-character (wchar_t) stream and the library's internal stack buffer is sized without accounting for character size and alignment, producing a stack-based buffer overflow. The vendor vector is network-reachable and unauthenticated (AV:N/PR:N/UI:N) but high complexity (AC:H), and the independent assessment limits impact to a crash (A:H, no confidentiality or integrity impact); real exposure requires an application that exposes this specific wide-character bitset extraction path to untrusted input, which is uncommon. No public exploit was identified at time of analysis and the CVE is not in CISA KEV.
An integer wrap in GCC's libstdc++ std::vector<bool> element-count handling can leave the container internally inconsistent, so a later operation on it reads or writes out of bounds and crashes the process - an availability-only denial of service (CVSS 5.9, C:N/I:N/A:H). The flaw is reachable only through an application compiled against the affected libstdc++ that builds a std::vector<bool> from an attacker-influenced, excessively large element count; the library is not independently network-reachable, and the high attack complexity reflects the need to drive the count to a value that actually triggers the wrap. Affected platforms per the CPE data are Red Hat Enterprise Linux 6 through 10, OpenShift Container Platform 4 and 5, and Red Hat Hardened Images; no KEV listing or public exploit was identified at time of analysis, and Red Hat tracks the issue under this CVE and Bugzilla 2478508.
Denial of service in GCC's libstdc++ parallel-mode search implementation allows a local attacker who can supply crafted search data to an application built with parallel mode to drive an out-of-bounds memory access, crashing the process. Only binaries compiled with the opt-in parallel mode (__gnu_parallel / _GLIBCXX_PARALLEL) are exposed, and the flaw is rated CVSS 6.2 with availability-only impact (C:N/I:N/A:H) on a local attack vector (AV:L/PR:N/UI:N). No public exploit code has been identified at time of analysis, and the issue is tracked by Red Hat with a 'this_month' priority; the underlying root cause is an undersized internal buffer (CWE-787).
A denial-of-service flaw in Red Hat Enterprise Linux 9.6 through 9.10 kernel builds stems from an incomplete backport of the CVE-2026-46099 fix, leaving a bottom-half imbalance in seg6_input_core() that causes softirq starvation. Only hosts with SRv6 (IPv6 Segment Routing) tunnels configured in the kernel are exposed, since that non-default networking feature is what drives traffic into the affected code path; upstream Linux and RHEL 10 are explicitly not affected. The impact is availability-only (CVSS 5.9, A:H, AC:H) with no confidentiality or integrity effect, and no public exploit code is identified at time of analysis.
Prefix-matching defects in the Kroxylicious ACL authorizer can let an authenticated Kafka client read topics that configured ACL rules are intended to deny when overlapping prefix rules or mixed principal types are present. The issue affects Red Hat Streams for Apache Kafka 2 and 3 deployments that use the Kroxylicious ACL authorizer and carries a CVSS score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Exploitation requires valid Kafka client authentication plus an ACL configuration with overlapping or cross-type prefixes, so deployments without that layout are not exposed; no public exploit was identified at time of analysis.
Out-of-bounds read in Eye of GNOME (eog) when parsing a crafted PNG with malformed ICC color-profile metadata allows an attacker who convinces a user to open the image to crash the viewer and potentially expose limited memory contents. Affected deployments are GNOME desktop systems, including the Red Hat Enterprise Linux 6 through 9 package scope identified in CPE data; headless servers without eog installed are not exposed. Exploitation requires user interaction via a local vector, and no public exploit or CISA KEV confirmation was identified at time of analysis.
An out-of-bounds memory read in Ghostscript's mesh shading renderer lets an attacker who supplies a crafted PDF or PostScript document cause the interpreter to crash or leak a small amount of adjacent memory. The flaw sits in the handling of indexed color values inside mesh shading data, where bounds validation is incomplete; Ghostscript builds shipped with Red Hat Enterprise Linux 6, 7, 8, 9 and 10 are listed as the affected packages, so any user or automated pipeline rendering untrusted documents with those builds is exposed to the crash path. The assessed vector is local with user interaction (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L, base 3.3), meaning a victim must actually open or process the malicious file; there is no network-service exposure and no privilege escalation. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so prioritization is monitor.
Request smuggling in Undertow's ChunkReader lets a remote attacker bypass the chunk-size limit using a crafted 15-digit chunk length, overflow internal state flags, and force the server to end a request body early so the trailing bytes are reinterpreted as a second, smuggled request. Red Hat ships the affected Undertow code in JBoss Enterprise Application Platform 7 and 8, Fuse 7, Red Hat Single Sign-On 7, the Red Hat build of Apache Camel for Spring Boot 4, and Red Hat Enterprise Linux 8 and 9, scored CVSS 3.1 6.5 with low integrity and availability impact and no confidentiality impact. No public exploit code was identified at time of analysis and the flaw is not in CISA KEV; real-world consequence is concentrated in deployments where Undertow shares connections with, or sits behind, a front-end proxy or load balancer whose parser disagrees on message boundaries, while standalone deployments without connection reuse are largely limited to premature termination of the attacker's own request.
Heap-based buffer overflow in Ghostscript's TrueType font rendering path lets an attacker crash the interpreter or potentially execute code by getting a crafted font - or a document embedding one - processed on the target host. The flaw is reachable whenever Ghostscript renders untrusted content, so automated document-conversion, print-filter and preview pipelines that ingest attacker-supplied files are the realistic exposure; the malicious file must reach and be parsed locally (AV:L) and the victim or service must open or render it (UI:R), while no authentication is required under the assessed vector. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so urgency is moderate and ties to patch availability rather than active exploitation; the supplied base score of 5.8 understates the assessed vector, which adds PR:N and A:H and raises the effective severity.
Mandatory required-action challenges in Keycloak - as shipped in Red Hat Build of Keycloak and Red Hat Single Sign-On 7 - can be skipped when an authorization request carries a kc_action query parameter set to a required action that is already pending on the account, such as profile verification (VERIFY_PROFILE) or terms-and-conditions acceptance. The attacker must be an authenticated user (CVSS PR:L) whose administrator has already assigned that mandatory action; the broken application-initiated-action handling then lets the authorization code be issued without the challenge being completed, so the user reaches the application while bypassing onboarding and compliance gates. The exposure is confined to defeating that mandatory-action control (integrity impact only, per the assessed vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, 5.4 medium) and does not escalate the user beyond their own granted access; no public exploit code or CISA KEV confirmation was identified at time of analysis.