Red Hat vulnerabilities
We track 2,065 vulnerabilities in Red Hat products across 60+ products. 2,057 are rated high or critical, and 99 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Red Hat vulnerabilities
- 8.1 High severity
Red Hat Certificate System 10: Authentication Bypass by Spoofing
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST su
- 8.8 High severity
Fedora: Authentication Bypass by Spoofing
An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Fla
- 9.0 Critical severity
Red Hat Directory Server 11: Improper Restriction of Communication Channel to Intended Endpoints
A flaw was found in 389-ds-base. The server does not discard plaintext bytes already buffered from a client connection when negotiating StartTLS, allowing an on-path attacker to inject a crafted LDAP message that is processed after the TLS upgrade and whose re
- 7.5 High severity
Red Hat Directory Server 11: Uncontrolled Resource Consumption
A flaw was found in 389-ds-base. An unauthenticated remote attacker can send a complete LDAP operation followed by the first bytes of an incomplete LDAPMessage on the same connection, causing the server to hand that connection to a second worker thread before
- 7.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. The foreman-tail utility is vulnerable to OS command injection due to the unsafe use of the eval command. The script takes user-supplied arguments and incorporates them directly into a string that is then executed by eval to expand
- 9.1 Critical severity
Red Hat Satellite 6.16 for RHEL 8: Privilege Defined With Unsafe Actions
A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sens
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Control of Generation of Code
A flaw was found in Foreman. This vulnerability allows an authenticated remote attacker with low-level read permissions to achieve arbitrary code execution on the underlying server. By manipulating the permitted methods list within the template rendering engin
- 7.7 High severity
Red Hat Satellite 6.16 for RHEL 8: Deserialization of Untrusted Data
A flaw was found in Foreman. The foreman-rake initialization logic in /usr/share/foreman/config/settings.rb contains a vulnerable code pattern where configuration data is processed through two distinct executable layers. This creates a multi-stage execution ch
- 8.2 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. OS command injection vulnerabilities exist in the foreman-rake db:dump and db:import_dump tasks. The application fails to properly sanitize user-supplied input in the destination parameter (during backups) and the file parameter (d
- 8.2 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in Foreman. A command injection vulnerability exists in the foreman-rake errors:fetch_log task. The request_id parameter is passed to an underlying system command (typically grep) without adequate shell neutralization. While the task is intend
- 7.5 High severity
Red Hat Satellite 6.16 for RHEL 8: Missing Authentication for Critical Functionality
A flaw was found in Foreman. The Red Hat Satellite /unattended/provision API endpoint is vulnerable to an authentication bypass due to a semantic logic flaw in host_verifier.rb. The application verifies the database state of a provisioning token rather than it
- 8.8 High severity
Red Hat Satellite 6.16 for RHEL 8: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in rubygem-foreman_remote_execution. A command injection vulnerability exists in the Red Hat Satellite API (/api/v2/job_invocations). When a job template has the effective_user property marked as overridable: true, the application fails to pro
- 7.1 High severity
Red Hat OpenShift Container Platform 4.18: Missing Authentication for Critical Functionality
A flaw was found in oc-mirror. During mirroring operations, the embedded local cache registry binds to all network interfaces without authentication or encryption instead of restricting access to the local system. An unauthenticated attacker on an adjacent net
- 7.3 High severity
Red Hat OpenShift Container Platform 4.13: Improper Limitation of a Pathname to a Restricted Directory
Path traversal / arbitrary file write in oc-mirror's operator catalog image extraction. When mirroring operator catalogs using either the legacy v1 path (--v1) or the OCI feature path (--use-oci-feature), oc-mirror extracts tar entries from catalog image layer
- 7.8 High severity
Red Hat OpenShift Container Platform 4.16: Trust Boundary Violation
A trust-boundary flaw in CRI-O's sandbox state persistence allows attacker-influenced pod metadata to overwrite CRI-O's own reserved sandbox bookkeeping; once reloaded as trusted after a restart, a later container recreate in that sandbox can expose a host-sid
- 7.1 High severity
Red Hat Hardened Images: Heap-based Buffer Overflow
A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, he
- 9.8 Critical severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. When the permessage-deflate WebSocket extension compresses a very large outgoing message, truncated size calculations used for GByteArray growth could wrap, causing zlib to write past the allocated buffer and resulting in a heap bu
- 8.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. When constructing a masked WebSocket client frame for a very large outgoing payload, size values passed to GByteArray allocation APIs could be truncated while the masking routine still used the full length, causing a heap buffer ov
- 8.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. When max-incoming-payload-size is unlimited (0), SoupWebsocketConnection could grow its incoming GByteArray based on an attacker-controlled frame length until the length wrapped, causing a heap buffer overflow while reading frame d
- 8.2 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. The soup_uri_decode_data_uri() function incorrectly treated base64 data-URI payloads as NUL-terminated strings when calling g_base64_decode_inplace(). If the percent-decoded payload contained embedded NUL bytes, the decoded length
- 8.6 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup. When reassembling fragmented WebSocket messages into a GByteArray, libsoup did not adequately cap total message size against the limits of the underlying buffer type. A remote peer could send fragments that caused size truncation w
- 8.6 High severity
Red Hat Enterprise Linux 10: Access of Resource Using Incompatible Type
A flaw was found in libsoup. When handling an incoming WebSocket Pong frame, SoupWebsocketConnection emitted the ::pong signal with a GByteArray pointer even though the signal is declared to pass a GBytes. Applications connecting a handler that follows the doc
- 7.1 High severity
Red Hat Hardened Images: Out-of-bounds Write
A heap-based buffer overflow flaw was found in rpm. Parsing a symlink entry in an untrusted RPM package whose declared RPMTAG_LONGFILESIZES value is 0xFFFFFFFFFFFFFFFF causes an integer overflow in iterReadArchiveNext() that shrinks a buffer allocation to one
- 7.1 High severity
Red Hat Enterprise Linux 10: UNIX Symbolic Link (Symlink) Following
A path traversal vulnerability in Flatpak's handling of the files/etc directory during app deployment allows a malicious Flatpak app to cause certain host system files (such as passwd, group, machine-id, or resolv.conf) to be emptied or replaced with a symlink
- 7.1 High severity
Red Hat Enterprise Linux 10: UNIX Symbolic Link (Symlink) Following
A path traversal vulnerability in Flatpak's handling of the export/bin directory during app deployment allows a malicious Flatpak app to cause deletion of attacker-chosen files outside the deployment directory when the app is installed or upgraded. In system-w
- 7.0 High severity
Red Hat Enterprise Linux 10: Expired Pointer Dereference
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this operation can exploit
- 7.1 High severity
Red Hat OpenShift Container Platform 4.19: Inclusion of Functionality from Untrusted Control Sphere
A flaw was found in kube-compare. When processing a 'container://' reference path, the tool incorrectly executes an untrusted container image's entrypoint instead of merely extracting data from a stopped container. This allows a remote attacker to achieve arbi
- 7.2 High severity
Red Hat Openshift Data Foundation 4: Improper Neutralization of Special Elements used in an OS Command
An OS command injection flaw was found in the set_hostname_internal function of NooBaa's cluster_internal_api. This component is responsible for managing the Multi-Cloud Object Gateway in OpenShift Data Foundation. The vulnerability occurs because the hostname
- 8.2 High severity
Red Hat JBoss Enterprise Application Platform…: Use of Externally-Controlled Input to Select Classes or Code
Apache ActiveMQ Artemis before 2.34.0 contains an unsafe reflection vulnerability in FederationStreamConnectMessage.getFederationPolicy(). The method calls Class.forName(clazz).getConstructor().newInstance() where clazz is read directly from the CORE protocol
- 7.5 High severity
Red Hat Enterprise Linux 10: Numeric Truncation Error
The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation functions expecting gsize (32 bits on 32-bit systems), causing undersized allocations while subsequent operations use the original 64-bit size, leading to heap buffer
- 8.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path containing stale heap data,
- 8.1 High severity
Red Hat Ansible Automation Platform 2.6 for…: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges to specify a local file URL for Pulp to download and store. A URL scheme validation check uses a strin
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Special Elements used in an OS Command
A command injection flaw was found in rpm. Installing or rebuilding a source RPM whose source or spec file basenames contain a %() macro construct causes rpm to execute an attacker-controlled shell command via popen() while relocating the source file list. Thi
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Neutralization of Special Elements used in an OS Command
A flaw was found in rpm. An attacker can supply a crafted manifest file that, when processed by a user or automation using `rpm -q -p` or similar manifest-processing flows, leads to arbitrary code execution. This occurs because manifest entries are unexpectedl
- 7.8 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Write
A flaw was found in GIMP. When processing a specially crafted GIMPressionist preset file, the plug-in does not properly validate vector indices before writing into fixed-size arrays. This can lead to an out-of-bounds write, corrupting memory. An attacker could
- 7.5 High severity
Red Hat OpenShift Container Platform 4.12: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in the OpenShift console. An unauthenticated attacker can exploit a path traversal vulnerability by manipulating the `lng` and `ns` query parameters in the `/locales/resource.json` endpoint. This allows the attacker to read sensitive `*.json`
- 7.2 High severity
Red Hat OpenShift Container Platform 4.17: Unintended Proxy or Intermediary
A flaw was found in openshift/console. An unauthenticated remote attacker can exploit a misconfiguration in the CatalogdHandler, which lacks proper authentication, and the forwarding of the `openshift-session-token` cookie. This allows the attacker to send req
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A flaw was found in librsvg. When processing an SVG document containing nested XML inclusions (Xincludes) with duplicate entity declarations, a use-after-free error can occur. This vulnerability arises because the library incorrectly frees an XML entity that i
- 7.2 High severity
Red Hat Ansible Automation Platform 2.7: Improper Neutralization of Directives in Statically Saved Code
A flaw was found in the Ansible Automation Platform automation controller. The external logging (rsyslog) configuration is generated by interpolating user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH and LOG_AGGREGATOR_RSYSLOGD
- 9.9 Critical severity
Red Hat Ansible Automation Platform 2.4 for…: Missing Authorization
A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and fails to check the i