Red Hat vulnerabilities
We track 2,065 vulnerabilities in Red Hat products across 60+ products. 2,057 are rated high or critical, and 99 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Red Hat vulnerabilities
- 7.5 High severity
Red Hat Satellite 6.12 for RHEL 8: Exposure of Sensitive Information to an Unauthorized Actor
A disclosure of sensitive information flaw was found in foreman via the GraphQL API. If the introspection feature is enabled, it is possible for attackers to retrieve sensitive admin authentication keys which could result in a compromise of the entire product'
- 7.8 High severity
Red Hat Enterprise Linux 10: Heap-based Buffer Overflow
A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation
- 7.8 High severity
Linux: Out-of-bounds Read
In the Linux kernel, the following vulnerability has been resolved: parport: Proper fix for array out-of-bounds access The recent fix for array out-of-bounds accesses replaced sprintf() calls blindly with snprintf(). However, since snprintf() returns the would
- 7.5 High severity
Red Hat 3scale API Management Platform 2: Incorrect Authorization
A flaw was found in Gateway. Sending a non-base64 'basic' auth with special characters can cause APICast to incorrectly authenticate a request. A malformed basic authentication header containing special characters bypasses authentication and allows unauthorize
- 7.3 High severity
Red Hat JBoss Enterprise Application Platform 7: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Wildfly, where a user may perform Cross-site scripting in the Wildfly deployment system. This flaw allows an attacker or insider to execute a deployment with a malicious payload, which could trigger undesired behavior against the s
- 7.8 High severity
Red Hat Enterprise Linux 7.7 Advanced Update…: Improper Control of Generation of Code
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails
- 8.1 High severity
Red Hat Build of Keycloak: Exposure of Sensitive Information to an Unauthorized Actor
A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or syst
- 8.2 High severity
Red Hat Enterprise Linux 8: Improper Link Resolution Before File Access
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the sys
- 7.7 High severity
Red Hat Build of Keycloak: Improper Verification of Cryptographic Signature
A flaw exists in the SAML signature validation method within the Keycloak XMLSignatureUtil class. The method incorrectly determines whether a SAML signature is for the full document or only for specific assertions based on the position of the signature in the
- 7.5 High severity
Red Hat Enterprise Linux AI (RHEL AI): Reachable Assertion
A flaw was found in the vLLM library. A completions API request with an empty prompt will crash the vLLM API server, resulting in a denial of service.
- 9.1 Critical severity
Red Hat OpenShift Container Platform 4.12: Execution with Unnecessary Privileges
A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files
- 9.9 Critical severity
Red Hat OpenShift Container Platform 4.12: Improper Privilege Management
A flaw was found in OpenShift. This issue occurs due to the misuse of elevated privileges in the OpenShift Container Platform's build process. During the build initialization step, the git-clone container is run with a privileged security context, allowing unr
- 7.5 High severity
Red Hat build of Quarkus: Improper Handling of Extra Values
A denial of service vulnerability was found in keycloak where the amount of attributes per object is not limited,an attacker by sending repeated HTTP requests could cause a resource exhaustion when the application send back rows with long attribute values.
- 7.1 High severity
Red Hat Build of Keycloak: Session Fixation
A session fixation issue was discovered in the SAML adapters provided by Keycloak. The session ID and JSESSIONID cookie are not changed at login time, even when the turnOffChangeSessionIdOnLogin option is configured. This flaw allows an attacker who hijacks th
- 7.5 High severity
Migration Toolkit for Virtualization 2.6: Improper Authorization
A vulnerability was found in Forklift Controller. There is no verification against the authorization header except to ensure it uses bearer authentication. Without an Authorization header and some form of a Bearer token, a 401 error occurs. The presence of a t
- 7.5 High severity
Red Hat Enterprise Linux 9: Uncontrolled Resource Consumption
A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and
- 9.8 Critical severity
Red Hat Satellite 6.13 for RHEL 8: Improper Authentication
An authentication bypass vulnerability has been identified in Pulpcore when deployed with Gunicorn versions prior to 22.0, due to the puppet-pulpcore configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restriction
- 9.8 Critical severity
Red Hat Satellite 6.13 for RHEL 8: Improper Authentication
An authentication bypass vulnerability has been identified in Foreman when deployed with External Authentication, due to the puppet-foreman configuration. This issue arises from Apache's mod_proxy not properly unsetting headers because of restrictions on under
- 7.5 High severity
Red Hat Enterprise Linux 10: Exposure of Data Element to Wrong Session
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a resul
- 8.1 High severity
Red Hat OpenStack Platform 17.1 for RHEL 8: Improper Certificate Validation
A flaw was found in the openstack-tripleo-common component of the Red Hat OpenStack Platform (RHOSP) director. This vulnerability allows an attacker to deploy potentially compromised container images via disabling TLS certificate verification for registry mirr
- 7.5 High severity
HawtIO 4.0.0 for Red Hat build of Apache Camel 4: Concurrent Execution using Shared Resource with Improper Synchronization
A vulnerability was found in Undertow where the ProxyProtocolReadListener reuses the same StringBuilder instance across multiple requests. This issue occurs when the parseProxyProtocolV1 method processes multiple requests on the same HTTP connection. As a resu
- 8.0 High severity
Red Hat OpenShift Container Platform 4.12: Insufficient Entropy
An insufficient entropy vulnerability was found in the Openshift Console. In the authorization code type and implicit grant type, the OAuth2 protocol is vulnerable to a Cross-Site Request Forgery (CSRF) attack if the state parameter is used inefficiently. This
- 8.8 High severity
RHOAI-2.14-RHEL-8: Authentication Bypass by Primary Weakness
A vulnerability was found in OpenShift AI that allows for authentication bypass and privilege escalation across models within the same namespace. When deploying AI models, the UI provides the option to protect models with authentication. However, credentials f
- 7.5 High severity
Red Hat Enterprise Linux 8: NULL Pointer Dereference
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. T
- 8.8 High severity
Fence Agents Remediation 0.4 for RHEL 8: Improper Control of Generation of Code
A flaw was found in the Fence Agents Remediation operator. This vulnerability can allow a Remote Code Execution (RCE) primitive by supplying an arbitrary command to execute in the --ssh-path/--telnet-path arguments. A low-privilege user, for example, a user wi
- 8.3 High severity
Red Hat Ansible Automation Platform 2: Insecure Inherited Permissions
A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object crea
- 7.5 High severity
Red Hat Enterprise Linux 8: Improper Synchronization
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.
- 7.4 High severity
Red Hat Enterprise Linux 8: Improper Certificate Validation
A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.
- 7.0 High severity
Red Hat Enterprise Linux 8: Improper Control of Generation of Code
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
- 7.5 High severity
Red Hat build of Apache Camel 3.20.7 for…: Uncontrolled Recursion
A vulnerability was found in Undertow, where the chunked response hangs after the body was flushed. The response headers and body were sent but the client would continue waiting as Undertow does not send the expected 0\r\n termination of the chunked response.
- 7.0 High severity
Red Hat Enterprise Linux 9: Signal Handler Race Condition
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls v
- 7.8 High severity
Advanced Virtualization for RHEL 8.2.1: Out-of-bounds Write
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time,
- 8.1 High severity
Red Hat Enterprise Linux 9: Concurrent Execution using Shared Resource with Improper Synchronization
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate
- 7.5 High severity
A flaw was found in the Poppler's Pdfinfo utility.
A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.
- 7.5 High severity
EAP 8.0.1: Exposure of Data Element to Wrong Session
A vulnerability was found in Undertow, where URL-encoded request paths can be mishandled during concurrent requests on the AJP listener. This issue arises because the same buffer is used to decode the paths for multiple requests simultaneously, leading to inco
- 8.1 High severity
Red Hat OpenShift Container Platform 4.12: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
- 8.1 High severity
Red Hat Enterprise Linux 7: Use of Password Hash With Insufficient Computational Effort
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the ta
- 8.8 High severity
Red Hat Enterprise Linux 8: Incorrect Authorization
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delega
- 7.5 High severity
Red Hat Certificate System 10.4 EUS for RHEL-8: Authentication Bypass by Primary Weakness
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, whi
- 7.5 High severity
Red Hat OpenShift Container Platform 4.12: Authentication Bypass by Spoofing
A flaw was found in OpenShift's Telemeter. If certain conditions are in place, an attacker can use a forged token to bypass the issue ("iss") check during JSON web token (JWT) authentication.