Red Hat vulnerabilities
We track 2,065 vulnerabilities in Red Hat products across 60+ products. 2,057 are rated high or critical, and 99 have been exploited in real attacks. The most recent was published on November 13, 2026.
Latest Red Hat vulnerabilities
- 7.3 High severity
Red Hat Enterprise Linux 8: Incorrect Default Permissions
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbou
- 7.5 High severity
Hci Baseboard Management Controller: Uncontrolled Resource Consumption
The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC
- 7.5 High severity
Enterprise Linux: Allocation of Resources Without Limits or Throttling
Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. One of the concerns is that, when ther
- 9.3 Critical severity
OpenShift Developer Tools and Services: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which uses the `parent` or `plugin` keywords. This could download a malicious archive and
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Out-of-bounds Write
An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the serve
- 7.5 High severity
Red Hat Enterprise Linux 8: NULL Pointer Dereference
A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel
- 7.5 High severity
Red Hat Enterprise Linux 8: NULL Pointer Dereference
A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel
- 7.5 High severity
Red Hat Enterprise Linux 8: NULL Pointer Dereference
A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing ker
- 7.5 High severity
EAP 7.4.14: Improper Initialization
An improper initialization vulnerability was found in Galleon. When using Galleon to provision custom EAP or EAP-XP servers, the servers are created unsecured. This issue could allow an attacker to access remote HTTP services available from the server.
- 7.5 High severity
Red Hat Ansible Automation Platform 2: Observable Discrepancy
A flaw was found in the python-cryptography package. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
- 7.5 High severity
Red Hat Enterprise Linux 6: Observable Discrepancy
A flaw was found in m2crypto. This issue may allow a remote attacker to decrypt captured messages in TLS servers that use RSA key exchanges, which may lead to exposure of confidential or sensitive data.
- 8.6 High severity
runc: Exposure of Resource to Wrong Sphere
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a workin
- 7.5 High severity
glibc: Out-of-bounds Write
An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes,
- 7.8 High severity
glibc: Out-of-bounds Write
A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NU
- 7.8 High severity
Linux Kernel Use-After-Free Exploited
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow
- 7.4 High severity
Red Hat Enterprise Linux 7: Integer Overflow or Wraparound
A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to
- 7.5 High severity
kernel: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.
- 7.8 High severity
Red Hat Enterprise Linux 8: NULL Pointer Dereference
A null pointer dereference flaw was found in the hugetlbfs_fill_super function in the Linux kernel hugetlbfs (HugeTLB pages) functionality. This issue may allow a local user to crash the system or potentially escalate their privileges on the system.
- 7.1 High severity
Red Hat build of Keycloak 22: URL Redirection to Untrusted Site
A flaw was found in the redirect_uri validation logic in Keycloak. This issue may allow a bypass of otherwise explicitly allowed hosts. A successful attack may lead to an access token being stolen, making it possible for the attacker to impersonate other users
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API. This flaw allows a remote attacker to cause a heap-buffer overflow, leading to a denial of service.
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
- 9.8 Critical severity
Red Hat build of Quarkus 2.13.9.Final: Improper Handling of Exceptional Conditions
A flaw was found in the json payload. If annotation based security is used to secure a REST resource, the JSON body that the resource may consume is being processed (deserialized) prior to the security constraints being evaluated and applied. This does not hap
- 7.5 High severity
Red Hat Virtualization Engine 4.4: Improper Authentication
An authentication bypass vulnerability was found in overt-engine. This flaw allows the creation of users in the system without authentication due to a flaw in the CreateUserSession command.
- 8.3 High severity
Red Hat Enterprise Linux 7: Origin Validation Error
A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-b
- 7.5 High severity
Red Hat Enterprise Linux 6: Out-of-bounds Read
An out-of-bounds read vulnerability was found in Netfilter Connection Tracking (conntrack) in the Linux kernel. This flaw allows a remote user to disclose sensitive information via the DCCP protocol.
- 7.1 High severity
kernel: Use After Free
A use-after-free flaw was found in the __ext4_remount in fs/ext4/super.c in ext4 in the Linux kernel. This flaw allows a local user to cause an information leak problem while freeing the old quota file names before a potential failure, leading to a use-after-f
- 7.0 High severity
Red Hat Enterprise Linux 9: Concurrent Execution using Shared Resource with Improper Synchronization
A use-after-free flaw was found in the Linux Kernel due to a race problem in the unix garbage collector's deletion of SKB races with unix_stream_read_generic() on the socket that the SKB is queued on.
- 7.8 High severity
Red Hat Enterprise Linux 7: Out-of-bounds Write
A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.
- 9.8 Critical severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Out-of-bounds Write
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's
- 7.8 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Write
An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileg
- 7.8 High severity
Red Hat Enterprise Linux 6: Use After Free
A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. This flaw allows a local user to crash or potentially escalate their privileges on the
- 9.8 Critical severity
The Mock software contains a vulnerability wherein an attacker could potentially exploit…
The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion an
- 7.5 High severity
Red Hat Enterprise Linux 9: Improper Verification of Cryptographic Signature
A vulnerability was found in GnuTLS, where a cockpit (which uses gnuTLS) rejects a certificate chain with distributed trust. This issue occurs when validating a certificate chain with cockpit-certificate-ensure. This flaw allows an unauthenticated, remote clie
- 7.5 High severity
Red Hat Enterprise Linux 8: Observable Discrepancy
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channe
- 7.4 High severity
kernel: Integer Underflow (Wrap or Wraparound)
An out-of-bounds memory read flaw was found in receive_encrypted_standard in fs/smb/client/smb2ops.c in the SMB Client sub-component in the Linux Kernel. This issue occurs due to integer underflow on the memcpy length, leading to a denial of service.
- 7.8 High severity
Red Hat Enterprise Linux 8.6 Extended Update…: Use After Free
A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after t
- 7.5 High severity
Red Hat OpenShift Container Platform 4.13: Allocation of Resources Without Limits or Throttling
A flaw was found in CRI-O that involves an experimental annotation leading to a container being unconfined. This may allow a pod to specify and get any amount of memory/cpu, circumventing the kubernetes scheduler and potentially resulting in a denial of servic
- 7.0 High severity
Red Hat Enterprise Linux 6: Use After Free
A flaw was found in the ATA over Ethernet (AoE) driver in the Linux kernel. The aoecmd_cfg_pkts() function improperly updates the refcnt on `struct net_device`, and a use-after-free can be triggered by racing between the free on the struct and the access throu
- 7.8 High severity
Red Hat Enterprise Linux 6: Out-of-bounds Write
A vulnerability was found in Perl. This security issue occurs while Perl for Windows relies on the system path environment variable to find the shell (`cmd.exe`). When running an executable that uses the Windows Perl interpreter, Perl attempts to find and exec
- 7.5 High severity
EAP 7.4.13: Allocation of Resources Without Limits or Throttling
A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eve