Skip to contentRed Hat Hardened Images vulnerabilities
- red hat hardened imagesBusybox: busybox: dpkg stale field_start pointer causes out-of-bounds read and status file corruptionCVE-2026-888423.3 Low
- red hat hardened imagesBusybox: busybox: http request smuggling via pipelined requests in httpd reverse proxyCVE-2026-888297.2 High
- red hat hardened imagesBusybox: busybox: dpkg-deb extraction-root escape via per-ar-member deferred symlink flushCVE-2026-909547.8 High
- red hat hardened imagesBusybox: busybox: httpd user existence oracle in non-default shadow-disabled buildsCVE-2026-88834Fix available3.7 Low
- red hat hardened imagesBusybox: busybox: non-root mount option filter bypass allows clearing fstab security restrictionsCVE-2026-888385.5 Medium
- red hat enterprise linux 6, hardened images +1 moreBusybox: busybox: udhcpc integer underflow in dhcp packet length calculation causes denial of serviceCVE-2026-88833Fix available6.5 Medium
- red hat enterprise linux 6, hardened images +1 moreBusybox: busybox: tar extraction-root escape via deferred symlink/hardlink creation bypasses cve-2026-26158 fixCVE-2026-108119Fix available6.3 Medium
- red hat build of podman desktop, certification program for red hat enterprise linux 9, edge manager 1 +8 more +10 moreGvisor-tap-vsock: gvisor-tap-vsock: unathenticated arbitrary file deletion on the host via /exposeCVE-2026-107935Fix available9.3 Critical
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreCups: null pointer dereference via embedded job ticket comments allows remote denial of serviceCVE-2026-107655Fix available4.0 Medium
- red hat hardened images, satellite 6 +1 moreRubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypassCVE-2026-1074455.4 Medium
- red hat hardened images, satellite 6 +1 moreRubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypassCVE-2026-1074444.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreCyrus-sasl: heap buffer overflow in cyrus-sasl add_to_challenge() allows malicious server to crash or compromise digest-md5 clientsCVE-2026-107161Fix available7.5 High
- red hat ansible automation platform 2, hardened images +1 moreAnsible: ansible-ui: ansible ui dom xss in /redirect next parameterCVE-2026-1060335.4 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +1 more +3 moreCups: cups: argument injection in mailto notifier via notify-recipient-uriCVE-2026-105326Fix available2.5 Low
- red hat build of openjdk 11 els, enterprise linux 10, enterprise linux 6 +4 more +6 moreFreetype: freetype: denial of service via repeated subroutine allocations in cid font loaderCVE-2026-95512Fix available5.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: heap-based buffer overflow write in hex2binv() via a mistyped rpmtag_filesignatures header tagCVE-2026-103242Fix available7.1 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpm: integer overflow in iterreadarchivenext() leads to heap-based buffer overflow when parsing untrusted rpm packagesCVE-2026-955207.1 High
- red hat enterprise linux 10, enterprise linux 10.2 extended update support, enterprise linux 6 +8 more +10 moreGcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: denial of service via use-after-free in binary heap erase_ifCVE-2026-102010Fix available7.0 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: rpm: shell command injection via macro expansion of source/spec file basenames when installing a source rpmCVE-2026-955217.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: code execution via macro expansion of manifest entries in `rpmgi` (`-q -p` / verify manifest flows)CVE-2026-95519Fix available7.8 High
- red hat hardened imagesBusybox: busybox: tls ssl_server reads one byte out of bounds when parsing truncated clienthelloCVE-2026-888405.3 Medium
- red hat hardened imagesBusybox: busybox: passwd/group parser writes heap pointers out of bounds due to stale tokenize() endpointCVE-2026-888396.7 Medium
- red hat hardened imagesBusybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authenticationCVE-2026-88837Fix available6.5 Medium
- red hat hardened imagesBusybox: busybox: dpkg read_package_field() steps past nul terminator, causing out-of-bounds read on malformed .deb packagesCVE-2026-88835Fix available6.1 Medium
- red hat hardened imagesBusybox: busybox: httpd silently fails open when ip deny rules contain invalid cidr prefix lengthsCVE-2026-88831Fix available5.3 Medium
- red hat hardened imagesBusybox: busybox: romfs volume id parsing performs unbounded memcpy into fixed-size label buffer, causing heap overflowCVE-2026-888327.3 High
- red hat hardened imagesBusybox: busybox: tls montgomery reduction allocates bytes instead of digits, causing a pre-auth heap buffer overflowCVE-2026-888307.5 High
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 7 extended lifecycle support +15 more +17 moreSudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorizationCVE-2026-96512Public exploitFix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +7 more +9 moreGcc: libstdc++ integer overflow in `new` operatorCVE-2026-95619Fix available7.7 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 morePoppler: poppler: unbounded cpu loop in splashoutputdev::tilingpatternfill via unvalidated tiling-pattern repeat count (denial of service)CVE-2026-936535.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 moreLibxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attributeCVE-2026-76781Fix available5.5 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +4 more +6 morePodman: arbitrary file write when importing oci archiveCVE-2025-11395Fix available5.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreTftp: tftp-hpa: denial of service due to out-of-bounds read/write in remap engineCVE-2026-85234Fix available7.5 High
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +6 more +8 morePodman: buildah: skopeo: containers/storage: malicious tar whiteout header allows replacement of extraction destination directoryCVE-2026-79699Fix available4.4 Medium
- red hat ansible automation platform 2, enterprise linux 10, enterprise linux 8 +7 more +9 morePodman: buildah: buildah/copier: directory escape via crafted tar symlinks when used outside buildah by non-root callersCVE-2026-79705Fix available4.5 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreEnvironment-modules: command injection in environment-modules bash completion via malicious module names containing shell metacharactersCVE-2026-85013Fix available7.3 High
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: /dev/null symlink follow during stdio reopen allows host bind-mount write and chownCVE-2026-88265Fix available5.6 Medium
- containers crun, red hat enterprise linux 10, enterprise linux 8 +4 more +6 moreCrun: crun: /dev/console symlink follow allows root-owned file creation outside the rootfsCVE-2026-88264Fix available5.6 Medium
- red hat enterprise linux 10, enterprise linux 8, enterprise linux 9 +3 more +5 moreCrun: crun: rootful krun with passt executes container payload as host rootCVE-2026-84042Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: remaining case-insensitive username matching in scheduler side paths (cve-2026-27447 follow-up)CVE-2026-87876Fix available3.0 Low
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreCups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length boundCVE-2026-87875Fix available4.3 Medium
- red hat cert manager support for red hat openshift release 1.20, cost management on-premise 1, enterprise linux 10 +22 more +24 moreLibxml2: double-free/uaf in libxml2 python bindingsCVE-2026-74860Fix available8.5 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +6 more +8 moreGlib2: toctou symlink race in `g_file_create_replace_destination` fallback pathCVE-2026-864695.3 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +5 more +7 morePolkit: regression in cve-2026-4897 fix (polkit read_cookie()) - stack buffer underflowCVE-2026-85498Fix available3.5 Low
- red hat enterprise linux 10, enterprise linux 10.0 extended update support, enterprise linux 8 +11 more +13 moreBubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setupCVE-2026-87766Fix available8.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +3 more +5 moreRpm: command injection in rpmuncompress via unescaped filenames passed to popen()CVE-2026-848387.8 High
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +4 more +6 moreRpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball pathCVE-2026-84837Fix available7.8 High
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +3 more +5 moreUtil-linux: util-linux: x-mount.subdir detached-tree resolution can escape via intermediate symlinksCVE-2026-78409Fix available7.0 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: restricted bind mounts do not pin the source, allowing x-mount.owner/group/mode redirectionCVE-2026-78410Fix available7.8 High
- red hat cost management on-premise 1, enterprise linux 10, enterprise linux 7 +5 more +7 moreUtil-linux: util-linux: nsenter --join-cgroup leaks root cgroup migration authorityCVE-2026-78408Fix available7.9 High
- Show moreLoading…