IP-DB.com
Türkçe English Deutsch Español
Log In Get API Key

Red Hat Enterprise Linux vulnerabilities

CVE records published for Red Hat Red Hat Enterprise Linux, newest first. Follow to get an email when a new one appears.

RSS feed
Total CVEs2,081
Last 30 days147
Critical149
Exploited82
2,081 results
6.5Medium
CVE-2026-120831

Libslirp: libslirp: queue pointer corruption in if_output() leading to denial of service

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4

A flaw was found in libslirp in if_output(). When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm->m_nextpkt instead of the session queue head, corrupting queue pointers. A guest generating…

7.4High
CVE-2026-120830

Libslirp: libslirp: out-of-bounds heap read in icmp_forward_error() leading to information disclosure

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat OpenShift Container Platform 4

A flaw was found in libslirp in icmp_forward_error(). When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause…

2.0Low
CVE-2026-120740

Hivex: hivex: denial of service via out-of-bounds read in big-data block processing

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application pr…

7.5High
CVE-2026-120194

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a ha…

6.5Medium
CVE-2026-119842

Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDV…

6.5Medium
CVE-2026-119727

Gst-plugins-bad: gst-plugins-bad: h.265 sps scc palette predictor array overflow via integer underflow in bounds computation

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding (SCC) extension with certain palette predictor initializer settings, an integer underflow in the upper-boun…

6.5Medium
CVE-2026-119729

Gst-plugins-base: gst-plugins-bad: gst-plugins-base/gst-plugins-bad: integer overflow in av1 leb128 parser allows denial of service

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an inv…

5.5Medium
CVE-2026-119728

Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview (MVC) Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated…

7.8High
CVE-2026-119777

Gstreamer1-plugins-bad-free: gstreamer1-plugins-bad-free: stack buffer overflow in h.266/vvc parser

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an a…

7.8High
CVE-2026-119528

Gimp: gimp: stack buffer overflow in psd image resource header loader

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GIMP. The PSD plug-in’s image resource header loader uses an incorrect destination size when copying a converted resource name into a fixed stack buffer. Opening a crafted PSD file can cause a stack-based buffer overflow, leading to a cras…

3.7Low
CVE-2026-115456

Gcc: out-of-bounds read in std::from_chars

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in gcc. An attacker could cause a Denial of Service (DoS) by passing a string that is not null-terminated to the std::from_chars() function in the libstdc++ library. This issue triggers an out-of-bounds read beyond the allocated buffer, poten…

6.5Medium
CVE-2026-115455

Gcc: stack overflow in std::bitset on libstdc++

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GCC libstdc++. When an application extracts data into a bitset from a wide-character stream, internal stack memory allocation fails to properly account for character size and alignment. An attacker capable of supplying crafted input to an …

5.9Medium
CVE-2026-114691

Gcc: integer wrap in `std

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in the libstdc++ component of GCC. An attacker who can provide an excessively large element count to a boolean vector (std::vector<bool>) constructor can trigger an integer wrap during internal memory calculations. This issue leaves the conta…

6.2Medium
CVE-2026-114690

Gcc: confirmed out-of-bounds read/write in libstdc++ parallel `std

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in GCC. An out-of-bounds memory access vulnerability exists in the libstdc++ parallel search implementation due to an undersized internal buffer. A local attacker can exploit this flaw by providing crafted search data to an application compil…

5.9Medium
CVE-2026-118593

Kernel: local_bh imbalance in seg6_input_core() drop path (incomplete fix for cve-2026-46099)

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in Red Hat Enterprise Linux 9 kernel builds. An incomplete backport of the CVE-2026-46099 fix in RHEL 9.6 through 9.10 left a local_bh imbalance in seg6_input_core(), where the drop path returns with bottom halves still disabled. This can lea…

7.5High
CVE-2026-103963

Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by …

3.6Low
CVE-2026-118475

Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a m…

3.3Low
CVE-2026-112922

Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of…

6.5Medium
CVE-2026-91920

Undertow: undertow: chunkreader message length permits chunk-size overflow

Red Hat Red Hat build of Apache Camel for Spring Boot 4; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 9; Red Hat Red Hat Fuse 7

A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer encoding in HTTP requests. The issue occurs because a security check for the chunk size is performed before the value is shifted, allowing a spe…

5.8Medium
CVE-2026-110133

Ghostscript: heap buffer overflow in ghostscript truetype outliner due to npointstotal integer underflow during retry rollback

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7; Red Hat Red Hat Enterprise Linux 8

A flaw was found in Ghostscript. When processing a specially crafted TrueType font or document embedding one, an accounting error during font rendering can bypass buffer size checks, triggering a heap-based buffer overflow. A remote attacker could exploit thi…

4.3Medium
CVE-2026-93009

Dnsmasq: dnsmasq: heap out-of-bounds read in dhcpv6 option 39 fqdn decoder

Red Hat Red Hat Ceph Storage 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A flaw was found in dnsmasq. The DHCPv6 client hostname parser can read one byte past the end of a crafted FQDN option because it checks the next label length before confirming the pointer is still inside the option. An attacker on the local network can trigg…

4.3Medium
CVE-2026-93010

Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check

Red Hat Red Hat Ceph Storage 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A flaw was found in dnsmasq. When DHCP leasequery is enabled without listing allowed source addresses, the server does not check who sent the query. A host on the local network can request DHCP lease records and learn assigned addresses, MAC addresses, hostna…

6.8Medium
CVE-2026-93006

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

Red Hat Red Hat Ceph Storage 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive…

5.3Medium
CVE-2026-93007

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

Red Hat Red Hat Ceph Storage 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS…

5.3Medium
CVE-2026-93011

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

Red Hat Red Hat Ceph Storage 9; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DN…

The list holds every record since the start of 2025 and older records for this product.