Red Hat Enterprise Linux 9.0

Eap-7: heap exhaustion via deserialization

389-ds-base: 389-ds-base: pre-authentication stack buffer overflow in get_ruvelement_from_berval() via unbounded replica id parsing

Glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid gdatetime

Python-eventlet: patch regression for cve-2021-21419 in some red hat builds

Poppler: pdfinfo: crash in broken documents when using -dests parameter

Eap-galleon: custom provisioning creates unsecured http-invoker

Libssh: libssh: use-after-free via data callbacks on closed channels

Libssh: libssh: integrity downgrade via openssl aes-gcm tag verification

389-ds-base: 389-ds-base: null pointer dereference in deref control plugin ber parser

389-ds-base: 389-ds-base: pre-auth ldap filter injection in cleanallruv status check

Ocp & fips mode

Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd

Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()

Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

Gstreamer: incomplete fix of cve-2026-1940

Yelp: arbitrary file read

A timing side-channel in the handling of RSA ClientKeyExchange messages was discovered in GnuTLS. This side-channel can be sufficient to recover the key encrypted in the RSA ciphertext across a network in a Bleichenbacher style attack. To achieve a successful decryption the attacker would need to send a large amount of specially crafted messages to the vulnerable server. By recovering the secret from the ClientKeyExchange message, the attacker would be able to decrypt the application data exchanged over that connection.

Gnutls: gnutls: policy bypass due to case-sensitive nameconstraints comparison

Controller: html injection in custom login info

Libsoup: libsoup: authentication bypass via digest authentication replay attack

Gimp: gimp: double-free in read_layer_block()

Xorg: xmayland: value overflow in xkbsetcompatmap()

Xorg: xwayland: use-after-free in xkb client resource removal

Libkcapi: memory corruption via uncanceled aio requests on error in libkcapi's one-shot aio path

schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.

Libsoup: libsoup: http request smuggling via permissive chunk-size parsing in soup_body_input_stream_read_chunked()

A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linux Kernel. This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service.

An out-of-bounds (OOB) memory access flaw was found in the Linux kernel's eBPF due to an Improper Input Validation. This flaw allows a local attacker with a special privilege to crash the system or leak internal information.

Keycloak: redirect_uri validation bypass

Samba: missing access check on reparse point operations

Wildfly-elytron: org.keycloak/keycloak-services: session fixation in elytron saml adapters

Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image

Kernel: out-of-bounds read vulnerability in smbcalcsize

Keycloak: oauth client impersonation

Kernel: oob access in smb2_dump_detail

Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race

Openvswitch don't match packets on nd_target field

An incorrect handling of the supplementary groups in the Buildah container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.

An incorrect handling of the supplementary groups in the Podman container engine might lead to the sensitive information disclosure or possible data modification if an attacker has direct access to the affected container where supplementary groups are used to set access permissions and is able to execute a binary code in that container.