Read the docs
Red Hat Security Advisory

RHSA-2026:39981

Cost Management Metrics Operator Update

Released 2026-07-15 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 10 records

TI-2026-04772 CVE-2026-5450 · GHSA-v898-xg3c-w4rj

scanf %mc off-by-one heap buffer overflow

Priority HIGH 82

Calling the scanf family of functions with a %mc (malloc'd character match) in the GNU C Library version 2.7 to version 2.43 with a format width specifier with an explicit width greater than 1024 could result in a one by…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00502 Published 2026-04-20 Partial fix CWE-122
TI-2026-00692 CVE-2026-0915 · GHSA-xp56-6525-9chf

getnetbyaddr and getnetbyaddr_r leak stack contents to DNS resovler

Priority HIGH 72

Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00618 Published 2026-01-15 Partial fix CWE-908
TI-2026-33226 CVE-2026-45447 · GHSA-f684-cpcq-j565

Heap Use-After-Free in the PKCS7_verify() Function

Priority MEDIUM 47

Issue summary: A specially crafted PKCS#7 or S/MIME signed message could trigger a use-after-free during PKCS#7 signature verification.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.04002 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +5 CWE-416
TI-2026-26479 CVE-2026-34182 · GHSA-f9v2-4w9p-2cwc

CMS AuthEnvelopedData Processing May Accept Forged Messages

Priority MEDIUM 47

Issue Summary: Cryptographic Message Services (CMS) processing fails to perform sufficient input validation on the cipher and tag length fields of AuthEnvelopedData containers, leading to various potential compromises.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.01057 Published 2026-06-09 Fixed in 4.0.1, 3.6.3 +3 CWE-354
TI-2026-30987 CVE-2026-42764 · GHSA-5pg7-f6xv-j6m4

NULL Pointer Dereference in QUIC Server Initial Packet Handling

Priority MEDIUM 41

Issue summary: Receiving a QUIC initial packet with an invalid token may trigger a NULL pointer dereference in the OpenSSL QUIC server with address validation disabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01165 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +1 CWE-476
TI-2026-26480 CVE-2026-34183 · GHSA-f5vx-f6jp-89j6

Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler

Priority MEDIUM 41

Issue summary: Remote peer may exhaust heap memory of the QUIC server or client by flooding it with packets containing PATH_CHALLENGE frames.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01049 Published 2026-06-09 Partial fix · 4.0.1, 3.6.3 +2 CWE-1325
TI-2026-24346 CVE-2026-31790 · GHSA-vgxx-5xj5-q97x

Incorrect Failure Handling in RSA KEM RSASVE Encapsulation

Priority MEDIUM 41

Issue summary: Applications using RSASVE key encapsulation to establish a secret encryption key can send contents of an uninitialized memory buffer to a malicious peer.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01049 Published 2026-04-07 Partial fix · 3.6.2, 3.5.6 +3 CWE-754
TI-2026-33224 CVE-2026-45445 · GHSA-v446-xwfm-x7mr

AES-OCB IV Ignored on EVP_Cipher() Path

Priority MEDIUM 40

Issue summary: When an application drives an AES-OCB context through the public EVP_Cipher() one-shot interface, the application-supplied initialisation vector (IV) is silently discarded.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00704 Published 2026-06-09 Fixed in 4.0.1, 3.6.3 +3 CWE-325