Red Hat Security AdvisoryRHSA-2026:65851
OpenShift Container Platform 4.18.55 bug fix and security update
Released 2026-09-17 · Red Hat rating Important · View on Red Hat →
Fixes 18 records
Priority HIGH 72
A double free issue has been identified in libarchive's RAR5 reader.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00792 · Published 2026-06-30 · Partial fix · 3.7.7-10.el10_2, 3.7.7-5.el10_0.1 +58 CWE-415
Priority HIGH 72
A flaw was found in gnutls.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00565 · Published 2026-04-30 · Partial fix · 3.8.13, 3.8.10-4.el10_2 +42 CWE-178
Priority MEDIUM 47
The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.
CVSS 3.1CRITICAL 9.6· Network · Low privileges · No interaction · EPSS 0.01834 · Published 2026-05-22 · Partial fix · 1.25.13, 1.26.6 +2 CWE-1289
Priority MEDIUM 43
The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone.
CVSS 3.1HIGH 8.6· Network · No auth · No interaction · EPSS 0.00217 · Published 2026-07-22 · Partial fix CWE-346
Priority MEDIUM 43
Multiple flaws have been identified in `named` related to the handling of DNS messages whose CLASS is not Internet (`IN`) — for example, `CHAOS` or `HESIOD`, or DNS messages that specify meta-classes (`ANY` or `NONE`) in…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01942 · Published 2026-05-20 · Partial fix CWE-125
Priority MEDIUM 42
If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01687 · Published 2026-03-25 · Fixed CWE-606
Priority MEDIUM 41
BIND servers that are configured to use TKEY-based authentication via GSS-API tokens are vulnerable to excessive memory consumption when receiving and processing maliciously-constructed packets.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01086 · Published 2026-05-20 · Partial fix CWE-771
Priority MEDIUM 40
In the Linux kernel, the following vulnerability has been resolved: fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath When cifs_sanitize_prepath is called with an empty string or a string containing only del…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00352 · Published 2026-05-06 · Partial fix · 5.15.209, 6.1.175 +5 CWE-125
Priority LOW 39
An attacker who knows (or guesses) that a resolver uses RPZ with wildcard CNAME policies can craft query names long enough to trigger a NAMETOOLONG error condition during RPZ processing.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00428 · Published 2026-07-22 · Partial fix CWE-790
Priority LOW 38
SQLite before 3.53.2 contains a heap-based buffer overflow vulnerability in the FTS5 full-text search extension that allows attackers to cause a crash or execute arbitrary code by supplying a crafted database with malici…
CVSS 4.0HIGH 8.5· Local · No auth · User interaction · EPSS 0.00182 · Published 2026-06-09 · Partial fix · 3.53.2 CWE-122
Priority LOW 37
A flaw was found in dracut.
CVSS 3.1HIGH 7.5· Adjacent network · No auth · No interaction · EPSS 0.01275 · Published 2026-06-10 · Fixed in 107-7.el10_2, 105-4.el10_0.1 +21 CWE-78
Priority LOW 36
A flaw was found in Samba’s certificate auto-enrollment Group Policy handling.
CVSS 3.1HIGH 8.0· Adjacent network · No auth · No interaction · EPSS 0.00261 · Published 2026-05-27 · Partial fix · 4.23.5-109.el10_2, 4.21.3-114.el10_0.1 +22 CWE-345
Priority LOW 35
A flaw was found in sg3_utils.
CVSS 3.1HIGH 7.6· Physical · No auth · No interaction · EPSS 0.00348 · Published 2026-07-28 · Partial fix · 1.48-7.el10_2.1, 1.48-7.el10_0.2 +17 CWE-93
Priority LOW 35
A flaw was found in dracut.
CVSS 3.1HIGH 7.5· Adjacent network · No auth · No interaction · EPSS 0.00371 · Published 2026-08-07 · Partial fix · 107-9.el10_2, 105-4.el10_0.1 +24 CWE-78
Priority LOW 31
SQLite before 3.53.2 contains an out-of-bounds read vulnerability in the FTS5 full-text search extension that allows attackers to crash the process by supplying a crafted database with a malformed FTS5 leaf page.
CVSS 4.0MEDIUM 6.8· Local · No auth · User interaction · EPSS 0.00195 · Published 2026-06-09 · Partial fix · 3.53.2 CWE-125
Priority LOW 31
A flaw was found in Samba’s vfs_worm module.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00947 · Published 2026-05-27 · Partial fix · 4.23.5-109.el10_2, 4.21.3-114.el10_0.1 +22 CWE-280
Priority LOW 30
BIND may accept incorrect child-zone NSEC3 records as valid, which could allow an attacker to forge authenticated NXDOMAIN responses.
CVSS 3.1MEDIUM 6.8· Network · No auth · No interaction · EPSS 0.00272 · Published 2026-07-22 · Partial fix CWE-347
Priority LOW 24
systemd, a system and service manager, (as PID 1) hits an assert and freezes execution when an unprivileged IPC API call is made with spurious data.
CVSS 3.1MEDIUM 5.5· Local · Low privileges · No interaction · EPSS 0.00126 · Published 2026-03-23 · Partial fix · 257.11, 258.5 +1 CWE-269
THREATIST.IORead the docs