CVE-2026-112320

Krb5: mit krb5 kadmind unauthenticated memory leak dos via gss-rpc auth flavor switching

The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112319

Krb5: mit krb5 kadmind authenticated memory exhaustion dos via unbounded rpc xdr allocation

The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112318

Krb5: mit krb5 kadmind authenticated dos exploiting dereference of null policy name pointers

The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112317

Krb5: mit krb5 kdc unauthenticated memory leak dos in kdb keytab key decryption error path

krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112316

Krb5: mit krb5 kadmind authenticated memory leak dos in xdr_krb5_tl_data() decode failure

xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-112315

Krb5: mit krb5 kadmind unauthenticated memory leak dos in rpcsec_gss buffer decode failure

The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-103963

Glib-networking: unbounded tls 1.3 session ticket queue growth in glib-networking allows remote denial of service

A flaw was found in glib-networking. When establishing connections using Transport Layer Security (TLS) version 1.3, the client-side session cache does not limit the number of session tickets retained for a single host. A malicious server can exploit this by sending excessive session ticket messages, causing the client application to continuously consume memory. This unbounded memory growth can exhaust system memory, resulting in a Denial of Service (DoS).

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 2 more

CVE-2026-108472

Xfsprogs: xfsprogs: local privilege escalation via command injection in xfs_admin

A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Enterprise Linux Eus and 4 more

CVE-2026-124746

Busybox: out-of-bounds read in volume_id_get_buffer() via an offset+length wraparound

A flaw was found in BusyBox. An integer overflow occurs in the volume_id component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Busybox Red Hat Redhat

Products

Busybox Enterprise Linux Enterprise Linux and 3 more

CVE-2026-85518

Openscap: openscap: arbitrary file write via path traversal in source datastream decomposition

A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Openscap Red Hat Redhat

Products

Openscap Enterprise Linux Enterprise Linux and 3 more

CVE-2026-119618

Apache HTTP Server: mod_http2: heap corruption and RCE in assign_headers

Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's mod_http2 in assign_headers() can lead to RCE. This issue affects Apache HTTP Server: from 2.4.55 through 2.4.70. Affected releases of mod_h2 from GitHub: from 2.0.8 through 2.0.42.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Apache Apache Software Foundation Redhat

Products

Apache Http Server Http Server Apache Http Server and 4 more

CVE-2026-124744

Busybox: cpio hardlink target not sanitized under feature_path_traversal_protection

A flaw was found in BusyBox. When extracting files using the cpio utility with path traversal protection enabled, hardlink target paths are not properly sanitized. By tricking a user or automated process into extracting a crafted archive, an attacker can create hardlinks that point to files outside the intended extraction directory. This issue may allow an attacker to modify or overwrite arbitrary files outside the target directory during subsequent extraction operations.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Hardened Images and 2 more

CVE-2026-16118

Xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c

A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ai Inference Server Cert Manager Cost Management On Premise and 10 more

CVE-2026-122056

Openscap: one-byte heap buffer overflow in sds-compose may lead to denial-of-service

A flaw was found in OpenSCAP. A heap-based buffer overflow can occur when processing a specially crafted Extensible Configuration Checklist Description Format (XCCDF) document using the sds-compose option. An attacker could exploit this vulnerability to corrupt memory, resulting in an application crash and a Denial of Service (DoS).

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Openscap Red Hat Redhat

Products

Openscap Enterprise Linux Enterprise Linux and 3 more

CVE-2026-127101

Sssd: sssd: null pointer dereference in pam responder when protocol version negotiation is skipped

A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service.

CVSS 3.1 · 5.5 Medium EPSS n/a KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2026-125707

Gst-plugins-bad: gst-plugins-bad: off-by-one write in mxf demuxer temporal offset table

A flaw was found in GStreamer's MXF demuxer. When an application processes a crafted MXF file, an off-by-one bounds check can allow a one-byte write past the logical end of a temporal offset array. This may corrupt memory and cause the application to crash. The extent of the impact has not been demonstrated by a runtime test.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-125706

Gst-plugins-bad: gst-plugins-bad: missing bounds checks in mpeg ps pes header parsing

A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin. The PES header parsers do not adequately check remaining data before reading timestamps and optional header fields. Opening a specially crafted MPEG Program Stream file can cause an out-of-bounds read and potentially crash the application, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-125703

Gst-plugins-bad: gst-plugins-bad: bounds check errors in mxf vanc packet handling

A flaw was found in the GStreamer gst-plugins-bad MXF plugin. Insufficient bounds checks when parsing crafted VANC data can cause an out-of-bounds read in the demuxer, while an incorrect buffer size calculation when muxing multiple ancillary packets can cause an out-of-bounds write. Processing affected content may crash the application, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-91151

Cockpit: cockpit: local privilege escalation via insecure symlink handling in public key addition helper

A flaw was found in Cockpit. A local authenticated user with control over a target account's home directory can exploit a privileged symlink dereference vulnerability in the `ssh-add-public-key.sh` helper. When this helper runs with elevated privileges, it can be tricked into following attacker-controlled symlinks within the `.ssh` or `authorized_keys` paths. This allows the attacker to arbitrarily change file ownership and modes, potentially leading to local privilege escalation and impacting the integrity, confidentiality, and availability of the system.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Openshift Devspaces and 2 more

CVE-2026-91150

Cockpit: cockpit: denial of service via unbounded fragmented websocket messages

A flaw was found in Cockpit. This vulnerability allows a remote attacker, without prior authentication, to send specially crafted fragmented WebSocket messages. These messages accumulate without a total-size limit, leading to unbounded memory exhaustion and a denial of service in the `cockpit-ws` service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Openshift Devspaces and 2 more