CVE-2026-15588

Gdbusserver: glib2: gdbusserver pre-authentication dos via unbounded sasl line buffering

A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Ai Inference Server Cert Manager Discovery and 15 more

CVE-2026-15003

Binutils: gnu binutils: heap-buffer-overflow in linker leads to information disclosure and denial of service

A flaw was found in the GNU Binutils (Binary Utilities) linker. This vulnerability, a heap-buffer-overflow read (CWE-125), occurs when the linker processes a specially crafted 32-bit XCOFF (Extended Common Object File Format) object file. An attacker could exploit this by providing a malicious file, leading to an out-of-bounds read of memory. This can result in information disclosure, potentially revealing sensitive heap data, and a Denial of Service (DoS) due to the linker crashing.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Binutils Enterprise Linux Hardened Images and 5 more

CVE-2026-14164

Libarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()

A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Libarchive Red Hat Redhat

Products

Libarchive Enterprise Linux Ai Inference Server and 13 more

CVE-2026-13757

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

P11-kit Project Redhat

Products

P11-kit Cert Manager Cost Management and 10 more

CVE-2026-11850

Krb5: krb5: integer underflow in berval2tl_data() leads to heap out-of-bounds read

An integer underflow vulnerability was found in MIT krb5 in the berval2tl_data() function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c. The function performs an unsigned subtraction (bv_len - 2) without a prior bounds check. When bv_len is 0 or 1, the subtraction wraps to a large value which is then truncated to uint16_t, yielding 0xFFFE (65534) or 0xFFFF (65535). The subsequent malloc succeeds and memcpy reads up to 65534 bytes from a 0-1 byte buffer, resulting in a heap out-of-bounds read. The attack vector involves a malicious or compromised LDAP KDB backend returning a krbExtraData attribute with bv_len < 2, triggering the underflow when the KDC or kadmind reads principal data.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hardened Images Hummingbird and 4 more

CVE-2026-120194

Json-glib: json-glib: infinite loop in json_path_query() with negative jsonpath slice step

A flaw was found in json-glib. The JSONPath slice evaluator used by json_path_query() can enter an infinite loop when given a slice expression with a negative step. An application that evaluates attacker-controlled JSONPath expressions can be forced into a hang, leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Json-glib Red Hat Redhat

Products

Json-glib Enterprise Linux Enterprise Linux and 4 more

CVE-2026-95508

Libslirp: libslirp: heap buffer overflow in dhcpv6/tftp response builders on small interface mtu

A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply buffer with attacker-controlled content and length, resulting in denial of service and potentially arbitrary code execution in the host process. The default interface MTU is not affected.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform

CVE-2026-93011

Dnsmasq: dnsmasq: heap out-of-bounds write in dnssec validator via to_wire/from_wire transforms

A flaw was found in dnsmasq. After a reduction of internal domain-name buffer sizes, the DNSSEC validator can write a few bytes past a name buffer when converting names to and from DNS wire format. An attacker who can cause the server to validate a crafted DNSSEC response may overwrite a small amount of adjacent heap metadata. DNSSEC support is not compiled in by default and must also be enabled at runtime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-93007

Dnsmasq: dnsmasq: tcp/53 child-slot exhaustion starves dnssec validation

A flaw was found in dnsmasq. The TCP DNS service uses a small fixed pool of child processes and does not set a receive timeout on client connections. A remote attacker can open idle TCP connections to port 53 and occupy the entire pool, preventing new TCP DNS connections and DNSSEC validation that requires TCP fallback. UDP DNS resolution continues, and occupied slots are released after a fixed lifetime.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-93006

Dnsmasq: dnsmasq: tftp prefetch cache keyed on stale heap pointer serves wrong file content

A flaw was found in dnsmasq. The TFTP server can serve the wrong file contents because a recently used transfer cache is not invalidated when a transfer finishes. An attacker on the local network who can request a TFTP file may cause a later client to receive previously cached data instead of the requested file. In PXE network-boot environments this can substitute attacker-chosen boot content for a victim machine.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Dnsmasq Red Hat Redhat

Products

Dnsmasq Enterprise Linux Ceph Storage and 6 more

CVE-2026-92821

Sssd: sssd: access control bypass via premature ldap access rule evaluation

A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early and treats the access request as successful. A remote authenticated user with an expired password using an alternative authentication method, such as SSH public key authentication, can exploit this flaw to bypass access control restrictions and gain unauthorized access to protected systems.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Sssd

Products

Enterprise Linux Openshift Openshift Container Platform and 2 more

CVE-2026-90462

Sssd: sssd: fail-open in ldap ppolicy access check allows continued authorization

A flaw was found in SSSD. When configured with the LDAP access provider and `ldap_access_order` including `ppolicy` or `lockout`, a fail-open condition in the LDAP ppolicy access check can occur if a user lookup returns zero results. This can incorrectly return success and cache an allow decision, permitting continued authorization for a deleted or deprovisioned user. A remote attacker with prior valid account context could exploit this to maintain access to information and potentially make limited modifications to resources that should no longer be available.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat Sssd

Products

Sssd Enterprise Linux Openshift and 3 more

CVE-2026-89329

Device-mapper-multipath: local denial of service via blocking ipc send operations

A flaw was found in `multipathd`. A local attacker with access to the `multipathd` UNIX control socket can exploit this vulnerability by sending valid commands and then ceasing to read replies. This action can cause the `multipathd` listener thread to block, leading to a Denial of Service (DoS) where legitimate Inter-Process Communication (IPC) operations may hang or time out. This issue does not result in privilege escalation, arbitrary code execution, or impact data confidentiality or integrity.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform and 1 more

CVE-2026-89098

Nfs-utils: nfs-utils: denial of service via assertion failure in fsidd

A flaw was found in nfs-utils. The fsidd daemon improperly handles input received over its local domain socket by relying on program assertions to verify command arguments. A local user can exploit this vulnerability by sending a malformed request lacking the required arguments to trigger an assertion failure. This causes the daemon to crash, resulting in a Denial of Service (DoS) for filesystem identifier lookup services until restarted.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Nfs Redhat

Products

Nfs-utils Enterprise Linux Openshift and 2 more

CVE-2026-89096

Nfs-utils: nfs-utils: denial of service via memory leak in rpc.statd

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service (DoS) by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory growth. Sustained requests can exhaust system resources, eventually causing the service to degrade or crash.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nfs Redhat

Products

Nfs-utils Enterprise Linux Openshift and 2 more

CVE-2026-88252

Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion

A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat Sssd

Products

Sssd Enterprise Linux Openshift and 3 more

CVE-2026-87875

Cups: openprinting cups: heap out-of-bounds read in cupsutf32toutf8() via missing source-length bound

The cupsUTF32ToUTF8() function in CUPS's cups/transcode.c lacks a source-length bound and can read past the end of the source buffer, resulting in a heap out-of-bounds read. This is reachable via SNMP supply-description parsing in backend/snmp-supplies.c with attacker-controlled content.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Openprinting Redhat

Products

Cups Enterprise Linux Hardened Images and 4 more

CVE-2026-84828

Pcs: pcs: non-root haclient users can read arbitrary files via pcs host auth --token

A flaw was found in PCS (Pacemaker Configuration System). A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read with root privileges by the pcsd daemon and can be exfiltrated by the attacker through subsequent cluster node communication. This allows disclosure of sensitive data such as API keys, tokens, or configuration secrets that would otherwise be inaccessible to the attacker.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Openshift Container Platform and 2 more

CVE-2026-81666

Corosync: corosync: integer overflow in check_memb_commit_token_sanity may bypass message length validation on 32-bit systems

An integer overflow was found in Corosync's handling of membership commit token messages. The length-validation check for these messages can be bypassed on 32-bit systems due to an integer overflow in the calculation of the expected message length, allowing a crafted network packet to trigger an out-of-bounds memory access that crashes the Corosync daemon. This results in a denial of service for the affected cluster node. The overflow does not occur on 64-bit systems, where the length calculation is correctly performed in 64-bit arithmetic.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Corosync Redhat

Products

Corosync Enterprise Linux Openshift and 2 more

CVE-2026-80048

Sssd: sssd-kcm: local denial of service via excessive memory preallocation

A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Sssd

Products

Enterprise Linux Openshift Openshift Container Platform and 2 more