CVE-2025-5916

Libarchive: integer overflow while reading warc files at archive_read_support_format_warc.c

A vulnerability has been identified in the libarchive library. This flaw involves an integer overflow that can be triggered when processing a Web Archive (WARC) file that claims to have more than INT64_MAX - 4 content bytes. An attacker could craft a malicious WARC archive to induce this overflow, potentially leading to unpredictable program behavior, memory corruption, or a denial-of-service condition within applications that process such archives using libarchive. This bug affects libarchive versions prior to 3.8.0.

CVSS 3.1 · 3.9 Low EPSS < 1% KEV · Not listed

Vendors

Libarchive Redhat

Products

Libarchive Enterprise Linux Openshift and 3 more

CVE-2025-5915

Libarchive: heap buffer over read in copy_from_lzss_window() at archive_read_support_format_rar.c

A vulnerability has been identified in the libarchive library. This flaw can lead to a heap buffer over-read due to the size of a filter block potentially exceeding the Lempel-Ziv-Storer-Schieber (LZSS) window. This means the library may attempt to read beyond the allocated memory buffer, which can result in unpredictable program behavior, crashes (denial of service), or the disclosure of sensitive information from adjacent memory regions.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Libarchive Redhat

Products

Libarchive Enterprise Linux Openshift and 3 more

CVE-2026-114236

Podman: goroutine/file-descriptor leak in storage/pkg/archive.applylayer and applyuncompressedlayer on malformed layers

storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or malicious inputs, leak a file descriptor; unbounded repeated calls can exhaust the process’ file descriptor limit

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Advanced Cluster Security Ansible Automation Platform Certifications and 16 more

CVE-2026-114370

Undertow: undertow: pathresourcemanager safepaths check allows sibling-directory symlink traversal

A flaw was found in the PathResourceManager component of the Undertow web server. This component is responsible for serving static files from the file system. The issue occurs because the mechanism used to verify if a symbolic link points to a safe location only checks if the target path starts with a specific string, without ensuring it matches a full directory name. This could allow an attacker to access files in a sibling directory if that directorys name starts with the same characters as an authorized safe directory.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Camel Spring Boot Enterprise Linux Jboss Enterprise Application Platform and 3 more

CVE-2026-112922

Ghostscript: out-of-bounds read in ghostscript shade_next_color via integer overflow of indexed color index in mesh shading

A flaw was found in Ghostscript. A remote attacker could exploit this vulnerability by enticing a user to process a specially crafted PDF or PostScript document containing malicious mesh shading data. Due to improper bounds validation during the processing of indexed color values, Ghostscript triggers an out-of-bounds memory read. Successful exploitation can lead to a Denial of Service (DoS) through an application crash or result in limited information disclosure.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Ghostscript Redhat

Products

Ghostscript Enterprise Linux Rhel Els

CVE-2026-111802

Nautilus: nautilus: arbitrary file deletion via trash symlink

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage volume and confirming the prompt to empty the trash, leading to the arbitrary deletion of files accessible to that user.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Rhel Els

CVE-2026-111581

Libblockdev: libblockdev: argument injection in ntfs/vfat label-setting helpers via udisks2 setlabel() d-bus method

A flaw was found in libblockdev. The bd_fs_ntfs_set_label() and bd_fs_vfat_set_label() functions pass caller-supplied label values as bare positional arguments to the ntfslabel and fatlabel utilities without end-of-options separators or input validation for values beginning with a dash. This allows a label starting with '-' to be interpreted as a command-line flag by the spawned tool, potentially bypassing safety checks or causing unintended operations. This is reachable by unprivileged local users through the udisks2 Filesystem.SetLabel() D-Bus method without administrator authentication.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2026-118475

Eog: eye of gnome: buffer overrun when parsing malicious png files with non-standard iccp chunk

A flaw was found in Eye of GNOME. When parsing a specially crafted PNG image containing malformed color profile metadata, the application fails to validate chunk boundaries while searching for a null terminator. An attacker could trick a user into opening a malicious image, causing the application to read past the allocated buffer. This issue can lead to an application crash, resulting in a Denial of Service (DoS), or potentially expose sensitive memory contents.

CVSS 3.1 · 3.6 Low EPSS < 1% KEV · Not listed

Vendors

Gnome Red Hat Redhat

Products

Eog Enterprise Linux Enterprise Linux and 1 more

CVE-2026-115449

Libslirp: libslirp: icmp echo reply length desynchronization leaks host ip to guest

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift

CVE-2026-11793

389-ds-base: 389-ds-base: stack buffer overflow in checkprefix() algorithm id parsing

A stack buffer overflow flaw was found in 389 Directory Server. The checkPrefix() function in pw.c copies an attacker-controlled algorithm ID into a 256-byte stack buffer without bounds checking when parsing reversible-encrypted attribute values. An attacker with Directory Manager privileges can crash the LDAP server by storing a crafted credential with an oversized algorithm ID. FORTIFY_SOURCE mitigates this to denial of service only.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

389 Directory Server Directory Server Enterprise Linux and 2 more

CVE-2026-11792

389-ds-base: 389-ds-base: heap buffer overflow in audit log password masking (create_masked_entry_string)

A heap buffer overflow flaw was found in 389 Directory Server. When audit logging is enabled, the create_masked_entry_string() function in auditlog.c copies a fixed-length password mask into a precisely-sized heap buffer without checking available space. If a short cleartext password is logged (requiring non-default CLEAR password storage or a compromised replication peer), the copy overflows the buffer, corrupting heap memory and audit log output.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Enterprise Linux Redhat Directory Server and 1 more

CVE-2026-11786

389-ds-base: 389-ds-base: heap out-of-bounds read in ldif parser str2entry_state_information_from_type()

A flaw was found in 389 Directory Server. The LDIF parser reads past the end of a heap buffer when processing attribute types with trailing semicolons during database import, causing an out-of-bounds read detectable under memory instrumentation.

CVSS 3.1 · 1.9 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

389 Directory Server Directory Server Enterprise Linux and 2 more

CVE-2026-110036

Device-mapper-persistent-data: device-mapper-persistent-data: denial of service via crafted block indices

A flaw was found in device-mapper-persistent-data. A local attacker can cause a Denial of Service (DoS) by inducing a user or system tool to process crafted device metadata containing an excessively large block index. An arithmetic error in the synchronous block reading logic causes the application to panic and unexpectedly terminate.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Red Hat Redhat

Products

Enterprise Linux Enterprise Linux Openshift and 2 more

CVE-2026-109976

Clevis: clevis: integer underflow in pkcs#11 data socket handler crashes daemon on unbound client connection

A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling. This causes a denial of service, preventing LUKS disk decryption from completing during boot.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2026-109854

M17n-lib: uninitialized stack read in iso-2022 compound text utf-8 decoding

A flaw was found in m17n-lib. An attacker who supplies crafted input to an application processing ISO-2022 encoded text can cause the library to read uninitialized memory from the stack. If the application exposes or returns the decoded output, this flaw can result in unexpected behavior and limited information disclosure.

CVSS 3.1 · 2.5 Low EPSS < 1% KEV · Not listed

Vendors

M17n-lib Red Hat Redhat

Products

M17n-lib Enterprise Linux Enterprise Linux and 1 more

CVE-2026-10028

Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of service via circular certificate chain

A flaw was found in glib-networking. A remote attacker can exploit this vulnerability by presenting a specially crafted certificate chain to an application that uses glib-networking with the GnuTLS backend enabled and performs certificate verification. This crafted chain, which contains circular issuer relationships, can cause an infinite loop during certificate verification. The unbounded traversal consumes excessive CPU resources, leading to a denial of service for the affected process or worker.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Glib-networking Enterprise Linux Rhel Els

CVE-2026-0992

Libxml2: libxml2: denial of service via crafted xml catalogs

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

CVSS 3.1 · 2.9 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Redhat Xmlsoft

Products

Aix Vios Enterprise Linux and 8 more

CVE-2026-0989

Libxml2: unbounded relaxng include recursion leading to stack overflow

A flaw was identified in the RelaxNG parser of libxml2 related to how external schema inclusions are handled. The parser does not enforce a limit on inclusion depth when resolving nested <include> directives. Specially crafted or overly complex schemas can cause excessive recursion during parsing. This may lead to stack exhaustion and application crashes, creating a denial-of-service risk.

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Ibm Redhat Xmlsoft

Products

Aix Vios Enterprise Linux and 8 more

CVE-2026-0988

Glib: glib: denial of service via integer overflow in g_buffered_input_stream_peek()

A flaw was found in glib. Missing validation of offset and count parameters in the g_buffered_input_stream_peek() function can lead to an integer overflow during length calculation. When specially crafted values are provided, this overflow results in an incorrect size being passed to memcpy(), triggering a buffer overflow. This can cause application crashes, leading to a Denial of Service (DoS).

CVSS 3.1 · 3.7 Low EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Hummingbird Openshift Ai and 1 more

CVE-2026-0967

Libssh: libssh: denial of service via inefficient regular expression processing

A flaw was found in libssh. A remote attacker, by controlling client configuration files or known_hosts files, could craft specific hostnames that when processed by the `match_pattern()` function can lead to inefficient regular expression backtracking. This can cause timeouts and resource exhaustion, resulting in a Denial of Service (DoS) for the client.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Libssh Redhat

Products

Libssh Enterprise Linux Hummingbird and 2 more