Known vulnerabilities in Red Hat Enterprise Linux 9

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-5734	Memory safety bugs present in Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and Thunderbird 149.0.1	8.1 High	Apr 7, 2026
CVE-2026-5733	Incorrect boundary conditions in the Graphics: WebGPU component	8.8 High	Apr 7, 2026
CVE-2026-5731	Memory safety bugs present in Firefox ESR 115.34.0, Firefox ESR 140.9.0, Thunderbird ESR 140.9.0, Firefox 149.0.1 and…	9.8 Critical	Apr 7, 2026
CVE-2026-34197	Exploited Apache ActiveMQ Improper Input Validation Vulnerability	Not rated	Apr 7, 2026
CVE-2026-34986	Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…	7.5 High	Apr 6, 2026
CVE-2026-34589	OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…	8.4 High	Apr 6, 2026
CVE-2026-34588	OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…	8.6 High	Apr 6, 2026
CVE-2026-34379	OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…	7.1 High	Apr 6, 2026
CVE-2026-5704	Tar: tar: hidden file injection via crafted archives	5.0 Medium	Apr 6, 2026
CVE-2026-34982	Vim is an open source, command line text editor	8.2 High	Apr 6, 2026
CVE-2026-5673	Libtheora: libtheora: denial of service or information disclosure via malformed avi file processing	5.6 Medium	Apr 6, 2026
CVE-2026-3184	Util-linux: util-linux: access control bypass due to improper hostname canonicalization	3.7 Low	Apr 3, 2026
CVE-2026-2625	Rust-rpm-sequoia: rust-rpm-sequoia: denial of service via crafted rpm file during signature verification	4.0 Medium	Apr 3, 2026
CVE-2026-31402	In the Linux kernel, the following vulnerability has been resolved: nfsd: fix heap overflow in NFSv4.0 LOCK replay cache…	9.8 Critical	Apr 3, 2026
CVE-2026-35535	In Sudo through 1.9.17p2 before 3e474c2, a failure of a setuid, setgid, or setgroups call, during a privilege drop…	7.4 High	Apr 3, 2026
CVE-2026-34827	Rack is a modular Ruby web server interface	7.5 High	Apr 2, 2026
CVE-2026-34829	Rack is a modular Ruby web server interface	7.5 High	Apr 2, 2026
CVE-2026-35385	In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users'…	7.5 High	Apr 2, 2026
CVE-2026-34545	OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for…	8.4 High	Apr 1, 2026
CVE-2026-35093	Libinput: libinput: unauthorized code execution and information disclosure through lua bytecode plugins	8.8 High	Apr 1, 2026
CVE-2026-35094	A flaw was found in libinput	3.3 Low	Apr 1, 2026
CVE-2026-35092	A flaw was found in Corosync	7.5 High	Apr 1, 2026
CVE-2026-35091	A flaw was found in Corosync	8.2 High	Apr 1, 2026
CVE-2026-23401	KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE	8.1 High	Apr 1, 2026
CVE-2026-4800	The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same…	8.1 High	Mar 31, 2026

Other Red Hat products