Known vulnerabilities in Red Hat Enterprise Linux 9

Is your version affected?

CVE list

CVE	Summary	Score	Published
CVE-2026-2760	Sandbox escape due to incorrect boundary conditions in the Graphics: WebRender component	10.0 Critical	Feb 24, 2026
CVE-2026-2759	Incorrect boundary conditions in the Graphics: ImageLib component	9.8 Critical	Feb 24, 2026
CVE-2026-2758	Use-after-free in the JavaScript: GC component	9.8 Critical	Feb 24, 2026
CVE-2026-2757	Incorrect boundary conditions in the WebRTC: Audio/Video component	9.8 Critical	Feb 24, 2026
CVE-2026-1709	A flaw was found in Keylime	9.4 Critical	Feb 6, 2026
CVE-2025-56005	An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via…	9.8 Critical	Jan 20, 2026
CVE-2026-0881	Sandbox escape in the Messaging System component	10.0 Critical	Jan 13, 2026
CVE-2026-0879	Sandbox escape due to incorrect boundary conditions in the Graphics component	9.8 Critical	Jan 13, 2026
CVE-2025-61686	React Router is a router for React	9.1 Critical	Jan 10, 2026
CVE-2025-12543	Undertow-core: undertow http server fails to reject malformed host headers leading to potential cache poisoning and ssrf	9.6 Critical	Jan 7, 2026
CVE-2025-67268	gpsd before commit dc966aa contains a heap-based out-of-bounds write vulnerability in the drivers/driver_nmea2000.c file	9.8 Critical	Jan 2, 2026
CVE-2025-10230	Samba: command injection in wins server hook script	10.0 Critical	Nov 7, 2025
CVE-2025-7493	A privilege escalation flaw from host to domain administrator was found in FreeIPA	9.1 Critical	Sep 30, 2025
CVE-2025-4404	Freeipa: idm: privilege escalation from host to domain admin in freeipa	9.1 Critical	Jun 17, 2025
CVE-2025-49794	Libxml: heap use after free (uaf) leads to denial of service (dos)	9.1 Critical	Jun 16, 2025
CVE-2025-49796	Libxml: type confusion leads to denial of service (dos)	9.1 Critical	Jun 16, 2025
CVE-2025-32911	Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value	9.0 Critical	Apr 15, 2025
CVE-2024-12084	Rsync: heap buffer overflow in rsync due to improper checksum length handling	9.8 Critical	Jan 15, 2025
CVE-2024-3094	Xz: malicious code in distributed source	10.0 Critical	Mar 29, 2024
CVE-2023-6816	Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer	9.8 Critical	Jan 18, 2024
CVE-2023-3961	A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain…	9.1 Critical	Nov 3, 2023
CVE-2023-46846	SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform…	9.3 Critical	Nov 3, 2023
CVE-2023-32254	A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server	9.8 Critical	Jul 10, 2023
CVE-2023-32250	A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server	9.0 Critical	Jul 10, 2023
CVE-2006-4339	Openssl: openssl: signature forgery via improper pkcs-1 padding removal leading to certificate validation bypass	9.1 Critical	Sep 5, 2006

Other Red Hat products