Red Hat Red Hat Update Infrastructure 5
37 CVEs affecting Red Hat Red Hat Update Infrastructure 5. Latest disclosed: 2026-09-24. Critical: 1, High: 17.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12701 | Critical | 9.0 | 2026-07-20 | A path traversal vulnerability was found in pulpcore. The relative_path_validator function only verifies that content paths do not begin with "/" but fails to… |
CVE-2026-5260 | High | 8.2 | 2026-05-26 | A flaw was found in libgnutls. A remote attacker, by sending an extremely short premaster secret during an RSA key exchange to a server using an RSA key backed… |
CVE-2026-42013 | High | 8.2 | 2026-05-26 | A flaw was found in gnutls. When validating certificates, an oversized Subject Alternative Name (SAN) could cause the validation process to incorrectly fall ba… |
CVE-2026-90959 | High | 8.1 | 2026-09-24 | A path traversal vulnerability was found in pulpcore. The content upload API accepts a 'file_url' parameter that allows users with file repository privileges t… |
CVE-2026-48864 | High | 7.8 | 2026-05-26 | A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insuf… |
CVE-2025-13601 | High | 7.7 | 2025-11-26 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to… |
CVE-2026-58016 | High | 7.5 | 2026-06-30 | A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus… |
CVE-2026-14164 | High | 7.5 | 2026-06-30 | A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain st… |
CVE-2026-42009 | High | 7.5 | 2026-05-18 | A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator fu… |
CVE-2026-33846 | High | 7.5 | 2026-05-04 | A heap buffer overflow vulnerability exists in the DTLS handshake fragment reassembly logic of GnuTLS. The issue arises in merge_handshake_packet() where incom… |
CVE-2026-33845 | High | 7.5 | 2026-04-30 | A flaw in GnuTLS DTLS handshake parsing allows malformed fragments with zero length and non-zero offset, leading to an integer underflow during reassembly and… |
CVE-2026-5121 | High | 7.5 | 2026-03-30 | A flaw was found in libarchive. On 32-bit systems, an integer overflow vulnerability exists in the zisofs block pointer allocation logic. A remote attacker can… |
CVE-2026-4424 | High | 7.5 | 2026-03-19 | A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sl… |
CVE-2026-4111 | High | 7.5 | 2026-03-13 | A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a sp… |
CVE-2026-42011 | High | 7.4 | 2026-05-07 | A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) o… |
CVE-2026-92925 | High | 7.1 | 2026-09-17 | A flaw was found in Redis community. The cluster bus packet parser, responsible for handling PING, PONG, and MEET packets, fails to properly validate string-ca… |
CVE-2026-42012 | High | 7.1 | 2026-05-26 | A flaw was found in gnutls. A remote attacker could exploit this vulnerability by presenting a specially crafted certificate that contains Uniform Resource Ide… |
CVE-2026-42010 | High | 7.1 | 2026-05-07 | A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character wi… |
CVE-2026-4878 | Medium | 6.7 | 2026-04-09 | A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This… |
CVE-2026-42014 | Medium | 6.6 | 2026-06-16 | A flaw was found in GnuTLS. The `gnutls_pkcs11_token_set_pin` function, used for changing the Security Officer PIN, can lead to a use-after-free vulnerability… |