openshift/ose-rhel-coreos-9 vulnerabilities
CVEs whose affected-version data names the openshift/ose-rhel-coreos-9 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
129 CVEsRSS
CVE-2026-110926Medium· 5.3A flaw was found in OpenSSH
A flaw was found in OpenSSH. When compression is negotiated, channels on the same connection share one LZ77 dictionary. A peer who can write on one channel can recover plaintext from another channel by chosen-plaintext lengths.
CVE-2026-109968Medium· 5.5A flaw was found in the clevis PKCS#11 pin
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon logs LUKS disk encryption passphrases in plaintext to a log file. The log file is created without restrictive permissions, making it world-readable…
CVE-2026-109976Medium· 4.7PoCA flaw was found in the clevis PKCS#11 pin
A flaw was found in the clevis PKCS#11 pin. The clevis-pkcs11-afunix-socket-unlock daemon crashes when an AF_UNIX client connects to the data socket without a bound address, due to an integer underflow in the getpeername result handling.…
CVE-2026-107565Medium· 5.1A flaw was found in luksmeta
A flaw was found in luksmeta. A local attacker with administrative privileges can cause data corruption when saving metadata to a Linux Unified Key Setup (LUKS) device. Due to incorrect boundary calculations and flawed overlap detection,…
CVE-2026-107161High· 7.5A heap-based buffer overflow flaw was found in Cyrus SASL
A heap-based buffer overflow flaw was found in Cyrus SASL. The add_to_challenge() function in the DIGEST-MD5 plugin computes the size of the buffer needed for a challenge/response field before DIGEST-MD5 quoting is applied, but does not …
CVE-2026-80048Medium· 5.5PoCA flaw was found in `sssd-kcm`
A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the sy…
CVE-2026-76061Medium· 5.5A flaw was found in CRI-O's `bind_mount_prefix` handling
A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate abs…
CVE-2026-88252Medium· 4.7PoCA flaw was found in sssd
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connection…
CVE-2026-104041Medium· 5.5PoCA flaw was found in SSSD
A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and…
CVE-2026-104039Medium· 4.7A flaw was found in SSSD
A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable A…
CVE-2026-104042Medium· 5.5PoCA flaw was found in sssd
A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input…
CVE-2026-104044Medium· 6.2A flaw was found in sssd
A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check…
CVE-2026-104043Medium· 5.5A flaw was found in SSSD
A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an …
CVE-2026-104034Medium· 4.7A flaw was found in SSSD
A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been rele…
CVE-2026-104033Medium· 5.4PoCA flaw was found in SSSD
A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid creden…
CVE-2026-104031Medium· 5.5A flaw was found in SSSD
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vu…
CVE-2026-92821Medium· 6.8A flaw was found in SSSD
A flaw was found in SSSD. When configured to evaluate password expiration warnings before restrictive access rules in LDAP (Lightweight Directory Access Protocol) environments, an expired-password warning terminates rule evaluation early…
CVE-2026-104036Medium· 5.8A flaw was found in SSSD's NFS idmap plugin
A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnera…
CVE-2026-104038Medium· 5.9PoCA flaw was found in sssd
A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, t…
CVE-2026-104035Medium· 5.5A flaw was found in SSSD
A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Becaus…
CVE-2026-104037Medium· 5.5PoCA flaw was found in SSSD
A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read…
CVE-2026-104032Medium· 5.5PoCA flaw was found in SSSD
A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookup…
CVE-2026-104030Medium· 5.5A flaw was found in sssd
A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end…
CVE-2026-104029Low· 3.3A flaw was found in SSSD
A flaw was found in SSSD. A local attacker can exploit this vulnerability by sending a specially crafted request to the autofs responder UNIX socket. Due to improper buffer offset calculation during request parsing, the service performs …
CVE-2026-102010High· 7.0A flaw was found in GCC
A flaw was found in GCC. When an application calls the erase_if function on a binary heap priority queue in libstdc++, the library reallocates storage but fails to update its internal entry pointer. An attacker capable of triggering this…
CVE-2026-93834High· 8.8PoCA use-after-free vulnerability was found in QEMU's 9pfs subsystem
A use-after-free vulnerability was found in QEMU's 9pfs subsystem. A race condition between the main thread and a worker thread when processing concurrent Tlcreate and Twalk requests allows a malicious guest user to craft a fid path cont…
CVE-2026-94640High· 7.5A flaw was found in rpcbind
A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service (DoS) by sending a large number of unique requests. The rpcbind service records previously unseen RPC (Remote Procedur…
CVE-2026-95619High· 7.7A flaw was found in libstdc++
A flaw was found in libstdc++. An integer overflow can occur when processing large inputs to the aligned operator new in the C++ library. This vulnerability could lead to an undersized memory allocation, potentially causing memory corrup…
CVE-2026-95508High· 7.4A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp
A heap-based buffer overflow was found in the DHCPv6 and TFTP response builders of libslirp. When the host is configured with a small interface MTU, a guest-supplied DHCPv6 CLIENTID option or TFTP blksize option can overflow the reply bu…
CVE-2026-92574High· 8.8A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context
A vulnerability in CRI-O checkpoint restore allows a user who can create a pod from a malicious checkpointed container to bypass the destination Kubernetes security context. The restored process may retain credentials, Linux capabilities…