Veille CVE

Jeudi 7 mai 2026

23 CVE

Critique 5 Élevée 14 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Linux » ✕
  1. CVE-2026-42499 7.5 Élevée

    Go standard library net/mail · Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat Ansible Automation Platform 2.6 for RHEL 9

    Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

  2. CVE-2026-39820 7.5 Élevée

    Go standard library net/mail · Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat Ansible Automation Platform 2.5 for RHEL 9 · Red Hat Ansible Automation Platform 2.6 for RHEL 9

    Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

  3. CVE-2026-33814 7.5 Élevée

    golang.org/x/net/http2 · Go standard library net/http · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

  4. CVE-2026-33811 7.5 Élevée

    Go standard library net · Red Hat Cryostat 4 on RHEL 9 · Red Hat Ansible Automation Platform 2.5 for RHEL 8 · Red Hat Ansible Automation Platform 2.5 for RHEL 9

    When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

  5. CVE-2026-42011 7.4 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8

    A flaw was found in gnutls. This vulnerability occurs because permitted name constraints were incorrectly ignored when previous Certificate Authorities (CAs) only had excluded name constraints. A remote attacker could exploit this to bypass critical name constraint checks during certificate validation. This bypass could lead to the acceptance of invalid certificates, potentially enabling spoofing or man-in-the-middle attacks against affected systems.

  6. CVE-2026-41685 4.3 Moyenne

    lxc incus · Linuxcontainers incus

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, uploads of large amount of data by authenticated users can run the Incus server out of disk space, potentially taking down the host system. The impact here is limited for anyone using storage.images_volume and storage.backups_volume as those users will have large uploads be stored on those volumes rather than directly on the host filesystem. This is the default behavior on IncusOS. This issue has been patched in version 7.0.0.

  7. CVE-2026-41684 6.5 Moyenne

    lxc incus · Linuxcontainers incus

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, backup.GetInfo() trusts the inline backup/index.yaml config when present and only falls back to parsing the legacy backup/container/backup.yaml file if result.Config == nil. As a result, an archive can carry a valid inline config that passes the initial import preflight while also carrying a malformed legacy backup/container/backup.yaml file that is reparsed later from the restored file system. ParseConfigYamlFile() accepts YAML documents with no container section, and multiple downstream consumers then dereference. Container without checking for nil. Confirmed examples in the instance restore and import flow include backup.UpdateInstanceConfig() and internalImportFromBackup(). An authenticated user with permission to import instance backups may be able to crash the Incus daemon with a crafted backup archive whose inline backup/index.yaml is valid but whose extracted legacy backup.yaml omits container. The crash occurs in the restore path after archive extraction has begun. This issue has been patched in version 7.0.0.

  8. CVE-2026-41648 5.0 Moyenne

    lxc incus · Linuxcontainers incus

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, user provided image and backup tarballs would be unpacked and YAML files parsed without any size restrictions. This was making it easy for an authenticated user to provide a crafted image or backup tarball that when parsed by Incus would lead to a very large YAML document being loaded into memory, potentially causing the entire server to run out of memory. This issue has been patched in version 7.0.0.

  9. CVE-2026-41647 6.5 Moyenne

    lxc incus · Linuxcontainers incus

    Incus is a system container and virtual machine manager. Prior to version 7.0.0, a missing error handling could lead an authenticated Incus user to cause a daemon crash through the import of a truncated storage bucket backup file. This issue has been patched in version 7.0.0.

  10. CVE-2026-8094 9.8 Critique

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Other issue in the WebRTC component. This vulnerability was fixed in Firefox ESR 140.10.2 and Thunderbird 140.10.2.

  11. CVE-2026-8093 8.1 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6

    Memory safety bugs present in Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2 and Thunderbird 150.0.2.

  12. CVE-2026-8092 8.1 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Memory safety bugs present in Thunderbird ESR 140.10.1 and Thunderbird 150.0.1. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

  13. CVE-2026-8091 9.8 Critique

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Incorrect boundary conditions in the Audio/Video: Playback component. This vulnerability was fixed in Firefox 150, Thunderbird 150, Firefox ESR 140.10.1, Thunderbird 140.10.1, and Firefox ESR 115.35.2.

  14. CVE-2026-8090 7.3 Élevée

    Mozilla Firefox · Mozilla Thunderbird · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support

    Use-after-free in the DOM: Networking component. This vulnerability was fixed in Firefox 150.0.2, Firefox ESR 140.10.2, Firefox ESR 115.35.2, Thunderbird 150.0.2, and Thunderbird 140.10.2.

  15. CVE-2026-42010 9.8 Critique

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

    A flaw was found in gnutls. Servers configured with RSA-PSK (Rivest–Shamir–Adleman – Pre-Shared Key) wrongfully matched usernames containing a NUL character with truncated usernames. A remote attacker could exploit this by sending a specially crafted username, leading to an authentication bypass. This vulnerability allows an attacker to gain unauthorized access by circumventing the authentication process.

  16. CVE-2026-41139 8.8 Élevée

    josdejong mathjs · Red Hat Cryostat 4 · Red Hat Developer Hub · Red Hat Enterprise Linux 10

    Math.js is an extensive math library for JavaScript and Node.js. From version 13.1.0 to before version 15.2.0, arbitrary JavaScript can be executed via the expression parser of mathjs. This issue has been patched in version 15.2.0.

  17. CVE-2026-42216 9.1 Critique

    AcademySoftwareFoundation openexr · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 9

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, IDManifest::init() reconstructs strings from a prefix-compressed representation. If the previous string is longer than 255 bytes, the next string is expected to begin with a 2-byte prefix length. The code reads stringList[i][0] and stringList[i][1] without checking that the current string has at least two bytes. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

  18. CVE-2026-41675 7.5 Élevée

    xmldom · Red Hat Developer Hub 1.9 · Red Hat OpenShift AI 3.4 · Red Hat Build of Podman Desktop

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled processing instruction data to be serialized into XML without validating or neutralizing the PI-closing sequence ?>. As a result, an attacker can terminate the processing instruction early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

  19. CVE-2026-41673 7.5 Élevée

    xmldom · Red Hat Developer Hub 1.9 · Red Hat OpenShift AI 3.4 · Red Hat Build of Podman Desktop

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, seven recursive traversals in lib/dom.js operate without a depth limit. A sufficiently deeply nested DOM tree causes a RangeError: Maximum call stack size exceeded, crashing the application. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

  20. CVE-2026-41672 7.5 Élevée

    xmldom · Red Hat Developer Hub 1.9 · Red Hat OpenShift AI 3.4 · Red Hat Build of Podman Desktop

    xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) `DOMParser` and `XMLSerializer` module. In @xmldom/xmldom prior to versions 0.9.10 and 0.8.13 and xmldom version 0.6.0 and prior, the package allows attacker-controlled comment content to be serialized into XML without validating or neutralizing comment-breaking sequences. As a result, an attacker can terminate the comment early and inject arbitrary XML nodes into the serialized output. This issue has been patched in versions @xmldom/xmldom versions 0.9.10 and 0.8.13.

  21. CVE-2026-41142 8.8 Élevée

    AcademySoftwareFoundation openexr · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 9

    OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. From versions 3.0.0 to before 3.2.9, 3.3.0 to before 3.3.11, and 3.4.0 to before 3.4.11, there is an integer overflow in ImageChannel::resize that leads to heap OOB write via OpenEXRUtil public API. This issue has been patched in versions 3.2.9, 3.3.11, and 3.4.11.

  22. CVE-2026-40982 9.1 Critique

    Spring Cloud Config · Red Hat Enterprise Linux 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack · Vmware spring cloud config

    Spring Cloud Config allows applications to serve arbitrary text and binary files through the spring-cloud-config-server module. A malicious user, or attacker, can send a request using a specially crafted URL that can lead to a directory traversal attack. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.

  23. CVE-2026-40981 7.5 Élevée

    Spring Cloud Config · Red Hat Enterprise Linux 8 · Red Hat JBoss Enterprise Application Platform Expansion Pack · Vmware spring cloud config

    When using Google Secrets Manager as a backend for the Spring Cloud Config server a client can craft a request to the config server potentially exposing secrets from unintended GCP projects. Spring Cloud Config 3.1.x: affected from 3.1.0 through 3.1.13 (inclusive); upgrade to 3.1.14 or greater (Enterprise Support Only). Spring Cloud Config 4.1.x: affected from 4.1.0 through 4.1.9 (inclusive); upgrade to 4.1.10 or greater (Enterprise Support Only). Spring Cloud Config 4.2.x: affected from 4.2.0 through 4.2.6 (inclusive); upgrade to 4.2.7 or greater (Enterprise Support Only). Spring Cloud Config 4.3.x: affected from 4.3.0 through 4.3.2 (inclusive); upgrade to 4.3.3 or greater. Spring Cloud Config 5.0.x: affected from 5.0.0 through 5.0.2 (inclusive); upgrade to 5.0.3 or greater.