uuid before 14.0.0 can make unexpected writes when external output buffers are used, and the UUID version is 3, 5, or 6.

red hat product security vex CVE-2026-41988 updated 2026-11-06 cvss 2.8

uuid: uuid: Unexpected data writes when using external output buffers with specific UUID versions

• Red Hat Confidential Cluster Operator confidential-clusters-beta/buildroot-rhel9, confidential-clusters-beta/compute-pcrs-rhel9, confidential-clusters-beta/registration-server-rhel9, confidential-clusters-beta/attestation-key-register-rhel9, confidential-clusters-beta/confidential-cluster-rhel9-operator, confidential-clusters-beta/confidential-cluster-operator-bundle Red Hat Confidential Compute Attestation build-of-trustee/trustee-rhel9, openshift-sandboxed-containers/osc-pccs, openshift-sandboxed-containers/osc-monitor-rhel9, openshift-sandboxed-containers/osc-rhel9-operator, openshift-sandboxed-containers/osc-operator-bundle, openshift-sandboxed-containers/osc-podvm-builder-rhel9, +1 more Red Hat Cryostat 4 uuid, cryostat-openshift-console-plugin-npm Red Hat Gatekeeper 3 gatekeeper/gatekeeper-rhel9 Red Hat Lightspeed Core lightspeed-core/lightspeed-stack-rhel9, lightspeed-core/dataverse-exporter-rhel9 Red Hat Logging Subsystem for Red Hat OpenShift openshift-logging/vector-rhel9

  +34 more productsfewer

  Red Hat Migration Toolkit for Containers rhmtc/openshift-migration-ui-rhel8 Red Hat Multicluster Engine for Kubernetes multicluster-engine/console-mce-rhel9 Red Hat Node HealthCheck Operator workload-availability/node-remediation-console-rhel8, workload-availability/node-healthcheck-rhel9-operator, workload-availability/node-healthcheck-operator-bundle, workload-availability/node-healthcheck-must-gather-rhel9 Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-ocp-rag-rhel9, openshift-lightspeed/lightspeed-console-plugin-rhel9, openshift-lightspeed/lightspeed-console-plugin-419-rhel9, openshift-lightspeed/lightspeed-console-plugin-pf5-rhel9, openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-console-plugin-rhel8, openshift-pipelines/pipelines-console-plugin-rhel9 Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9, openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9, openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9, +3 more Red Hat OpenShift Service Mesh 2 openshift-service-mesh/kiali-rhel8, openshift-service-mesh/kiali-ossmc-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/kiali-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/istio-ztunnel-rhel9, openshift-service-mesh/kiali-rhel9-operator, openshift-service-mesh/kiali-operator-bundle Red Hat Pen Drive Powered by Red Hat Lightspeed pen-drive/pen-drive-scanner-rhel9 Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/console-rhel9 Red Hat Advanced Cluster Security 4 advanced-cluster-security/rhacs-fact-rhel8 Red Hat AI Inference Server rhaii-preview/vllm-cuda-rhel9 Red Hat Ansible Automation Platform 2 automation-gateway, automation-controller, automation-platform-ui, automation-eda-controller, ansible-automation-platform-26/hub-rhel9, ansible-automation-platform-26/gateway-rhel9, +17 more Red Hat Ansible Automation Platform Ansible Core 2 ansible-automation-platform/ee-minimal-rhel8, ansible-automation-platform/ee-minimal-rhel9, ansible-automation-platform-tech-preview/ee-minimal-rhel8, ansible-automation-platform-tech-preview/ee-minimal-rhel9 Red Hat build of Apache Camel - HawtIO 4 uuid Red Hat build of Apicurio Registry 2 uuid Red Hat build of Apicurio Registry 3 apicurio/apicurio-studio-ui-rhel8, apicurio/apicurio-registry-ui-rhel8 Red Hat Build of Podman Desktop rh-podman-desktop.git Red Hat Ceph Storage 9 rhceph/alloy-rhel10 Red Hat Connectivity Link 1 rhcl-1/limitador-rhel9, rhcl-1/wasm-shim-rhel9, rhcl-1/rhcl-console-plugin-rhel9 Red Hat Data Grid 8 uuid Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor Red Hat Directory Server 11 389-ds-base Red Hat Directory Server 12 389-ds-base Red Hat Directory Server 13 389-ds-base Red Hat Discovery 2 discovery/discovery-ui-rhel9, discovery/discovery-server-rhel9 Red Hat Enterprise Linux 6 uuid, uuid-c++, uuid-dce, uuid-php, uuid-perl, uuid-pgsql Red Hat Enterprise Linux 7 uuid, firefox, uuid-c++, uuid-dce, uuid-php, uuid-perl, +3 more Red Hat Enterprise Linux 8 pcs, rls, rust, uuid, cargo, clippy, +46 more Red Hat Enterprise Linux 9 gjs, pcs, rust, uuid, bootc, cargo, +60 more Red Hat Enterprise Linux 10 gjs, rust, uuid, bootc, cockpit, firefox, +21 more Red Hat Enterprise Linux AI (RHEL AI) 3 rust, rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/disk-image-cuda-rhel9 Red Hat Fuse 7 uuid Red Hat JBoss Enterprise Application Platform 7 uuid
  affected: no fix available “Fix deferred”

17 more affected, 1 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf