Kushalkhemka/embedding-cve-nvd-dataset huggingface dataset:
CVE ID: CVE-2025-32025 State: PUBLISHED Published: 2025-04-08T15:13:24.770Z Last Updated: 2025-04-08T15:37:58.737Z Vendors: bep Products: imagemeta Problem Types: CWE-770 Description: bep/imagemeta is a Go library for reading EXIF, IPTC and XMP image meta data from JPEG, TIFF, PNG, and WebP files. The buffer created for parsing metadata for PNG and WebP images was only bounded by their input data type, which could lead to potentially large memory allocation, and unreasonably high for image metadata. Before v0.11.0, If you didn't trust the input images, this could be abused to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit. Additional Analyst Notes: - CISA ADP Vulnrich
to construct denial-of-service attacks. v0.11.0 added a 10 MB upper limit. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/bep/imagemeta/security/advisories/GHSA-fmhh-rw3h-785m - https://github.com/bep/imagemeta/commit/ee0de9b029f4e82106729f69559f27c9a404229d
CVE ID: CVE-2025-32026 State: PUBLISHED Published: 2025-04-08T15:22:54.903Z Last Updated: 2025-04-08T20:02:20.297Z Severity: LOW (CVSS 3.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N) Vendors: element-hq Products: element-web Problem Types: CWE-497 Description: Element Web is a Matrix web client built using the Matrix React SDK. Element Web, starting from version 1.11.16 up to version 1.11.96, can be configured to load Element Call from an external URL. Under certain conditions, the external page is able to get access to the media encryption keys used for an Element Call call. Version 1.11.97 fixes the problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.
all. Version 1.11.97 fixes the problem. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/element-hq/element-web/security/advisories/GHSA-69q3-jg79-cg79
CVE ID: CVE-2025-32027 State: PUBLISHED Published: 2025-04-10T14:32:31.116Z Last Updated: 2025-04-10T14:54:23.272Z Severity: MEDIUM (CVSS 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) Vendors: yiisoft Products: yii Problem Types: CWE-79, CWE-80 Description: Yii is an open source PHP web framework. Prior to 1.1.31, yiisoft/yii is vulnerable to Reflected XSS in specific scenarios where the fallback error renderer is used. Upgrade yiisoft/yii to version 1.1.31 or higher. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/yiisoft/yii/security/advisories/GHSA-7r2v-8wxr-3ch5 - https://github.com/yiisoft/yii/commit/d386d737861c9014269b7ed8c36c65eadb387368
CVE ID: CVE-2025-32028 State: PUBLISHED Published: 2025-04-08T16:06:33.976Z Last Updated: 2025-04-08T20:00:56.916Z Severity: CRITICAL (CVSS 10 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) Vendors: haxtheweb Products: issues Problem Types: CWE-434 Description: HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail c
y blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/haxtheweb/issues/security/advisories/GHSA-vj5q-3jv2-cg5p
CVE ID: CVE-2025-32029 State: PUBLISHED Published: 2025-04-07T20:13:48.176Z Last Updated: 2025-04-08T13:38:23.695Z Vendors: ApelegHQ Products: ts-asn1-der Problem Types: CWE-835, CWE-1335 Description: ts-asn1-der is a collection of utility classes to encode ASN.1 data following DER rule. Incorrect number DER encoding can lead to denial on service for absolute values in the range 2**31 -- 2**32 - 1. The arithmetic in the numBitLen didn't take into account that values in this range could result in a negative result upon applying the >> operator, leading to an infinite loop. The issue is patched in version 1.0.4. If upgrading is not an option, the issue can be mitigated by validating inputs to
he issue is patched in version 1.0.4. If upgrading is not an option, the issue can be mitigated by validating inputs to Asn1Integer to ensure that they are not smaller than -2**31 + 1 and no larger than 2**31 - 1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/ApelegHQ/ts-asn1-der/security/advisories/GHSA-p4qw-7j9g-5h53 - https://github.com/ApelegHQ/ts-asn1-der/commit/b2bc9032cbe19755d234a27d79e47a7e52993af8
CVE ID: CVE-2025-32030 State: PUBLISHED Published: 2025-04-07T20:38:59.654Z Last Updated: 2025-04-08T18:25:01.371Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: federation Problem Types: CWE-770 Description: Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usa
Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/federation/security/advisories/GHSA-q2f9-x4p4-7xmh - https://github.com/apollographql/federation/pull/3236 - https://github.com/apollographql/federation/releases/tag/%40apollo%2Fgateway%402.10.1
CVE ID: CVE-2025-32031 State: PUBLISHED Published: 2025-04-07T20:41:35.767Z Last Updated: 2025-04-08T14:52:34.948Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: federation Problem Types: CWE-770 Description: Apollo Gateway provides utilities for combining multiple GraphQL microservices into a single GraphQL endpoint. Prior to 2.10.1, a vulnerability in Apollo Gateway allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable
ing frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can render gateway inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in @apollo/gateway version 2.10.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/federation/security/advisories/G
Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/federation/security/advisories/GHSA-p2q6-pwh5-m6jr - https://github.com/apollographql/federation/pull/3236 - https://github.com/apollographql/federation/releases/tag/%40apollo%2Fgateway%402.10.1
CVE ID: CVE-2025-32032 State: PUBLISHED Published: 2025-04-07T20:44:30.050Z Last Updated: 2025-04-08T14:52:25.565Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: router Problem Types: CWE-770 Description: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. A vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically due to internal optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up plannin
optimizations being frequently bypassed. The query planner includes an optimization that significantly speeds up planning for applicable GraphQL selections. However, queries with deeply nested and reused named fragments can generate many selections where this optimization does not apply, leading to significantly longer planning times. Because the query planner does not enforce a timeout, a small number of such queries can exhaust router's thread pool, rendering it inoperable. This could lead to excessive resource consumption and denial of service. This has been remediated in apollo-router versions 1.61.2 and 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://gith
n apollo-router versions 1.61.2 and 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/router/security/advisories/GHSA-94hh-jmq8-2fgp - https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564 - https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952
CVE ID: CVE-2025-32033 State: PUBLISHED Published: 2025-04-07T20:48:19.504Z Last Updated: 2025-04-08T13:31:44.219Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: router Problem Types: CWE-119 Description: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, the operation limits plugin uses unsigned 32-bit integers to track limit counters (e.g. for a query's height). If a counter exceeded the maximum value for this data type (4,294,967,295), it wrapped around to 0, unintentionally allowing queries to bypass configur
um value for this data type (4,294,967,295), it wrapped around to 0, unintentionally allowing queries to bypass configured thresholds. This could occur for large queries if the payload limit were sufficiently increased, but could also occur for small queries with deeply nested and reused named fragments. This has been remediated in apollo-router versions 1.61.2 and 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/router/security/advisories/GHSA-84m6-5m72-45fp - https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564 - https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952
CVE ID: CVE-2025-32034 State: PUBLISHED Published: 2025-04-07T20:50:29.690Z Last Updated: 2025-04-08T13:30:44.951Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: apollographql Products: router Problem Types: CWE-770 Description: The Apollo Router Core is a configurable, high-performance graph router written in Rust to run a federated supergraph that uses Apollo Federation 2. Prior to 1.61.2 and 2.1.1, a vulnerability in Apollo Router allowed queries with deeply nested and reused named fragments to be prohibitively expensive to query plan, specifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query pl
ecifically during named fragment expansion. Named fragments were being expanded once per fragment spread during query planning, leading to exponential resource usage when deeply nested and reused fragments were involved. This could lead to excessive resource consumption and denial of service. This has been remediated in apollo-router versions 1.61.2 and 2.1.1. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/apollographql/router/security/advisories/GHSA-75m2-jhh5-j5g2 - https://github.com/apollographql/router/commit/ab6675a63174715ea6ff50881fc957831d4e9564 - https://github.com/apollographql/router/commit/bba032e183b861348a466d3123c7137a1ae18952
CVE ID: CVE-2025-32035 State: PUBLISHED Published: 2025-04-08T18:00:41.460Z Last Updated: 2025-04-08T18:27:55.670Z Severity: LOW (CVSS 2.6 CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-351 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. Prior to 9.13.2, when uploading files (e.g. when uploading assets), the file extension is checked to see if it's an allowed file type but the actual contents of the file aren't checked. This means that it's possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security
s possible to e.g. upload an executable file renamed to be a .jpg. This file could then be executed by another security vulnerability. This vulnerability is fixed in 9.13.2. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-8q89-mqw7-9pp7 - https://github.com/dnnsoftware/Dnn.Platform/commit/a5c13c3836cfbde374dc19dac032cd51af41050a
CVE ID: CVE-2025-32036 State: PUBLISHED Published: 2025-04-08T18:06:49.961Z Last Updated: 2025-04-08T18:27:18.463Z Severity: MEDIUM (CVSS 4.2 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) Vendors: dnnsoftware Products: Dnn.Platform Problem Types: CWE-804 Description: DNN (formerly DotNetNuke) is an open-source web content management platform (CMS) in the Microsoft ecosystem. The algorithm used to generate the captcha image shows the least complexity of the desired image. For this reason, the created image can be easily read by OCR tools, and the intruder can send automatic requests by building a robot and using this tool. This vulnerability is fixed in 9.13.8. Additional Analyst Notes: - CIS
requests by building a robot and using this tool. This vulnerability is fixed in 9.13.8. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://github.com/dnnsoftware/Dnn.Platform/security/advisories/GHSA-48q9-3p26-8595 - https://github.com/dnnsoftware/Dnn.Platform/commit/abda726e75f1938c8d89795b5dceb80dc4e2e6c5
CVE ID: CVE-2025-32037 State: PUBLISHED Published: 2025-11-11T16:50:57.011Z Last Updated: 2025-11-17T16:09:58.478Z Severity: LOW (CVSS 2 CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:L) Vendors: n/a Products: Intel(R) PresentMon Problem Types: Denial of Service, CWE-284 Description: Improper access control for some Intel(R) PresentMon before version 2.3.1 within Ring 3: User Applications may allow a denial of service. Network adversary with a privileged user combined with a high complexity attack may enable denial of service. This result may potentially occur via adjacent access when attack requirements are not present without special internal knowledge and requires no user interaction. The pot
ss when attack requirements are not present without special internal knowledge and requires no user interaction. The potential vulnerability may impact the confidentiality (none), integrity (none) and availability (low) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01392.html
CVE ID: CVE-2025-32038 State: PUBLISHED Published: 2025-11-11T16:50:59.446Z Last Updated: 2025-11-13T04:55:39.875Z Severity: MEDIUM (CVSS 6.7 CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H) Vendors: n/a Products: Intel oneAPI DPC++C++ Compiler software Problem Types: Escalation of Privilege, CWE-427 Description: Uncontrolled search path for some FPGA Support Package for the Intel oneAPI DPC++C++ Compiler software before version 2025.0.1 within Ring 3: User Applications may allow an escalation of privilege. Unprivileged software adversary with an authenticated user combined with a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when
th a high complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires active user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://intel.com/content/www/us/en/security-center/advisory/intel-sa-01364.html
CVE ID: CVE-2025-32044 State: PUBLISHED Published: 2025-04-25T14:43:22.142Z Last Updated: 2025-04-25T15:54:57.173Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) Problem Types: CWE-200 Description: A flaw has been identified in Moodle where, on certain sites, unauthenticated users could retrieve sensitive user data—including names, contact information, and hashed passwords—via stack traces returned by specific API calls. Sites with PHP configured with zend.exception_ignore_args = 1 in the php.ini file are not affected by this vulnerability. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-32044 - https://
l Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-32044 - https://bugzilla.redhat.com/show_bug.cgi?id=2356829
CVE ID: CVE-2025-32045 State: PUBLISHED Published: 2025-04-25T14:43:54.071Z Last Updated: 2025-04-25T15:54:49.153Z Severity: MEDIUM (CVSS 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) Problem Types: CWE-862 Description: A flaw has been identified in Moodle where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades. Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-32045 - https://bugzilla.redhat.com/show_bug.cgi?id=2356835
CVE ID: CVE-2025-32049 State: PUBLISHED Published: 2025-04-03T13:36:13.035Z Last Updated: 2025-11-18T08:36:53.872Z Severity: HIGH (CVSS 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Suppor
ice, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 6 Problem Types: CWE-770 Description: A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:21657 - https://access.redhat
t Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/errata/RHSA-2025:21657 - https://access.redhat.com/errata/RHSA-2025:8126 - https://access.redhat.com/errata/RHSA-2025:8128 - https://access.redhat.com/errata/RHSA-2025:8132 - https://access.redhat.com/errata/RHSA-2025:8139 - https://access.redhat.com/errata/RHSA-2025:8140 - https://access.redhat.com/errata/RHSA-2025:8252 - https://access.redhat.com/errata/RHSA-2025:8480 - https://access.redhat.com/errata/RHSA-2025:8481 - https://access.redhat.com/errata/RHSA-2025:8482 - https://access.redhat.com/errata/RHSA-2025:8663 - https://access.redhat.com/errata/RHSA-2025:9179 - https://access.redhat.com/security/cve/CVE-2025-320
a/RHSA-2025:8663 - https://access.redhat.com/errata/RHSA-2025:9179 - https://access.redhat.com/security/cve/CVE-2025-32049 - https://bugzilla.redhat.com/show_bug.cgi?id=2357066
CVE ID: CVE-2025-32050 State: PUBLISHED Published: 2025-04-03T13:36:29.141Z Last Updated: 2025-11-06T23:08:05.131Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-127 Description: A flaw was found in libsoup. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read. Additional An
. The libsoup append_param_quoted() function may contain an overflow bug resulting in a buffer under-read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:4440 - https://access.redhat.com/errata/RHSA-2025:4508 - https://access.redhat.com/errata/RHSA-2025:4560 - https://access.redhat.com/errata/RHSA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:7436 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/security/cve/CVE-2025-32050 - https://bugzilla.redhat.com/show_bug.cgi?id=2357067
CVE ID: CVE-2025-32051 State: PUBLISHED Published: 2025-04-03T13:36:50.776Z Last Updated: 2025-11-20T20:45:29.766Z Severity: MEDIUM (CVSS 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) Vendors: Red Hat Products: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9 Problem Types: CWE-754 Description: A flaw was found in libsoup. The libsoup soup_uri_decode_data_uri() function may crash when processing malformed data URI. This flaw allows an attacker to cause a denial of service (DoS). Additional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-32051 -
dditional Analyst Notes: - CISA ADP Vulnrichment: References: - https://access.redhat.com/security/cve/CVE-2025-32051 - https://bugzilla.redhat.com/show_bug.cgi?id=2357068
CVE ID: CVE-2025-32052 State: PUBLISHED Published: 2025-04-03T13:37:23.109Z Last Updated: 2025-11-06T23:08:08.159Z Severity: MEDIUM (CVSS 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L) Vendors: Red Hat Products: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.8 Extended Update Support, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Extended Update Support, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Problem Types: CWE-126 Description: A flaw was found in libsoup. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. Additional Analyst Notes: - CISA AD
. A vulnerability in the sniff_unknown() function may lead to heap buffer over-read. Additional Analyst Notes: - CISA ADP Vulnrichment: - CVE Program Container: References: - https://access.redhat.com/errata/RHSA-2025:4440 - https://access.redhat.com/errata/RHSA-2025:4508 - https://access.redhat.com/errata/RHSA-2025:4560 - https://access.redhat.com/errata/RHSA-2025:4568 - https://access.redhat.com/errata/RHSA-2025:7436 - https://access.redhat.com/errata/RHSA-2025:8292 - https://access.redhat.com/security/cve/CVE-2025-32052 - https://bugzilla.redhat.com/show_bug.cgi?id=2357069