huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
libceph: return the handler error from mon_handle_auth_done()
CVE: CVE-2026-22992
Component: kernel
CWE: CWE-252
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: return the handler error from mon_handle_auth_done()

Currently any error from ceph_auth_handle_reply_done() is propagated
via finish_auth() but isn't returned from mon_handle_auth_done().  This
results in higher layers learning that (despite the monitor considering
us to be successfully authenticated) something went wrong in the
authentication phase and reacting accordingly, but msgr2 still trying
to proceed with establishing the session in the background.  In the
case of secure mode this can trigger a WARN in setup_crypto() and later
lead to a NULL pointer dereference inside of prepare_auth_signature().

Statement: The monitor auth-done handler incorrectly returned success even when the authentication reply finalization reported an error, causing a state mismatch where msgr2 could continue session establishment in the background. In secure mode this can trigger a WARN and later a NULL pointer dereference in signature preparation, leading to a remote crash/DoS (network-reachable under a malicious/compromised monitor or MITM conditions).

Remediation:
Traefik: Traffic redirection and hostname bypass via unsanitized input in router rules
CVE: CVE-2026-29777
Component: github.com/traefik/traefik
CWE: CWE-94
Severity: Moderate
CVSS v3: 5.6/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-03-11T15:54:17.219000+00:00

A flaw was found in Traefik. A tenant with write access to an HTTPRoute resource can exploit this vulnerability by injecting specially crafted rule tokens into Traefik's router rule language through unsanitized header or query parameter match values. This allows the attacker to bypass listener hostname constraints in shared gateway deployments, leading to the redirection of traffic intended for legitimate hostnames to attacker-controlled backends.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libexpat null pointer dereference
CVE: CVE-2026-24515
Component: libexpat
CWE: CWE-476
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-23T07:46:36.397000+00:00

In libexpat before 2.7.4, XML_ExternalEntityParserCreate does not copy unknown encoding handler user data.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GStreamer: Remote Code Execution via out-of-bounds write in RealMedia Demuxer
CVE: CVE-2026-2922
Component: GStreamer
CWE: CWE-787
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:38:49.124000+00:00

A flaw was found in GStreamer. This vulnerability allows a remote attacker to execute arbitrary code by exploiting an out-of-bounds write in the RealMedia Demuxer component. The issue occurs due to improper validation of user-supplied data during the processing of video packets, leading to a write past the end of an allocated buffer. Successful exploitation can result in arbitrary code execution within the context of the current process.

Statement: This IMPORTANT vulnerability in the GStreamer RealMedia Demuxer allows remote attackers to execute arbitrary code. The flaw occurs due to improper validation of user-supplied data when processing video packets, leading to an out-of-bounds write. Exploitation requires user interaction with a specially crafted RealMedia file.

Remediation:
Avoid processing untrusted RealMedia files with GStreamer-enabled applications. Users should exercise caution when opening RealMedia content from unknown or untrusted sources to prevent potential exploitation.
vLLM: Server-Side Request Forgery allows internal network access
CVE: CVE-2026-24779
Component: vLLM
CWE: CWE-918
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2026-01-27T22:01:13.808000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A Server-Side Request Forgery (SSRF) vulnerability exists in the MediaConnector class, specifically within the load_from_url and load_from_url_async methods. An attacker can exploit differing interpretations of backslashes by Python parsing libraries used for host restrictions to bypass these restrictions. This allows the attacker to force the vLLM server to make arbitrary requests to internal network resources, potentially leading to information disclosure, denial of service, or unauthorized access within containerized environments.

Statement: This IMPORTANT Server-Side Request Forgery (SSRF) vulnerability in vLLM's `MediaConnector` allows an attacker to bypass host restrictions when processing user-provided URLs. This enables the vLLM server to be coerced into making arbitrary requests to internal network resources. This is critical in containerized deployments, including Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI, where it could facilitate internal network reconnaissance and unauthorized access to other services.

Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
To mitigate this issue, restrict network access to the vLLM service to only trusted clients. Implement strict network segmentation for vLLM pods in containerized environments to limit potential lateral movement. Ensure that vLLM instances are not exposed to untrusted external networks without proper access controls and input validation at the perimeter.
Kernel: Local denial of service via incorrect VPU power management on i.MX8MQ
CVE: CVE-2026-23116
Component: kernel
CWE: CWE-667
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel. On i.MX8MQ platforms, the Video Processing Unit (VPU) power management incorrectly attempts to reset or ungate VPU instances independently. This invalid hardware sequence can be triggered by a local user through driver operations, runtime power management, or multimedia usage. Successful exploitation leads to a full system hang, resulting in a local Denial of Service (DoS).

Statement: On i.MX8MQ the VPUMIX domain ADB block does not provide separate reset and clock enable bits per VPU instance. The previous power domain data defined per domain rst_mask and clk_mask values for vpublk g1 and vpublk g2. As a result the kernel could attempt to reset or ungate one VPU independently. That hardware sequence is invalid on i.MX8MQ and can lead to a full system hang. This is an availability issue that can be triggered by local activity that causes VPU power management transitions. Such activity can be reached through driver probe and remove. Runtime PM operations. Or higher level multimedia usage that toggles VPU domains. The patch removes the per domain rst_mask and clk_mask so the generic block control code will not try to reset or clock gate G1 or G2 separately. Instead the existing imx8mq_vpu_power_notifier is relied on to perform the correct combined VPU reset sequence. The main impact is preventing a local denial of service on affected embedded systems.

Remediation:
thunderbird: Use-after-free in the JavaScript: GC component
CVE: CVE-2026-2758
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:32:58.501000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the JavaScript: GC component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
CVE: CVE-2026-0765
Component: Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:36:02.245000+00:00

Open WebUI PIP install_frontmatter_requirements Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Open WebUI. Authentication is required to exploit this vulnerability.

The specific flaw exists within the install_frontmatter_requirements function.The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28258.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
tar: node-tar: Arbitrary file overwrite via Unicode path collision race condition
CVE: CVE-2026-23950
Component: node-tar
CWE: CWE-367
Severity: Important
CVSS v3: 8.8/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L
Release date: 2026-01-20T00:40:48.510000+00:00

A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the `path-reservations` system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially crafted tar archive containing filenames that cause these collisions, bypassing internal concurrency safeguards. Successful exploitation can lead to arbitrary file overwrite.

Statement: This vulnerability is rated Important for Red Hat products. The `node-tar` library is susceptible to a race condition due to incomplete handling of Unicode path collisions, which can lead to arbitrary file overwrites via symlink poisoning. However, this issue primarily affects case-insensitive or normalization-insensitive filesystems. Red Hat Enterprise Linux and other Red Hat products typically utilize case-sensitive filesystems, which may limit the direct impact of this flaw in default configurations.

Remediation:
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Exiv2: Denial of service via out-of-bounds read in CRW image parser
CVE: CVE-2026-25884
Component: Exiv2
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-02T19:41:21.157000+00:00

Exiv2 is a C++ library and a command-line utility to read, write, delete and modify Exif, IPTC, XMP and ICC image metadata. Prior to version 0.28.8, an out-of-bounds read was found. The vulnerability is in the CRW image parser. This issue has been patched in version 0.28.8.

Statement: This LOW impact vulnerability in Exiv2, an image metadata library, involves an out-of-bounds read within its CRW image parser. Exploitation requires processing a specially crafted CRW image file.

Remediation:
Linux kernel: Denial of Service in NFSv4.1 client due to deadlock during memory reclaim
CVE: CVE-2026-23053
Component: kernel
CWE: CWE-400
Severity: Moderate
CVSS v3: 5.2/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

NFS: Fix a deadlock involving nfs_release_folio()

Wang Zhaolong reports a deadlock involving NFSv4.1 state recovery
waiting on kthreadd, which is attempting to reclaim memory by calling
nfs_release_folio(). The latter cannot make progress due to state
recovery being needed.

It seems that the only safe thing to do here is to kick off a writeback
of the folio, without waiting for completion, or else kicking off an
asynchronous commit.

Statement: An NFSv4.1 client can deadlock during memory reclaim because state recovery may wait on kthreadd while kthreadd attempts to reclaim memory by calling nfs_release_folio. The release path may require recovery to make progress, so the two paths can block each other and lead to hung tasks and system wide stalls. For the CVSS the PR is N because normal users can trigger page cache activity on an NFS mount and memory pressure can occur without special privileges. The issue is not directly network reachable. A remote or unstable server can influence recovery timing but the deadlock manifests on the client under local reclaim conditions. Impact is denial of service due to hung reclaim and stalled NFS operations.

Remediation:
FreeRDP: Denial of Service via double free vulnerability during disconnect
CVE: CVE-2026-26986
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-25T21:01:16.916000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `rail_window_free` dereferences a freed `xfAppWindow` pointer during `HashTable_Free` cleanup because `xf_rail_window_common` calls `free(appWindow)` on title allocation failure without first removing the entry from the `railWindows` hash table, leaving a dangling pointer that is freed again on disconnect. Version 3.23.0 fixes the vulnerability.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Caddy: Information disclosure via double-expansion of user-controlled input
CVE: CVE-2026-30852
Component: github.com/caddyserver/caddy/v2/modules/caddyhttp
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-07T16:28:26.894000+00:00

Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASE_URL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. This issue has been patched in version 2.11.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
LIBPNG has a heap buffer overflow in png_set_quantize
CVE: CVE-2026-25646
Component: libpng
CWE: CWE-125
Severity: Important
CVSS v3: 6.9/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-10T17:04:38.501000+00:00

A heap based buffer overflow flaw has been discovered in LibPNG. Prior to version 1.6.55, an out-of-bounds read vulnerability exists in the png_set_quantize() API function. When the function is called with no histogram and the number of colors in the palette is more than twice the maximum supported by the user's display, certain palettes will cause the function to enter into an infinite loop that reads past the end of an internal heap-allocated buffer. The images that trigger this vulnerability are valid per the PNG specification.

Statement: For `java-17-openjdk-headless` and `java-21-openjdk-headless`, while the affected code is present in the bundled sources, it is not exercised by these headless packages.

Remediation:
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Use after free in Extensions
CVE: CVE-2026-4458
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An use after free flaw was found in the Extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=489619753

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
apparmor: fix unprivileged local user can do privileged policy management
CVE: CVE-2026-23268
Component: kernel
Severity: None
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Inspektor Gadget uses unsanitized ANSI Escape Sequences In `columns` Output Mode
CVE: CVE-2026-25996
Component: inspektor-gadget
CVSS v3: 4.6/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N
Release date: 2026-02-12T20:06:58.709000+00:00

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. String fields from eBPF events in columns output mode are rendered to the terminal without any sanitization of control characters or ANSI escape sequences. Therefore, a maliciously forged – partially or completely – event payload, coming from an observed container, might inject the escape sequences into the terminal of ig operators, with various effects. The columns output mode is the default when running ig run interactively.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
FreeRDP has a Heap-use-after-free in play_thread
CVE: CVE-2026-24684
Component: freerdp
CWE: CWE-131
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:23:02.882000+00:00

A heap use after free has been discovered in FreeRDP. The RDPSND async playback thread can process queued PDUs after the channel is closed and internal state is freed, leading to a use after free in rdpsnd_treat_wave.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
btrfs: send: check for inline extents in range_is_hole_in_parent()
CVE: CVE-2026-23141
Component: kernel
CWE: CWE-125
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's btrfs filesystem send functionality. In the range_is_hole_in_parent() function, the code accesses the disk_bytenr field of a file extent item without first checking if it is an inline extent. For inline extents, the data begins at the disk_bytenr field offset, so accessing it as a disk address reads inline data incorrectly. If the inline data is less than 8 bytes and the extent is the first item in a leaf, this can cause an invalid memory access.

Statement: This flaw affects btrfs send operations when processing filesystems containing inline extents with specific layouts. The issue requires a crafted or unusual btrfs filesystem structure to trigger. Systems not using btrfs or not performing send operations are unaffected.

Remediation:
Vaultwarden: Two-factor authentication bypass allows unauthorized access and data deletion.
CVE: CVE-2026-27801
Component: vaultwarden
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-04T21:32:14.614000+00:00

A flaw was found in Vaultwarden. An authenticated attacker could bypass two-factor authentication (2FA) to perform sensitive actions. This bypass allows the attacker to access a user's API key or delete a user's vault and associated organizations where the user is an administrator or owner. This vulnerability could lead to unauthorized data manipulation and loss.

Statement: This MODERATE vulnerability allows an authenticated attacker to bypass 2FA for protected actions via faulty rate limiting. Exploitation requires network access and low privileges (valid account). Impact includes high confidentiality loss (API key exposure), high integrity loss (vault/org deletion), and high availability loss (data destruction). Red Hat ships Vaultwarden in its community products.

Remediation:
tracing denial of service via event flooding
CVE: CVE-2026-31890
Component: inspektor-gadget
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-12T17:35:02.129000+00:00

A flaw was found in Inspektor Gadget. The transfer mechanism of data from eBPF programs to userspace is based on a ring-buffer on Linux kernel versions newer than or equal to 5.8. The size of the ring-buffer is hard-coded to 256KB, and when gadget_reserve_buf fails due to insufficient space, the gadget silently cleans up without producing an alert. A malicious event source (e.g., a malicious container) can exploit this to cause the system to drop legitimate events.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: