huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Traefik: Denial of Service via stalled STARTTLS requests
CVE: CVE-2026-25949
Component: github.com/traefik/traefik
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-12T20:01:19.600000+00:00

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. An unauthenticated client can exploit this vulnerability by sending a specific 8-byte Postgres SSLRequest (STARTTLS) prelude and then intentionally delaying further communication. This action bypasses Traefik's configured read timeouts, causing connections to remain open indefinitely. The primary consequence is a Denial of Service, as the server's resources become exhausted by these persistent, non-responsive connections.

Statement: This is an IMPORTANT denial of service flaw in Traefik, an HTTP reverse proxy and load balancer, affecting Red Hat OpenShift Dev Spaces. An unauthenticated client can exploit this by sending a specific STARTTLS request and then stalling, which bypasses configured read timeouts and causes connections to remain open indefinitely, leading to resource exhaustion.

Remediation:
drm/amdgpu/userq: Fix fence reference leak on queue teardown v2
CVE: CVE-2026-23034
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu/userq: Fix fence reference leak on queue teardown v2

The user mode queue keeps a pointer to the most recent fence in
userq->last_fence. This pointer holds an extra dma_fence reference.

When the queue is destroyed, we free the fence driver and its xarray,
but we forgot to drop the last_fence reference.

Because of the missing dma_fence_put(), the last fence object can stay
alive when the driver unloads. This leaves an allocated object in the
amdgpu_userq_fence slab cache and triggers

This is visible during driver unload as:

  BUG amdgpu_userq_fence: Objects remaining on __kmem_cache_shutdown()
  kmem_cache_destroy amdgpu_userq_fence: Slab cache still has objects
  Call Trace:
    kmem_cache_destroy
    amdgpu_userq_fence_slab_fini
    amdgpu_exit
    __do_sys_delete_module

Fix this by putting userq->last_fence and clearing the pointer during
amdgpu_userq_fence_driver_free().

This makes sure the fence reference is released and the slab cache is
empty when the module exits.

v2: Update to only release userq->last_fence with dma_fence_put()
    (Christian)

(cherry picked from commit 8e051e38a8d45caf6a866d4ff842105b577953bb)


Remediation:
GStreamer: Remote Code Execution via integer underflow in H.266 Codec Parser
CVE: CVE-2026-3084
Component: GStreamer
CWE: CWE-191
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:42:03.443000+00:00

A flaw was found in GStreamer. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GStreamer. The issue stems from an integer underflow during the parsing of H.266 video codec picture partitions, caused by insufficient validation of user-supplied data. Successful exploitation can lead to remote code execution in the context of the current process.

Statement: IMPORTANT: This vulnerability in GStreamer's H.266 codec parser could lead to remote code execution due to an integer underflow when processing specially crafted H.266 media files. Red Hat Enterprise Linux systems are affected if they process untrusted H.266 content, as exploitation requires user interaction with such a file.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Linux kernel: Use-after-free in bonding module can cause system crash or arbitrary code execution
CVE: CVE-2026-23171
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 6.8/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's bonding module. This use-after-free vulnerability occurs when a new slave device is added to the bonding array but fails during the enslave process. A local attacker can exploit this by triggering the enslave failure, which may lead to a system crash, resulting in a Denial of Service (DoS), or potentially allow for arbitrary code execution.


Remediation:
To mitigate this issue, prevent the `bonding` kernel module from loading if bonding interfaces are not required. This can be achieved by creating a modprobe configuration file.

Create a file named `/etc/modprobe.d/disable-bonding.conf` with the following content:
`install bonding /bin/true`

After creating the file, a system reboot is required for the change to take effect if the module is currently loaded. This action will prevent the creation and use of bonding network interfaces.
Gradio: Information disclosure via absolute path traversal
CVE: CVE-2026-28414
Component: gradio
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-27T21:43:28.453000+00:00

A flaw was found in Gradio. When running on Windows with Python 3.13 or later, an absolute path traversal vulnerability allows unauthenticated attackers to read arbitrary files from the file system. This occurs because a change in Python's `os.path.isabs` definition causes Gradio's path joining logic to mishandle root-relative paths. This vulnerability can lead to significant information disclosure.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: liquidio: Initialize netdev pointer before queue setup
CVE: CVE-2026-23258
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Authlib: Signature verification bypass via malicious JWT allows unauthorized access
CVE: CVE-2026-28802
Component: authlib
CWE: CWE-347
Severity: Important
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-06T06:44:26.402000+00:00

A flaw was found in Authlib, a Python library for building OAuth and OpenID Connect servers. A remote attacker can exploit this vulnerability by crafting a malicious JSON Web Token (JWT) with a "none" algorithm and an empty signature. This bypasses the expected signature verification, potentially allowing the attacker to forge tokens and gain unauthorized access or perform unauthorized actions within applications using Authlib.


Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
thunderbird: Spoofing issue in the WebAuthn component in Firefox for Android
CVE: CVE-2026-2800
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:29.312000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Spoofing issue in the WebAuthn component in Firefox for Android

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
sigstore/cosign: Incorrect signature validation due to expired issuing certificate bypass
CVE: CVE-2026-24122
Component: sigstore/cosign
CWE: CWE-295
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-02-19T22:27:08.828000+00:00

A flaw was found in sigstore/cosign. This vulnerability affects private deployments using customized Public Key Infrastructures (PKIs), where it can lead to incorrect validation of artifact signatures. Cosign may mistakenly accept an issuing certificate as valid even if its expiration date precedes the leaf certificate's, potentially allowing invalid signatures to be trusted. This could compromise the integrity of signature verification in affected environments.


Remediation:
thunderbird: Use-after-free in the DOM: Window and Location component
CVE: CVE-2026-2787
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:19.579000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the DOM: Window and Location component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Argo Workflows: Privilege escalation and information disclosure via stored Cross-Site Scripting (XSS)
CVE: CVE-2026-23960
Component: argo-workflows
CWE: CWE-79
Severity: Important
CVSS v3: 7.2/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-21T22:02:50.491000+00:00

A flaw was found in Argo Workflows, an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. This stored Cross-Site Scripting (XSS) vulnerability in the artifact directory listing allows any workflow author to execute unauthorized JavaScript code in another user's web browser. This can lead to the compromise of the victim's session and enable an attacker to perform actions with the victim's privileges, potentially resulting in information disclosure or privilege escalation within the Argo Server environment.

Statement: This is an IMPORTANT vulnerability. A stored Cross-Site Scripting (XSS) flaw in Argo Workflows' artifact directory listing allows a workflow author to execute arbitrary JavaScript in another user's browser. This could lead to privilege escalation and information disclosure within Red Hat OpenShift AI, as an attacker could perform actions with the victim's privileges.

Remediation:
virtio-snd: integer overflow leading to unbounded memory allocation
CVE: CVE-2026-3196
Component: qemu-kvm
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-20T00:00:00+00:00

An integer overflow vulnerability was found in the virtio-snd device via PCM_INFO requests from the guest. A malicious guest can provide out-of-bounds stream counts, potentially leading to unbounded memory allocation on the host and a denial of service condition.

Statement: The `qemu-kvm` packages as shipped with Red Hat Enterprise Linux are not affected by this CVE. The virtio-snd device is disabled at build-time in RHEL, effectively removing the attack surface.

Remediation:
uacce: ensure safe queue release with state management
CVE: CVE-2026-23063
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

uacce: ensure safe queue release with state management

Directly calling `put_queue` carries risks since it cannot
guarantee that resources of `uacce_queue` have been fully released
beforehand. So adding a `stop_queue` operation for the
UACCE_CMD_PUT_Q command and leaving the `put_queue` operation to
the final resource release ensures safety.

Queue states are defined as follows:
- UACCE_Q_ZOMBIE: Initial state
- UACCE_Q_INIT: After opening `uacce`
- UACCE_Q_STARTED: After `start` is issued via `ioctl`

When executing `poweroff -f` in virt while accelerator are still
working, `uacce_fops_release` and `uacce_remove` may execute
concurrently. This can cause `uacce_put_queue` within
`uacce_fops_release` to access a NULL `ops` pointer. Therefore, add
state checks to prevent accessing freed pointers.


Remediation:
Linux kernel: Denial of Service in netdevsim due to race condition in BPF program list operations
CVE: CVE-2026-23126
Component: kernel
CWE: CWE-820
Severity: Moderate
CVSS v3: 6.3/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel. The netdevsim driver lacks proper protection for operations on the bpf_bound_progs list. A local user could exploit a race condition when bpf_bound_progs list operations are performed concurrently. This could lead to list corruption and trigger a kernel crash, resulting in a Denial of Service (DoS).


Remediation:
quickjs-ng: Use-after-free vulnerability in Atomics Ops Handler
CVE: CVE-2026-1144
Component: quickjs-ng
CVSS v3: 6.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-01-19T07:32:10.363000+00:00

A flaw was found in quickjs-ng. A remote attacker could exploit a use-after-free vulnerability within the Atomics Ops Handler component, specifically in the quickjs.c file. This manipulation could lead to arbitrary code execution, information disclosure, or a denial of service. The exploit for this vulnerability is publicly available.

Statement: This vulnerability is rated Important for Red Hat. A use-after-free flaw in the quickjs-ng JavaScript engine's Atomics Ops handler can be exploited remotely. If quickjs-ng is used in a Red Hat product, this could lead to arbitrary code execution. The exploit is publicly available.

Remediation:
CVE: CVE-2026-0755
Component: gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:17:16.515000+00:00

gemini-mcp-tool execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of gemini-mcp-tool. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the implementation of the execAsync method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27783.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Sandbox escape in the Storage: IndexedDB component
CVE: CVE-2026-2768
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:06.258000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape in the Storage: IndexedDB component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
thunderbird: Use-after-free in the JavaScript: GC component
CVE: CVE-2026-0885
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-13T13:30:56.939000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the JavaScript: GC component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Use after free in CSS
CVE: CVE-2026-2441
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-13T00:00:00+00:00

Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak
CVE: CVE-2026-23075
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: esd_usb: esd_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").

In esd_usb_open(), the URBs for USB-in transfers are allocated, added to
the dev->rx_submitted anchor and submitted. In the complete callback
esd_usb_read_bulk_callback(), the URBs are processed and resubmitted. In
esd_usb_close() the URBs are freed by calling
usb_kill_anchored_urbs(&dev->rx_submitted).

However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in esd_usb_close().

Fix the memory leak by anchoring the URB in the
esd_usb_read_bulk_callback() to the dev->rx_submitted anchor.


Remediation:
Side-channel information leakage in ResourceTiming
CVE: CVE-2026-3929
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-10T00:00:00+00:00

A side-channel information leakage flaw was found in the ResourceTiming component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=477180001

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
thunderbird: Mitigation bypass in the Networking: Cache component
CVE: CVE-2026-2791
Component: firefox
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-02-24T13:33:22.237000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Mitigation bypass in the Networking: Cache component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ESPHome: Denial of Service via integer overflow in API protobuf decoder
CVE: CVE-2026-23833
Component: ESPHome
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-19T17:58:50.499000+00:00

A flaw was found in ESPHome. An integer overflow vulnerability exists in the API component's protobuf decoder. A remote attacker can exploit this by sending a specially crafted, large field_length value, which bypasses a bounds check. This can lead to a denial-of-service (DoS) condition, causing the affected device to crash. This attack can be performed without authentication if API encryption is not utilized.

Statement: This vulnerability is rated Low for Red Hat. The flaw in ESPHome's API component, affecting `python-aioesphomeapi` in Fedora 42, can lead to a denial of service. Exploitation requires the API encryption to be disabled; if encryption is enabled, knowledge of the encryption key is necessary.

Remediation:
wifi: ath12k: fix dead lock while flushing management frames
CVE: CVE-2026-23130
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: ath12k: fix dead lock while flushing management frames

Commit [1] converted the management transmission work item into a
wiphy work. Since a wiphy work can only run under wiphy lock
protection, a race condition happens in below scenario:

1. a management frame is queued for transmission.
2. ath12k_mac_op_flush() gets called to flush pending frames associated
   with the hardware (i.e, vif being NULL). Then in ath12k_mac_flush()
   the process waits for the transmission done.
3. Since wiphy lock has been taken by the flush process, the transmission
   work item has no chance to run, hence the dead lock.

>From user view, this dead lock results in below issue:

 wlp8s0: authenticate with xxxxxx (local address=xxxxxx)
 wlp8s0: send auth to xxxxxx (try 1/3)
 wlp8s0: authenticate with xxxxxx (local address=xxxxxx)
 wlp8s0: send auth to xxxxxx (try 1/3)
 wlp8s0: authenticated
 wlp8s0: associate with xxxxxx (try 1/3)
 wlp8s0: aborting association with xxxxxx by local choice (Reason: 3=DEAUTH_LEAVING)
 ath12k_pci 0000:08:00.0: failed to flush mgmt transmit queue, mgmt pkts pending 1

The dead lock can be avoided by invoking wiphy_work_flush() to proactively
run the queued work item. Note actually it is already present in
ath12k_mac_op_flush(), however it does not protect the case where vif
being NULL. Hence move it ahead to cover this case as well.

Tested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c5-00302-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1.115823.3

Statement: A deadlock can occur in the ath12k management frame transmit flush path after the driver converted its management transmit worker into a wiphy work item. A wiphy work item can only execute while holding the wiphy lock. The flush operation takes the wiphy lock and then waits for pending management frame transmissions to complete. In the hardware wide flush case where vif is NULL the code previously did not flush the queued wiphy work before entering the wait loop. Because the wiphy lock is held by the flushing thread the management transmit work cannot run. As a result the pending management packet never completes and the flush waits indefinitely. This manifests as connection failures and timeouts with management packets stuck in the transmit queue. This ensures that queued management transmit work is proactively executed and the flush can observe completion. The impact is primarily denial of service of the wireless interface due to a driver hang.

Remediation:
ImageMagick: Denial of Service via crafted image due to memory leak
CVE: CVE-2026-25637
Component: ImageMagick
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T00:48:37.892000+00:00

A flaw was found in ImageMagick. A remote attacker can exploit a memory leak in the ASHLAR image writer by providing a specially crafted image. This vulnerability causes small objects to be allocated but never freed, leading to the exhaustion of process memory and a Denial of Service (DoS).

Statement: The impact of this flaw is MODERATE. A memory leak in the ASHLAR image writer component of ImageMagick can be triggered by processing a specially crafted image. This could lead to resource exhaustion and denial of service. This affects Red Hat Enterprise Linux 6 ELS and 7 ELS.

Remediation:
To mitigate this issue, restrict ImageMagick's processing of untrusted or unverified image files. Where possible, process images from unverified sources within a sandboxed environment to contain potential resource exhaustion. Additionally, ensure that applications utilizing ImageMagick implement robust input validation for all image inputs.
PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory
CVE: CVE-2026-2007
Component: postgresql
CWE: CWE-120
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-02-12T13:00:11.127000+00:00

A heap based buffer overflow has been discovered in postgresql. This heap buffer overflow is in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string.  The attacker has limited control over the byte patterns to be written, but we have not ruled out the viability of attacks that lead to privilege escalation.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.