huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
jaraco.context: Path traversal via malicious tar archives
CVE: CVE-2026-23949
Component: jaraco.context
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-01-20T00:36:23.777000+00:00

A flaw was found in jaraco.context. The `jaraco.context.tarball()` function is vulnerable to a Zip Slip path traversal when processing malicious tar archives. A remote attacker can exploit this by crafting a specially designed tar file, which, when extracted, allows files to be written outside the intended directory. This could lead to arbitrary file overwrites or information disclosure on the system.

Statement: This vulnerability is rated Important for Red Hat products that utilize `jaraco.context` versions prior to 6.1.0 and process untrusted tar archives. A path traversal flaw in the `jaraco.context.tarball()` function allows attackers to extract files outside the intended directory due to improper handling of `../` sequences, including in nested tarballs. This could lead to arbitrary file write.

Remediation:
Vaadin: Arbitrary file write via path traversal during Node.js download
CVE: CVE-2026-2741
Component: Vaadin-Flow
CWE: CWE-22
Severity: Low
CVSS v3: 2.1/AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:N/A:L
Release date: 2026-03-10T12:08:30.515000+00:00

A flaw was found in Vaadin. During the automatic download and extraction of Node.js, a remote attacker could exploit a path traversal vulnerability. By intercepting or controlling the Node.js download, an attacker could serve a specially crafted ZIP archive. This malicious archive would allow files to be written outside the intended directory, potentially leading to unauthorized file creation or modification on the system.


Remediation:
To mitigate this issue, ensure a compatible Node.js version is preinstalled globally on systems using Vaadin. This prevents Vaadin's build process from automatically downloading and extracting Node.js, thereby eliminating the vulnerable path. Verify that the preinstalled Node.js version meets the requirements of your Vaadin application.
Locutus is vulnerable to Prototype Pollution
CVE: CVE-2026-25521
Component: locutus
CWE: CWE-915
Severity: Critical
CVSS v3: 9.2/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Release date: 2026-02-04T21:20:32.643000+00:00

Locutus brings stdlibs of other programming languages to JavaScript for educational purposes. In versions from 2.0.12 to before 2.0.39, a prototype pollution vulnerability exists in locutus. Despite a previous fix that attempted to mitigate prototype pollution by checking whether user input contained a forbidden key, it is still possible to pollute Object.prototype via a crafted input using String.prototype. This issue has been patched in version 2.0.39.


Remediation:
CVE: CVE-2026-2038
Component: GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability
Release date: 2026-02-12T21:49:10.886000+00:00

GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affected installations of GFI Archiver. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of authorization prior to allowing access to functionality. An attacker can leverage this in conjunction with other vulnerabilities to execute code in the context of SYSTEM. Was ZDI-CAN-27934.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ksmbd: add chann_lock to protect ksmbd_chann_list xarray
CVE: CVE-2026-23226
Component: kernel
Severity: None
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: add chann_lock to protect ksmbd_chann_list xarray

ksmbd_chann_list xarray lacks synchronization, allowing use-after-free in
multi-channel sessions (between lookup_chann_list() and ksmbd_chann_del).

Adds rw_semaphore chann_lock to struct ksmbd_session and protects
all xa_load/xa_store/xa_erase accesses.


Remediation:
curl: Information disclosure via OAuth2 bearer token leakage during HTTP(S) redirect
CVE: CVE-2026-3783
Component: curl
CWE: CWE-201
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-11T10:09:08.746000+00:00

A flaw was found in curl. When an OAuth2 bearer token is used for an HTTP(S) transfer that redirects to a second URL, curl could unintentionally leak the token. This occurs if the second hostname has entries in the `.netrc` file, allowing the bearer token intended for the first host to be sent to the redirected host. This information disclosure could allow an attacker to gain unauthorized access.


Remediation:
To prevent the leakage of OAuth2 bearer tokens, ensure that `.netrc` files are carefully managed. Avoid configuring `.netrc` entries for untrusted or unknown hostnames, particularly when `curl` is used with OAuth2 bearer tokens and is configured to follow redirects. Regularly review and restrict the scope of credentials stored in `.netrc` files to only explicitly trusted destinations.
Out-of-bounds Write in o6 Automation GmbH Open62541
CVE: CVE-2026-1301
Component: open62541
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-05T19:09:37.387000+00:00

In builds with PubSub and JSON enabled, a crafted JSON message can cause the decoder to write beyond a heap-allocated array before authentication, reliably crashing the process and corrupting memory.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Keycloak Authorization Header Parsing Leading to Potential Security Control Bypass
CVE: CVE-2026-0707
Component: keycloak
CWE: CWE-551
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-01-07T00:00:00+00:00

A flaw was found in Keycloak. The Keycloak Authorization header parser is overly permissive regarding the formatting of the "Bearer" authentication scheme. It accepts non-standard characters (such as tabs) as separators and tolerates case variations that deviate from RFC 6750 specifications.

Statement: This vulnerability is rated Moderate for Red Hat because Keycloak's excessive tolerance for non-standard Bearer token formats in the Authorization header can lead to inconsistencies with front-end security controls such as WAFs and proxies. This may enable potential bypass risks, allowing malformed tokens to circumvent intended security policies.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
To mitigate this issue, configure any front-end security controls, such as Web Application Firewalls (WAFs) or reverse proxies, to strictly validate and normalize the `Authorization` header before forwarding requests to Keycloak. This ensures that only standard Bearer token formats are processed, preventing potential bypasses.
Incorrect enforcement of email constraints in crypto/x509
CVE: CVE-2026-27137
Component: crypto/x509
CWE: CWE-295
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-06T21:28:13.748000+00:00

A certificate validation flaw has been discovered in the golang crypto/x509 module. When verifying a certificate chain which contains a certificate containing multiple email address constraints which share common local portions but different domain portions, these constraints will not be properly applied, and only the last constraint will be considered.


Remediation:
For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Information disclosure and denial of service via heap over-read in MAT decoder
CVE: CVE-2026-28692
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-03-09T21:41:39.654000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A remote attacker could exploit a heap over-read vulnerability in the MAT decoder due to incorrect parenthesization when using 32-bit arithmetic. This could lead to the disclosure of sensitive information and a denial of service (DoS) condition.

Statement: This MODERATE impact vulnerability in ImageMagick stems from a heap buffer over-read within the MAT image decoder due to incorrect 32-bit arithmetic. Red Hat products, including Red Hat Enterprise Linux 6 ELS and 7 ELS, are affected if ImageMagick is used to process specially crafted MAT image files. Exploitation requires processing a malicious MAT image.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
nvme-pci: handle changing device dma map requirements
CVE: CVE-2026-23174
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: handle changing device dma map requirements

The initial state of dma_needs_unmap may be false, but change to true
while mapping the data iterator. Enabling swiotlb is one such case that
can change the result. The nvme driver needs to save the mapped dma
vectors to be unmapped later, so allocate as needed during iteration
rather than assume it was always allocated at the beginning. This fixes
a NULL dereference from accessing an uninitialized dma_vecs when the
device dma unmapping requirements change mid-iteration.


Remediation:
GStreamer: Arbitrary code execution via H.266 codec parsing stack-based buffer overflow
CVE: CVE-2026-3081
Component: GStreamer
CWE: CWE-120
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:39:20.596000+00:00

A flaw was found in GStreamer. A remote attacker can exploit this vulnerability by providing specially crafted H.266 codec data during the parsing of decoding units. This issue arises from insufficient validation of the length of user-supplied data before it is copied to a fixed-length stack-based buffer. Successful exploitation can lead to a stack-based buffer overflow, allowing for arbitrary code execution in the context of the current process.

Statement: This is an IMPORTANT vulnerability affecting the GStreamer H.266 codec parser. The flaw allows remote attackers to execute arbitrary code by providing specially crafted H.266 media content. Exploitation requires user interaction with applications that process untrusted H.266 streams using GStreamer.

Remediation:
To reduce the risk of exploitation, avoid processing untrusted H.266 media content with applications that use the GStreamer framework. Restricting the sources of H.266 content to trusted origins is recommended.
Linux kernel: Memory leak in gs_usb module can lead to denial of service via improper USB Request Block handling.
CVE: CVE-2026-23031
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

A flaw was found in the Linux kernel's `gs_usb` module. A local user can exploit this memory leak vulnerability due to improper handling of USB Request Blocks (URBs). The USB framework unanchors the URB before its completion, preventing its release and leading to resource exhaustion. This can result in a Denial of Service (DoS) condition for the system.


Remediation:
Caddy: Access control bypass due to case-sensitive host matching
CVE: CVE-2026-27588
Component: github.com/caddyserver/caddy/v2/modules/caddyhttp
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-02-24T16:28:28.106000+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, Caddy's HTTP `host` request matcher is documented as case-insensitive, but when configured with a large host list (>100 entries) it becomes case-sensitive due to an optimized matching path. An attacker can bypass host-based routing and any access controls attached to that route by changing the casing of the `Host` header. Version 2.11.1 contains a fix for the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Invalid pointer in the DOM: Core & HTML component
CVE: CVE-2026-2805
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:32.768000+00:00

Invalid pointer in the DOM: Core & HTML component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
libxml2: Denial of Service via crafted XML catalogs
CVE: CVE-2026-0992
Component: libxml2
CWE: CWE-400
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-15T00:00:00+00:00

A flaw was found in the libxml2 library. This uncontrolled resource consumption vulnerability occurs when processing XML catalogs that contain repeated <nextCatalog> elements pointing to the same downstream catalog. A remote attacker can exploit this by supplying crafted catalogs, causing the parser to redundantly traverse catalog chains. This leads to excessive CPU consumption and degrades application availability, resulting in a denial-of-service condition.

Statement: This vulnerability is rated Low for Red Hat. It affects applications that use the libxml2 library to process XML catalogs. An attacker must locally supply specially crafted XML catalogs containing repeated <nextCatalog> elements, which can lead to excessive CPU consumption and a denial-of-service condition due to redundant catalog chain traversal.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
CVE: CVE-2026-2043
Component: Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability
Release date: 2026-02-12T21:48:24.415000+00:00

Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Nagios Host. Authentication is required to exploit this vulnerability.

The specific flaw exists within the esensors_websensor_configwizard_func method. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28249.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Django: Denial of Service via slow URL normalization on Windows
CVE: CVE-2026-25673
Component: django
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-03T14:28:28.601000+00:00

A flaw was found in Django. A remote attacker can exploit a vulnerability in the `URLField.to_python()` function, specifically when Django is running on the Windows platform. This function, which utilizes `urllib.parse.urlsplit()`, performs a disproportionately slow normalization process for certain Unicode characters. By submitting large URL inputs containing these characters, an attacker can trigger a denial of service (DoS).

Statement: This flaw only affects Django running on the Windows platform. As such, Red Hat software is unaffected.

Remediation:
Fastify: Validation bypass due to malformed Content-Type header leading to integrity impact
CVE: CVE-2026-25223
Component: Fastify
CWE: CWE-179
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-02-03T21:21:40.268000+00:00

A flaw was found in Fastify, a web framework for Node.js. A remote attacker can exploit a validation bypass vulnerability by appending a tab character followed by arbitrary content to the Content-Type header. This circumvents the request body validation schemas, allowing the server to process the body as the original content type without proper validation. This could lead to unexpected data processing and potential integrity impact.

Statement: This IMPORTANT vulnerability in Fastify, a Node.js web framework, allows remote attackers to bypass request body validation by manipulating the Content-Type header. This can lead to unexpected data processing and integrity issues in applications. Red Hat products such as Red Hat Enterprise Linux AI, Red Hat OpenShift AI, and Red Hat OpenShift Dev Spaces are affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
pyasn1 Vulnerable to Denial of Service via Unbounded Recursion
CVE: CVE-2026-30922
Component: pyasn1
CWE: CWE-835
Severity: Important
CVSS v3: 7.5/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T02:29:45.857000+00:00

An unbounded recursion flaw has been discovered in the pypi pyasn1 library. This uncontrolled recursion occurs when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payload containing nested SEQUENCE (0x30) or SET (0x31) tags with Indefinite Length (0x80) markers. This forces the decoder to recursively call itself until the Python interpreter crashes with a RecursionError or consumes all available memory (OOM), crashing the host application.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Gitea Pull Requests Auto-Merge: Read-Only Users Can Cancel Scheduled Auto-Merge via Web Endpoint (Authorization Bypass)
CVE: CVE-2026-20888
Component: gitea
CWE: CWE-425
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-01-22T22:01:51.214000+00:00

Gitea does not properly verify authorization when canceling scheduled auto-merges via the web interface. A user with read access to pull requests may be able to cancel auto-merges scheduled by other users.


Remediation:
NULL Pointer Dereference in Wireshark
CVE: CVE-2026-3202
Component: wireshark
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-25T14:35:55.986000+00:00

A flaw was found in the NTS-KE dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing a NULL pointer dereference, resulting in a denial of service.

Statement: This issue will cause a crash in Wireshark with no other security impact. Also, this flaw can only be exploited when a malformed pcap file is processed. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
Linux kernel: Local denial of service in interconnect debugfs due to uninitialized pointers
CVE: CVE-2026-23123
Component: kernel
CWE: CWE-457
Severity: Low
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's interconnect debugfs test client. This vulnerability arises from the use of uninitialized pointers when handling debugfs entries. A local user with sufficient privileges could exploit this by accessing these debugfs entries. Successful exploitation could lead to a kernel crash, causing a local denial of service (DoS). There is also a theoretical risk of memory corruption.

Statement: The issue is in the interconnect debugfs test client. The debugfs_create_str API assumes that the backing pointer is either NULL or points to valid dynamically allocated memory. Before this change src_node and dst_node could be left uninitialized, meaning they might contain arbitrary stack or global garbage values. When the debugfs files are accessed, the debugfs str
ing helpers may dereference the pointer to print the string, or may attempt to update it on write. With an uninitialized pointer this can lead to a kernel crash due to an invalid dereference, producing a local denial of service. Depending on the exact debugfs string implementation and write path behavior, there is also a more theoretical risk of memory corruption if the subsystem attempts to treat the garbage pointer as a valid allocation. Access requires local privileges sufficient to read or write the debugfs entries. In many deployments debugfs is restricted to root and may not be mounted.

Remediation:
ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free()
CVE: CVE-2026-23089
Component: kernel
CWE: CWE-825
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's USB audio driver. When snd_usb_create_mixer() fails, snd_usb_mixer_free() frees mixer->id_elems while controls already added to the sound card still reference this memory. When snd_card_register() later runs, the OSS mixer layer invokes callbacks on these controls, triggering a use-after-free read in get_ctl_value().

Statement: This use-after-free occurs during USB audio device probe error handling. Triggering requires a USB audio device that causes mixer creation to fail, which could happen with malformed device descriptors or resource exhaustion. The vulnerability results in a kernel crash or potential information disclosure through the stale memory read.

Remediation:
To mitigate this issue, prevent the snd_usb_audio module from being loaded if USB audio devices are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
pypdf: Denial of Service due to excessive resource consumption from crafted PDF
CVE: CVE-2026-33123
Component: pypdf
CWE: CWE-770
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-03-20T09:09:12.831000+00:00

A flaw was found in pypdf, a pure-python PDF library. An attacker can craft a malicious PDF file that, when processed, leads to excessive resource consumption, causing long runtimes and high memory usage. This can result in a Denial of Service (DoS) condition, making the application unresponsive or unstable.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.