huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
pdfbox-examples: Apache PDFBox Example: Path Traversal via specially crafted filenames allows arbitrary file write
CVE: CVE-2026-23907
Component: org.apache.pdfbox
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-10T09:43:40.384000+00:00

A path traversal vulnerability was identified in the ExtractEmbeddedFiles example provided with Apache PDFBox. The example code constructs extraction paths by directly appending filenames obtained from PDComplexFileSpecification.getFilename() without validating the resulting path. An attacker could exploit this behavior by embedding files in a PDF document with crafted filenames containing path traversal sequences. If the example code is reused in an application without modification, this could cause extracted files to be written outside the intended extraction directory, potentially leading to data corruption or unauthorized file creation.

Statement: Red Hat Product Security rates this issue as Moderate severity, because the vulnerable code exists in the example implementation shipped with Apache PDFBox and is not part of the core library functionality. 

Applications that copied or reused the ExtractEmbeddedFiles example code without adding proper path validation may allow path traversal during extraction of embedded files from PDF documents. The impact is limited to the permissions of the application processing the PDF.

Systems that do not use this example code or that properly sanitize extraction paths are not affected.

Remediation:
Red Hat is not aware of a practical temporary workaround that fully mitigates this issue or meets Red Hat Product Security's standards for usability, deployment, applicability, or stability. Customers are advised to apply the relevant security updates if they become available.
curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication
CVE: CVE-2026-1965
Component: curl
CWE: CWE-303
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-11T10:08:52.431000+00:00

A flaw was found in curl. When an application uses libcurl to make multiple Negotiate-authenticated HTTP or HTTPS requests to the same server with different credentials, libcurl may incorrectly reuse an existing connection. This logical error can cause a subsequent request to be sent using the authentication of a previous user, leading to an authentication bypass.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Pydantic AI: Information disclosure via Server-Side Request Forgery (SSRF) through malicious URLs in message history.
CVE: CVE-2026-25580
Component: Pydantic AI
CWE: CWE-918
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-02-06T21:01:38.035000+00:00

A flaw was found in Pydantic AI. This Server-Side Request Forgery (SSRF) vulnerability allows a remote attacker to include malicious URLs within untrusted message history. When processed by the application, these URLs can force the server to make unauthorized HTTP requests to internal network resources. This could lead to the disclosure of sensitive internal information or access to cloud credentials.

Statement: This IMPORTANT vulnerability affects Red Hat Enterprise Linux AI products using Pydantic AI when applications process untrusted message history. A Server-Side Request Forgery (SSRF) flaw in URL download handling allows attackers to inject malicious URLs, potentially accessing internal network resources or cloud credentials. Exploitation requires applications to accept message history from external, untrusted sources.

Remediation:
To mitigate, configure applications using Pydantic AI to avoid accepting message history from untrusted external sources. Implement robust input validation and sanitization for all URLs processed by the application. Additionally, restrict network access for the Pydantic AI application to only essential internal and external resources, thereby limiting the potential impact of SSRF attacks.
Keycloak: Denial of Service due to excessive SAMLRequest decompression
CVE: CVE-2026-2575
Component: keycloak
CWE: CWE-409
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-16T08:08:00+00:00

A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.

Statement: This MODERATE impact denial of service flaw affects Red Hat Build of Keycloak (RHBK). An unauthenticated remote attacker can exploit this by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server's inability to enforce size limits during DEFLATE decompression leads to an OutOfMemoryError, causing process termination and disrupting service availability. This vulnerability is applicable when Keycloak is configured to use SAML Redirect Binding.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Keylime: Authentication bypass allows unauthorized administrative operations due to missing client-side TLS authentication
CVE: CVE-2026-1709
Component: keylime
CWE: CWE-322
Severity: Critical
CVSS v3: 9.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Release date: 2026-02-06T17:45:00+00:00

A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.

Statement: This is a Critical authentication bypass flaw in the Keylime registrar, affecting versions 7.12.0 and later. The registrar fails to enforce client-side TLS authentication, enabling unauthenticated clients with network access to perform administrative actions such as listing or deleting agents and retrieving TPM data. Exploitation requires direct network access to the registrar's HTTPS port (default 8891). Keylime packages shipped in RHEL-9.6 and earlier are not affected, as they never shipped the version which introduced this vulnerability.

Remediation:
Restrict network access to the Keylime registrar's HTTPS port (default 8891) to only trusted verifier and tenant hosts using firewall rules. 
Alternatively, deploy a reverse proxy (e.g., Nginx, HAProxy) in front of the registrar to enforce client certificate authentication. 
Ensure any changes to firewall rules or proxy configurations are reloaded or services are restarted for the mitigation to take effect.
btrfs: do not strictly require dirty metadata threshold for metadata writepages
CVE: CVE-2026-23157
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A deadlock vulnerability was found in the Linux kernel's Btrfs filesystem when used with cgroups that have low memory/dirty page limits. Btrfs has an internal 32MiB threshold before writing back btree metadata, but if a cgroup's dirty limit is lower (e.g., 16MB), processes can become stuck indefinitely in balance_dirty_pages() waiting for dirty pages to be written back that Btrfs refuses to flush.

Statement: This deadlock affects systems using Btrfs with memory cgroups that have restrictive dirty page limits. Over 1000 processes can become stuck, causing system hangs. The issue primarily impacts containerized environments with strict memory constraints. Newer kernels (6.18+) have mitigations via AS_KERNEL_FILE, but LTS kernels remain vulnerable.

Remediation:
llama.cpp: Remote code execution via invalid n_discard parameter in server endpoints
CVE: CVE-2026-21869
Component: llama.cpp
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-07T23:37:59.886000+00:00

A flaw was found in llama.cpp. A remote attacker can exploit an input validation vulnerability in the server's completion endpoints. By supplying a negative value for the `n_discard` parameter in JSON input, an attacker can cause out-of-bounds memory writes. This can lead to a process crash or enable remote code execution (RCE), allowing the attacker to run arbitrary code on the affected system.

Statement: This vulnerability is rated Important as it allows remote code execution in the llama.cpp server. An unauthenticated remote attacker can trigger out-of-bounds memory writes by providing a negative `n_discard` parameter in JSON input to the server's completion endpoints, leading to a crash or arbitrary code execution. This could impact deployments where the llama.cpp server is exposed to untrusted networks.

Remediation:
micronaut-core: Micronaut Framework: Denial of Service via unbounded cache in HTML error response handling
CVE: CVE-2026-33012
Component: Micronaut Framework
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T04:43:07.809000+00:00

A flaw was found in Micronaut Framework. Remote attackers can exploit an unbounded cache in the DefaultHtmlErrorResponseBodyProvider component by influencing exception messages, such as through request query parameters. This can lead to uncontrolled memory growth and an OutOfMemoryError, resulting in a Denial of Service (DoS) for the application.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
mm/damon/core: remove call_control in inactive contexts
CVE: CVE-2026-23012
Component: kernel
Severity: None
Release date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/damon/core: remove call_control in inactive contexts

If damon_call() is executed against a DAMON context that is not running,
the function returns error while keeping the damon_call_control object
linked to the context's call_controls list.  Let's suppose the object is
deallocated after the damon_call(), and yet another damon_call() is
executed against the same context.  The function tries to add the new
damon_call_control object to the call_controls list, which still has the
pointer to the previous damon_call_control object, which is deallocated. 
As a result, use-after-free happens.

This can actually be triggered using the DAMON sysfs interface.  It is not
easily exploitable since it requires the sysfs write permission and making
a definitely weird file writes, though.  Please refer to the report for
more details about the issue reproduction steps.

Fix the issue by making two changes.  Firstly, move the final
kdamond_call() for cancelling all existing damon_call() requests from
terminating DAMON context to be done before the ctx->kdamond reset.  This
makes any code that sees NULL ctx->kdamond can safely assume the context
may not access damon_call() requests anymore.  Secondly, let damon_call()
to cleanup the damon_call_control objects that were added to the
already-terminated DAMON context, before returning the error.


Remediation:
libceph: prevent potential out-of-bounds reads in handle_auth_done()
CVE: CVE-2026-22984
Component: kernel
Severity: Moderate
CVSS v3: 7.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: prevent potential out-of-bounds reads in handle_auth_done()

Perform an explicit bounds check on payload_len to avoid a possible
out-of-bounds access in the callout.

[ idryomov: changelog ]

Statement: An out-of-bounds read can occur in libceph messenger v2 during AUTH_DONE handling when payload_len is taken from the wire but the message buffer is not validated to actually contain that many bytes. A malicious or compromised Ceph peer can send a truncated message to reliably crash the kernel (network-triggered DoS).

Remediation:
If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
CVE: CVE-2026-2037
Component: GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-02-12T21:49:06.136000+00:00

GFI Archiver MArc.Core Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the configuration of the MArc.Core.Remoting.exe process, which listens on port 8017. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27935.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Kernel: Denial of Service in virtio-crypto due to missing spinlock protection
CVE: CVE-2026-23229
Component: kernel
CWE: CWE-820
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-18T00:00:00+00:00

A flaw was found in the Linux kernel's virtio-crypto driver. A local attacker, by running multiple OpenSSL processes with the `afalg` engine, could trigger a race condition due to missing spinlock protection in the `virtcrypto_done_task()` function. This could lead to a system hang, resulting in a Denial of Service (DoS).


Remediation:
CVE: CVE-2026-0773
Component: Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-01-09T17:13:26.864000+00:00

Upsonic Cloudpickle Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Upsonic. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the add_tool endpoint, which listens on TCP port 7541 by default. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-26845.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Chromium: Arbitrary code execution via crafted HTML page
CVE: CVE-2026-1861
Component: Chromium
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-03T20:56:47.624000+00:00

Heap buffer overflow in libvpx in Google Chrome prior to 144.0.7559.132 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
mm/hugetlb: fix hugetlb_pmd_shared()
CVE: CVE-2026-23100
Component: kernel
CWE: CWE-821
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mm/hugetlb: fix hugetlb_pmd_shared()

Patch series "mm/hugetlb: fixes for PMD table sharing (incl.  using
mmu_gather)", v3.

One functional fix, one performance regression fix, and two related
comment fixes.

I cleaned up my prototype I recently shared [1] for the performance fix,
deferring most of the cleanups I had in the prototype to a later point. 
While doing that I identified the other things.

The goal of this patch set is to be backported to stable trees "fairly"
easily. At least patch #1 and #4.

Patch #1 fixes hugetlb_pmd_shared() not detecting any sharing
Patch #2 + #3 are simple comment fixes that patch #4 interacts with.
Patch #4 is a fix for the reported performance regression due to excessive
IPI broadcasts during fork()+exit().

The last patch is all about TLB flushes, IPIs and mmu_gather.
Read: complicated

There are plenty of cleanups in the future to be had + one reasonable
optimization on x86. But that's all out of scope for this series.

Runtime tested, with a focus on fixing the performance regression using
the original reproducer [2] on x86.


This patch (of 4):

We switched from (wrongly) using the page count to an independent shared
count.  Now, shared page tables have a refcount of 1 (excluding
speculative references) and instead use ptdesc->pt_share_count to identify
sharing.

We didn't convert hugetlb_pmd_shared(), so right now, we would never
detect a shared PMD table as such, because sharing/unsharing no longer
touches the refcount of a PMD table.

Page migration, like mbind() or migrate_pages() would allow for migrating
folios mapped into such shared PMD tables, even though the folios are not
exclusive.  In smaps we would account them as "private" although they are
"shared", and we would be wrongly setting the PM_MMAP_EXCLUSIVE in the
pagemap interface.

Fix it by properly using ptdesc_pmd_is_shared() in hugetlb_pmd_shared().


Remediation:
net/ena: fix missing lock when update devlink params
CVE: CVE-2026-23045
Component: kernel
CWE: CWE-414
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-04T00:00:00+00:00

A locking flaw was found in the Amazon ENA (Elastic Network Adapter) driver in the Linux kernel. The ena_devlink_alloc() function calls devl_param_driverinit_value_set() without first acquiring the required devlink lock. This triggers a lock assertion warning in devl_assert_locked() during driver probe, indicating improper synchronization when updating devlink parameters.

Statement: This issue causes a kernel warning during ENA driver initialization on Amazon EC2 instances. The missing lock could theoretically lead to race conditions if devlink parameters are accessed concurrently, but the practical impact is limited to a warning message during driver probe. No crash or data corruption has been observed from this issue.

Remediation:
cpp-httplib: Server-Side Request Forgery via header injection
CVE: CVE-2026-21428
Component: cpp-httplib
CVSS v3: 8.6/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2026-01-01T17:54:43.959000+00:00

A flaw was found in cpp-httplib, a C++ HTTP/HTTPS library. A remote attacker can exploit this vulnerability by injecting carriage return and line feed characters into user-supplied headers. This allows the attacker to add extra headers, modify the request body, and potentially trigger a Server-Side Request Forgery attack, which can be used to make a server send requests to an unintended location.

Statement: This vulnerability is rated IMPORTANT as it allows remote attackers to perform Server-Side Request Forgery attacks to locations outside the scope of cpp-httplib by injecting carriage return and line feed characters into user-supplied headers. This affects applications utilizing the `cpp-httplib` library in Red Hat Community Projects such as Fedora and EPEL, where the library is used to process untrusted HTTP headers.

Remediation:
Use after free in Extensions
CVE: CVE-2026-3919
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An use after free flaw was found in the Extensions component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=444176961

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Out of bounds read in Blink
CVE: CVE-2026-4462
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-18T00:00:00+00:00

An out of bounds read flaw was found in the Blink component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=491080830

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
xfs: get rid of the xchk_xfile_*_descr calls
CVE: CVE-2026-23252
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
FreeRDP heap-buffer-overflow
CVE: CVE-2026-22855
Component: freerdp
CWE: CWE-125
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2026-01-14T17:50:06.209000+00:00

A heap based buffer overflow has been discovered in FreeRDP. This heap out-of-bounds read occurs in the smartcard SetAttrib path when cbAttrLen does not match the actual NDR buffer length.

Statement: Red Hat products in their default configuration employ Address Space Layout Randomization (ASLR) which drastically increases the complexity of the successful exploitation of this flaw.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
YAML::Syck versions through 1.36 for Perl has several potential security vulnerabilities including a high-severity heap buffer overflow in the YAML emitter
CVE: CVE-2026-4177
Component: perl-YAML-Syck
CWE: CWE-120
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-03-16T22:30:25.367000+00:00

Multiple security issues have been discovered in the perl YAML::Syck module. A heap overflow occurs when class names exceed the initial 512-byte allocation, a base64 decoder could read past the buffer end on trailing newlines. strtok mutated n->type_id in place, corrupting shared node data, and a memory leak occurred in syck_hdlr_add_anchor when a node already had an anchor. The incoming anchor string 'a' was leaked on early return.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.