huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Wasmtime: Denial of Service via guest-controlled resource exhaustion in WASI host interfaces
CVE: CVE-2026-27204
Component: wasmtime
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H
Release date: 2026-02-24T21:23:47.007000+00:00

Wasmtime is a runtime for WebAssembly. Prior to versions 24.0.6, 36.0.6, 4.0.04, 41.0.4, and 42.0.0, Wasmtime's implementation of WASI host interfaces are susceptible to guest-controlled resource exhaustion on the host. Wasmtime did not appropriately place limits on resource allocations requested by the guests. This serves as a Denial of Service vector. Wasmtime 24.0.6, 36.0.6, 40.0.4, 41.0.4, and 42.0.0 have all been released with the fix for this issue. These versions do not prevent this issue in their default configuration to avoid breaking preexisting behaviors. All versions of Wasmtime have appropriate knobs to prevent this behavior, and Wasmtime 42.0.0-and-later will have these knobs tuned by default to prevent this issue from happening. There are no known workarounds for this issue without upgrading. Embedders are recommended to upgrade and configure their embeddings as necessary to prevent possibly-malicious guests from triggering this issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libssh: Denial of Service via inefficient regular expression processing
CVE: CVE-2026-0967
Component: libssh
CWE: CWE-1333
Severity: Low
CVSS v3: 2.3/CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-10T18:47:09.215000+00:00

No description is available for this CVE.


Remediation:
Avoid using complex patterns in configuration files and known_hosts.
tcp: secure_seq: add back ports to TS offset
CVE: CVE-2026-23247
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Moodle: Improper Validation in File Restore Functionality Leading to Remote Code Execution
CVE: CVE-2026-26045
Component: moodle
CVSS v3: 8.2/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-19T00:00:00+00:00

A flaw was identified in Moodle’s backup restore functionality where specially crafted backup files were not properly validated during processing. If a malicious backup file is restored, it could lead to unintended execution of server-side code. Since restore capabilities are typically available to privileged users, exploitation requires authenticated access. Successful exploitation could result in full compromise of the Moodle server.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Malicious logback.xml configuration file allows instantiation of arbitrary classes
CVE: CVE-2026-1225
Component: ch.qos.logback/logback-core
CWE: CWE-20
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Release date: 2026-01-22T09:24:14.634000+00:00

ACE vulnerability in configuration file processing  by QOS.CH logback-core up to and including version 1.5.24 in Java applications, allows an attacker to instantiate classes already present on the class path by compromising an existing logback configuration file.




The instantiation of a potentially malicious Java class requires that said class is present on the user's class-path. In addition, the attacker must  have write access to a 
configuration file. However, after successful instantiation, the instance is very likely to be discarded with no further ado.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
use-after-free in the MSL encoder
CVE: CVE-2026-28688
Component: ImageMagick
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-09T21:38:08.127000+00:00

A flaw was found in ImageMagick. Processing commands related to MSL writing, specifically cloning an image structure for output, can cause a heap use-after-free vulnerability and result in a denial of service.

Statement: To exploit this issue, an attacker needs to convince a user to process a specially crafted file that makes ImageMagick use the MSL encoder to write or output an image. The malicious file, usually an .msl script or an image designed to invoke MSL processing, will contain instructions to trigger the cloning process and the use-after-free issue, with no evidence it can cause arbitrary command execution. Due to these reasons, this flaw has been rated with a moderate severity.

Remediation:
To mitigate this vulnerability, disable the vulnerable encoder by adding the following line to the ImageMagick policy.xml file, typically located in the directory /etc/ImageMagick-7/, /etc/ImageMagick-6/ or /etc/ImageMagick/:

~~~
<policy domain="coder" rights="none" pattern="MSL" />
~~~

To reduce the risk of exploitation, avoid processing untrusted MSL files with ImageMagick. If ImageMagick is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.
btrfs: sync read disk super and set block size
CVE: CVE-2026-23181
Component: kernel
CWE: CWE-367
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A race condition was found in the Linux kernel's Btrfs filesystem when reading the disk superblock. If a user changes the block device's block size via BLKBSZSET ioctl while Btrfs is mounting, the inconsistency between folio allocation and the new block size can trigger a VM_BUG_ON assertion or NULL pointer dereference.

Statement: Exploitation requires the ability to issue BLKBSZSET ioctls on a block device being mounted with Btrfs, which typically needs CAP_SYS_ADMIN or device ownership. The race window is narrow and the impact is denial of service via kernel crash rather than privilege escalation.

Remediation:
cpp-httplib: Denial of Service via crafted HTTP POST request
CVE: CVE-2026-29076
Component: cpp-httplib
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-07T16:08:56.048000+00:00

A flaw was found in cpp-httplib, a C++11 single-file header-only cross-platform HTTP/HTTPS library. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP POST request with a malicious filename* parameter in the Content-Disposition header. This triggers uncontrolled stack growth due to the std::regex engine's deep recursion, leading to a stack overflow and causing the server process to crash, resulting in a Denial of Service (DoS).

Statement: The vulnerability CVE-2026-29076 is of MODERATE impact. It affects applications utilizing the `cpp-httplib` library to parse multipart `Content-Disposition` headers, specifically when handling `filename*` values. A remote attacker can send a crafted HTTP POST request, leading to a stack overflow and denial of service in the server process. This issue primarily impacts services that accept and process such multipart requests.

Remediation:
Podman Desktop: Authentication bypass allows malicious extensions to gain unauthorized access.
CVE: CVE-2026-24835
Component: podman-desktop
CWE: CWE-305
Severity: Moderate
CVSS v3: 6.6/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
Release date: 2026-01-28T20:42:29.508000+00:00

A flaw was found in Podman Desktop, where an authentication bypass vulnerability allows any malicious extension to completely circumvent permission checks. By exploiting a flaw where the `isAccessAllowed()` function unconditionally returns `true`, an attacker can gain unauthorized access to all authentication sessions. This enables malicious extensions to impersonate any user, hijack authentication sessions, and access sensitive resources without authorization.

Statement: Red Hat believes this flaw to be of Moderate impact because the vulnerability only allows an attacker to gain access to local sessions and requires user interaction in the form of downloading and installing a malicious extension.

Remediation:
time affected by a stack exhaustion denial of service attack
CVE: CVE-2026-25727
Component: time
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-06T19:20:56.298000+00:00

A stack exhaustion flaw has been discovered in the rust time crate. When user-provided input is provided to any type that parses with the RFC 2822 format, a denial of service attack via stack exhaustion is possible. The attack relies on formally deprecated and rarely-used features that are part of the RFC 2822 format used in a malicious manner. Ordinary, non-malicious input will never encounter this scenario.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
devalue: Denial of Service due to excessive resource consumption from untrusted input
CVE: CVE-2026-22774
Component: devalue
CWE: CWE-405
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-15T18:53:21.963000+00:00

A flaw was found in devalue, a JavaScript library used for serializing values. A remote attacker can exploit this vulnerability by providing specially crafted input to the devalue.parse function. This can cause the application to consume excessive CPU time and memory, leading to a denial of service (DoS) condition. The root cause is an unchecked assumption during typed array hydration, where an ArrayBuffer is expected but not validated.

Statement: This vulnerability is rated Important for Red Hat products that utilize the `devalue` JavaScript library, such as pgAdmin 4, Red Hat Build of Podman Desktop, and Red Hat Trusted Artifact Signer. A remote attacker can exploit this flaw by providing specially crafted input to the `devalue.parse` function, leading to excessive CPU and memory consumption and a denial of service condition.

Remediation:
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.2/html-single/release_notes/index
Red Hat Trusted Artifact Signer simplifies cryptographic signing and verifying of software artifacts such as container images, binaries and source code changes. It is a self-managed on-premise deployment of the Sigstore project available at https://sigstore.dev

Platform Engineers, Software Developers and Security Professionals may use RHTAS to ensure the integrity, transparency and assurance of their organization's software supply chain.

For details on using the operator, refer to the product documentation at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3

You can find the release notes for this version of Red Hat Trusted Artifact Signer at https://access.redhat.com/documentation/en-us/red_hat_trusted_artifact_signer/1.3/html-single/release_notes/index
blst cryptographic library: Denial of Service via out-of-bounds stack write in key generation
CVE: CVE-2026-2681
Component: github.com/supranational/blst
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-18T00:00:00+00:00

A flaw was found in the blst cryptographic library. This out-of-bounds stack write vulnerability, specifically in the blst_sha256_bcopy assembly routine, occurs due to a missing zero-length guard. A remote attacker can exploit this by providing a zero-length salt parameter to key generation functions, such as blst_keygen_v5(), if the application exposes this functionality. Successful exploitation leads to memory corruption and immediate process termination, resulting in a denial-of-service (DoS) condition.

Statement: This MODERATE impact vulnerability in the `blst` cryptographic library can lead to a denial-of-service condition. The flaw is triggered when an application using the library's key generation API processes a zero-length salt, resulting in an out-of-bounds stack write.

Remediation:
Out-of-Bounds Read in libsoup WebSocket Frame Processing
CVE: CVE-2026-0716
Component: libsoup
CWE: CWE-805
Severity: Moderate
CVSS v3: 4.7/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-01-08T00:00:00+00:00

A flaw was found in libsoup’s WebSocket frame processing when handling incoming messages. If a non-default configuration is used where the maximum incoming payload size is unset, the library may read memory outside the intended bounds. This can cause unintended memory exposure or a crash. Applications using libsoup’s WebSocket support with this configuration may be impacted.

Statement: This vulnerability is rated Moderate for Red Hat because it requires a non-default configuration where `max_incoming_payload_size` is explicitly set to 0 or unset in libsoup's WebSocket frame processing. In typical Red Hat deployments, this configuration is not enabled by default, limiting the exposure to memory disclosure or application instability.

Remediation:
To mitigate this issue, applications utilizing libsoup's WebSocket support should ensure that the `max_incoming_payload_size` is explicitly set to a non-zero value. This prevents the library from processing WebSocket frames with an unset or zero maximum payload size, which can lead to out-of-bounds reads. Consult application-specific documentation for configuring libsoup parameters.
sfc: fix deadlock in RSS config read
CVE: CVE-2026-23165
Component: kernel
CWE: CWE-764
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A deadlock vulnerability was found in the Solarflare (sfc) network driver. When reading RSS configuration via ethtool -x, the driver attempts to acquire the rss_lock that is already held by the networking core, causing a deadlock and system hang.

Statement: This deadlock affects systems with Solarflare NICs when querying RSS settings via ethtool. Any local user with access to network configuration can trigger the hang. The fix is straightforward — remove the redundant lock acquisition in the driver.

Remediation:
net: 3com: 3c59x: fix possible null dereference in vortex_probe1()
CVE: CVE-2026-23020
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: 3com: 3c59x: fix possible null dereference in vortex_probe1()

pdev can be null and free_ring: can be called in 1297 with a null
pdev.


Remediation:
pnpm: Arbitrary file write via path traversal on Windows
CVE: CVE-2026-23889
Component: pnpm
CWE: CWE-22
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2026-01-26T21:50:55.289000+00:00

A flaw was found in pnpm, a package manager. This vulnerability, known as path traversal, allows a malicious package to write files to unintended locations on Windows systems during the extraction of compressed archives (tarballs). The issue arises because pnpm's path normalization process does not properly account for Windows-specific directory separators. This could enable an attacker to overwrite important configuration files, potentially leading to unauthorized code execution or system compromise.

Statement: This vulnerability is rated Moderate. However, in the Red Hat context, the impact is limited as this path traversal vulnerability in pnpm's tarball extraction is specific to Windows operating systems. Red Hat products, including the affected Enterprise Application Platform components, primarily operate on Linux environments, where this specific attack vector is not applicable.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Suricata: Denial of Service due to XFF handling inefficiencies
CVE: CVE-2026-22261
Component: suricata
Release date: 2026-01-27T18:10:27.881000+00:00

A flaw was found in Suricata, a network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. Various inefficiencies in its eXtended Forwarded For (XFF) handling, particularly for alerts not triggered in a transaction, can lead to severe slowdowns. This vulnerability could allow a remote attacker to cause a Denial of Service by sending specially crafted network traffic.

Statement: This is a LOW impact denial of service vulnerability in Suricata's XFF handling. Red Hat products shipping Suricata are not affected by default, as XFF support is disabled by default in the eve configuration. Exploitation would require an administrator to explicitly enable XFF support.

Remediation:
@langchain/community SSRF Bypass in RecursiveUrlLoader
CVE: CVE-2026-26019
Component: @langchain/community
CWE: CWE-918
Severity: Moderate
CVSS v3: 3.8/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-02-11T21:11:10.166000+00:00

LangChain is a framework for building LLM-powered applications. Prior to 1.1.14, the RecursiveUrlLoader class in @langchain/community is a web crawler that recursively follows links from a starting URL. Its preventOutside option (enabled by default) is intended to restrict crawling to the same site as the base URL. The implementation used String.startsWith() to compare URLs, which does not perform semantic URL validation. An attacker who controls content on a crawled page could include links to domains that share a string prefix with the target, causing the crawler to follow links to attacker-controlled or internal infrastructure. Additionally, the crawler performed no validation against private or reserved IP addresses. A crawled page could include links targeting cloud metadata services, localhost, or RFC 1918 addresses, and the crawler would fetch them without restriction. This vulnerability is fixed in 1.1.14.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Permalink Preview Information Disclosure After Permission Revocation
CVE: CVE-2026-1629
Component: github.com/mattermost/mattermost-server/
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-16T20:24:05.415000+00:00

A missing cache invalidation flaw has been discovered in mattermost server. Affected versions fail to invalidate cached permalink preview data when a user loses channel access which allows the user to continue viewing private channel content via previously cached permalink previews until cache reset or relogin.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Memory safety bugs fixed in Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147
CVE: CVE-2026-0891
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T13:30:59.454000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Memory safety bugs present in Firefox ESR 140.6, Thunderbird ESR 140.6, Firefox 146 and Thunderbird 146. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Calibre: Remote Code Execution via path traversal in CHM reader
CVE: CVE-2026-25635
Component: calibre
CVSS v3: 8.5/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-02-06T20:10:29.839000+00:00

A flaw was found in Calibre's CHM reader. This path traversal vulnerability allows an attacker to write arbitrary files to locations where the user has write permissions. On Windows systems, this could lead to remote code execution by placing a malicious file in the Startup folder, which would then execute upon the user's next login. This vulnerability primarily results in arbitrary code execution.

Statement: This IMPORTANT flaw in Calibre's CHM reader allows an attacker to perform path traversal, leading to arbitrary file writes. This could enable an attacker to write malicious files to arbitrary locations on the filesystem where the user has write permissions. Exploitation requires a user to open a specially crafted CHM file.

Remediation:
PostgreSQL pgcrypto heap buffer overflow executes arbitrary code
CVE: CVE-2026-2005
Component: postgresql
CWE: CWE-120
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-12T13:00:09.784000+00:00

A heap based buffer overflow flaw has been discovered in PostgreSQL. This Heap buffer overflow is in the `pgcrypto` component and allows a ciphertext provider to execute arbitrary code as the operating system user running the database.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
web-auth/webauthn-lib: Origin validation bypass due to host component reduction
CVE: CVE-2026-30964
Component: web-auth/webauthn-lib
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-03-10T17:16:46.895000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: