huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Keycloak: Unauthorized access via improper validation of encrypted SAML assertions
CVE: CVE-2026-2092
Component: keycloak-services
CWE: CWE-1287
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Release date: 2026-03-05T12:34:00+00:00

A flaw was found in Keycloak. Keycloak's Security Assertion Markup Language (SAML) broker endpoint does not properly validate encrypted assertions when the overall SAML response is not signed. An attacker with a valid signed SAML assertion can exploit this by crafting a malicious SAML response. This allows the attacker to inject an encrypted assertion for an arbitrary principal, leading to unauthorized access and potential information disclosure.

Statement: The issue is rated as important severity. A flaw in Red Hat Build of Keycloak's SAML broker endpoint allows unauthorized access. When the overall SAML response is not signed, an attacker with a valid signed SAML assertion can craft a malicious response to inject an encrypted assertion for an arbitrary principal. This leads to unauthorized access and potential information disclosure.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Apache Solr: Unauthorized bypass of certain "predefined permission" rules in the RuleBasedAuthorizationPlugin
CVE: CVE-2026-22022
Component: org.apache.solr/solr-core
CWE: CWE-285
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Release date: 2026-01-21T13:41:46.346000+00:00

Deployments of Apache Solr 5.3.0 through 9.10.0 that rely on Solr's "Rule Based Authorization Plugin" are vulnerable to allowing unauthorized access to certain Solr APIs, due to insufficiently strict input validation in those components.  Only deployments that meet all of the following criteria are impacted by this vulnerability:

  *  Use of Solr's "RuleBasedAuthorizationPlugin"
  *  A RuleBasedAuthorizationPlugin config (see security.json) that specifies multiple "roles"
  *  A RuleBasedAuthorizationPlugin permission list (see security.json) that uses one or more of the following pre-defined permission rules: "config-read", "config-edit", "schema-read", "metrics-read", or "security-read".
  *  A RuleBasedAuthorizationPlugin permission list that doesn't define the "all" pre-defined permission
  *  A networking setup that allows clients to make unfiltered network requests to Solr. (i.e. user-submitted HTTP/HTTPS requests reach Solr as-is, unmodified or restricted by any intervening proxy or gateway)

Users can mitigate this vulnerability by ensuring that their RuleBasedAuthorizationPlugin configuration specifies the "all" pre-defined permission and associates the permission with an "admin" or other privileged role.  Users can also upgrade to a Solr version outside of the impacted range, such as the recently released Solr 9.10.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Integer overflow in Dawn
CVE: CVE-2026-4453
Component: chromium-browser
CVSS v3: 7.4/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Release date: 2026-03-18T00:00:00+00:00

An integer overflow flaw was found in the Dawn component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=488400770

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
io_uring/zcrx: fix page array leak
CVE: CVE-2026-23263
Component: kernel
Severity: None
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
HarfBuzz::Shaper null pointer dereference vulnerability
CVE: CVE-2026-0943
Component: harfbuzz-shaper
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-19T02:46:52.012000+00:00

HarfBuzz::Shaper versions before 0.032 for Perl contains a bundled library with a null pointer dereference vulnerability. 

Versions before 0.032 contain HarfBuzz 8.4.0 or earlier bundled as hb_src.tar.gz in the source tarball, which is affected by CVE-2026-22693.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
heap-based buffer over-read when parsing a malformed MMCIF/CIF file
CVE: CVE-2026-2704
Component: openbabel
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-19T04:32:07.297000+00:00

A security vulnerability has been detected in Open Babel up to 3.1.1. The affected element is the function OpenBabel::transform3d::DescribeAsString of the file src/math/transform3d.cpp of the component CIF File Handler. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is suggested to install a patch to address this issue. The project was informed of the problem early through an issue report but has not responded yet.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
denial of service via maliciously crafted HTTP or multipart segment headers
CVE: CVE-2026-28356
Component: multipart
CWE: CWE-1333
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-12T16:45:01.070000+00:00

A flaw was found in multipart. The parse_options_header function in multipart.py uses a regular expression with an ambiguous alternation, causing an exponential backtracking (ReDoS) when parsing a specially crafted HTTP or multipart segment headers. A web application parsing request headers or multipart/form-data streams can block request handling threads for multiple seconds per request, eventually resulting in a denial of service.

Statement: This issue is only exploitable in applications using the multipart.parse_form_data function directly or indirectly when parsing request headers or multipart/form-data streams. Also, the security impact of this flaw is limited to a denial of service, there is no corruption of memory or arbitrary code execution. Due to these reasons, this vulnerability has been rated with an important severity.

Remediation:
Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.
Insufficient data validation in Navigation
CVE: CVE-2026-3545
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Insufficient data validation in Navigation in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
ctags: Denial of Service due to uncontrolled recursion
CVE: CVE-2026-2641
Component: ctags
CWE: CWE-835
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-18T05:32:07.920000+00:00

A flaw was found in ctags. A local attacker with low privileges can exploit a weakness in the V Language Parser component by executing a specially crafted input that triggers uncontrolled recursion within the `parseExpression/parseExprList` functions. This vulnerability can lead to a Denial of Service (DoS), making the application unresponsive or unavailable.


Remediation:
Infinite Loop Denial of Service in RAR5 Decompression via archive_read_data() in libarchive
CVE: CVE-2026-4111
Component: libarchive
CWE: CWE-835
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-11T00:00:00+00:00

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path. When a specially crafted RAR5 archive is processed, the decompression routine may enter a state where internal logic prevents forward progress. This condition results in an infinite loop that continuously consumes CPU resources. Because the archive passes checksum validation and appears structurally valid, affected applications cannot detect the issue before processing. This can allow attackers to cause persistent denial-of-service conditions in services that automatically process archives.

Statement: The Red Hat Product Security team would likely assess the severity of this vulnerability as High because it allows remote attackers to cause a persistent denial-of-service condition using a small crafted archive file. Successful exploitation requires no authentication, no special configuration, and no user interaction in environments that automatically process uploaded archives. By repeatedly submitting malicious archives, an attacker can exhaust CPU resources or worker threads in services such as file upload systems, CI/CD pipelines, mail scanners, and content indexing services that rely on libarchive for archive extraction.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
vips: libvips: Integer overflow leads to denial of service
CVE: CVE-2026-3284
Component: libvips
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-27T03:02:09.219000+00:00

A flaw was found in libvips. A local attacker could exploit an integer overflow vulnerability in the `vips_extract_area_build` function by manipulating the `extract_area` argument. This could lead to a denial of service (DoS) condition.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/sched: sch_qfq: do not free existing class in qfq_change_class()
CVE: CVE-2026-22999
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: sch_qfq: do not free existing class in qfq_change_class()

Fixes qfq_change_class() error case.

cl->qdisc and cl should only be freed if a new class and qdisc
were allocated, or we risk various UAF.

Statement: A use-after-free can occur in sch_qfq when qfq_change_class() hits an error path that incorrectly frees an already-existing class/qdisc. An attacker with network administration capabilities (typically CAP_NET_ADMIN, often obtainable inside a user namespace) can trigger the bug via crafted tc class changes, leading to a kernel crash.

Remediation:
Linux kernel: Denial of Service in sch_qfq due to NULL pointer dereference
CVE: CVE-2026-22976
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-21T06:57:23.939000+00:00

A flaw was found in the Linux kernel's `sch_qfq` (Quick Fair Queueing) scheduler. This vulnerability allows a local user to trigger a NULL pointer dereference in the `qfq_reset` function. The issue arises when multiple `qfq_class` objects incorrectly reference the same `leaf_qdisc`, leading to an attempt to deactivate an already inactive aggregate. Successful exploitation of this flaw can result in a system crash, causing a Denial of Service (DoS).


Remediation:
f2fs: fix to avoid UAF in f2fs_write_end_io()
CVE: CVE-2026-23234
Component: kernel
Severity: None
Release date: 2026-03-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix to avoid UAF in f2fs_write_end_io()

As syzbot reported an use-after-free issue in f2fs_write_end_io().

It is caused by below race condition:

loop device				umount
- worker_thread
 - loop_process_work
  - do_req_filebacked
   - lo_rw_aio
    - lo_rw_aio_complete
     - blk_mq_end_request
      - blk_update_request
       - f2fs_write_end_io
        - dec_page_count
        - folio_end_writeback
					- kill_f2fs_super
					 - kill_block_super
					  - f2fs_put_super
					 : free(sbi)
       : get_pages(, F2FS_WB_CP_DATA)
         accessed sbi which is freed

In kill_f2fs_super(), we will drop all page caches of f2fs inodes before
call free(sbi), it guarantee that all folios should end its writeback, so
it should be safe to access sbi before last folio_end_writeback().

Let's relocate ckpt thread wakeup flow before folio_end_writeback() to
resolve this issue.


Remediation:
Glib: Local denial of service via buffer underflow in content type parsing
CVE: CVE-2026-1485
Component: Glib
CWE: CWE-124
Severity: Low
CVSS v3: 2.9/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-01-27T00:00:00+00:00

A flaw was found in Glib's content type parsing logic. This buffer underflow vulnerability occurs because the length of a header line is stored in a signed integer, which can lead to integer wraparound for very large inputs. This results in pointer underflow and out-of-bounds memory access. Exploitation requires a local user to install or process a specially crafted treemagic file, which can lead to local denial of service or application instability.

Statement: This vulnerability is rated Low for Red Hat. Exploitation requires a local user to install or process a specially crafted treemagic file, which limits the practical impact to local denial of service or application instability. Red Hat products are affected where GLib is used to process untrusted treemagic files.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
heap-based buffer over-read in GSSAPI error handling
CVE: CVE-2026-2303
Component: mongo-go-driver
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-10T19:03:06.737000+00:00

The mongo-go-driver repository contains CGo bindings for GSSAPI (Kerberos) authentication on Linux and macOS. The C wrapper implementation contains a heap out-of-bounds read vulnerability due to incorrect assumptions about string termination in the GSSAPI standard. Since GSSAPI buffers are not guaranteed to be null-terminated or have extra padding, this results in reading one byte past the allocated heap buffer.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-0781
Component: ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:54:21.358000+00:00

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28290.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
AprilRobotics apriltag: Memory corruption leads to denial of service via local input manipulation
CVE: CVE-2026-2246
Component: apriltag
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T19:32:07.858000+00:00

A security vulnerability has been detected in AprilRobotics apriltag up to 3.4.5. Affected by this vulnerability is the function apriltag_detector_detect of the file apriltag.c. The manipulation leads to memory corruption. The attack must be carried out locally. The exploit has been disclosed publicly and may be used. The identifier of the patch is cfac2f5ce1ffe2de25967eb1ab80bc5d99fc1a61. It is suggested to install a patch to address this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nscd client crash on x86_64 under high nscd load
CVE: CVE-2026-3904
Component: glibc
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-11T13:19:09.741000+00:00

A flaw was found in glibc. When calling NSS-backed functions that support caching via nscd, the nscd client under high load on x86_64 systems may call the memcmp function on inputs that are concurrently modified by other processes or threads, causing a crash and resulting in a denial of service.

Statement: This issue is only exploitable via applications using NSS-backed functions that support caching via nscd under a high load on x86_64 systems. It depends on a race condition on inputs that are concurrently modified by other processes or threads during memory access, increasing the complexity of exploitation. Also, this flaw can only cause an application crash, limiting the security impact to a denial of service. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
htslib: Information disclosure and denial of service due to insufficient CRAM feature data validation
CVE: CVE-2026-31966
Component: htslib
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-03-18T18:58:47.090000+00:00

A flaw was found in htslib, a library for reading and writing bioinformatics file formats. Specifically, within the CRAM (Compressed Reference-oriented Alignment Map) decoding process, insufficient validation of feature data series could allow a remote attacker to craft malicious CRAM records. This could lead to an out-of-bounds read, resulting in the disclosure of arbitrary program data or a program crash, causing a Denial of Service (DoS).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Keycloak SAML brokering: Response delay due to unchecked NotOnOrAfter in SubjectConfirmationData
CVE: CVE-2026-1190
Component: org.keycloak/keycloak-services
CWE: CWE-112
Severity: Low
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-01-19T08:08:00+00:00

A flaw was found in Keycloak's SAML brokering functionality. When Keycloak is configured as a client in a Security Assertion Markup Language (SAML) setup, it fails to validate the `NotOnOrAfter` timestamp within the `SubjectConfirmationData`. This allows an attacker to delay the expiration of SAML responses, potentially extending the time a response is considered valid and leading to unexpected session durations or resource consumption.

Statement: This vulnerability is rated Low for Red Hat products. In the Red Hat context, this flaw in Keycloak's SAML brokering functionality allows an attacker to delay the expiration of SAML responses by not validating the `NotOnOrAfter` timestamp in `SubjectConfirmationData`. This could lead to unexpected session durations or increased resource consumption.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service in ems_usb CAN USB driver due to memory leak
CVE: CVE-2026-23058
Component: kernel
CWE: CWE-401
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak

Fix similar memory leak as in commit 7352e1d5932a ("can: gs_usb:
gs_usb_receive_bulk_callback(): fix URB memory leak").

In ems_usb_open(), the URBs for USB-in transfers are allocated, added to
the dev->rx_submitted anchor and submitted. In the complete callback
ems_usb_read_bulk_callback(), the URBs are processed and resubmitted. In
ems_usb_close() the URBs are freed by calling
usb_kill_anchored_urbs(&dev->rx_submitted).

However, this does not take into account that the USB framework unanchors
the URB before the complete function is called. This means that once an
in-URB has been completed, it is no longer anchored and is ultimately not
released in ems_usb_close().

Fix the memory leak by anchoring the URB in the
ems_usb_read_bulk_callback() to the dev->rx_submitted anchor.

Statement: A memory leak can occur in the ems_usb CAN USB driver because completed RX URBs are unanchored by the USB core before the completion callback runs. The driver anchored URBs only during open and then relied on usb_kill_anchored_urbs during close to free them. Once an URB completes it is no longer in the rx_submitted anchor and it can escape cleanup which leads to leaked URB allocations over repeated activity and open close cycles. For the CVSS the PR is L in the paranoid rating because a user with access to the CAN network interface can often trigger open close or device use through standard networking administration in delegated environments. The issue is not directly network reachable in the IP sense. Impact is denial of service via resource exhaustion over time.

Remediation: