huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Fiber: Denial of Service via excessive route parameters
CVE: CVE-2026-25882
Component: github.com/gofiber/fiber/v2
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T21:05:28.211000+00:00

Fiber is an Express inspired web framework written in Go. A denial of service vulnerability exists in Fiber v2 and v3 that allows remote attackers to crash the application by sending requests to routes with more than 30 parameters. The vulnerability results from missing validation during route registration combined with an unbounded array write during request matching. Version 2.52.12 patches the issue in the v2 branch and 3.1.0 patches the issue in the v3 branch.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Out of bounds write in Skia
CVE: CVE-2026-3909
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-12T00:00:00+00:00

An out of bounds write flaw was found in the Skia component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=491421267

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Seroval: Denial of Service via malicious regular expressions during deserialization
CVE: CVE-2026-23956
Component: seroval
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-22T01:23:58.922000+00:00

A flaw was found in seroval, a JavaScript (JS) value stringification library. A remote attacker could exploit this vulnerability by providing specially crafted regular expressions during deserialization. This could lead to the exhaustion of JavaScript runtime memory or trigger a Regular Expression Denial of Service (ReDoS), making the application unavailable to legitimate users.

Statement: This vulnerability is rated Important for Red Hat as it can lead to a Denial of Service in applications utilizing the `seroval` library. Specifically, versions 1.4.0 and below are susceptible to memory exhaustion or Regular Expression Denial of Service (ReDoS) when processing maliciously crafted serialized regular expressions. This affects community projects such as Forgejo in Fedora and EPEL.

Remediation:
artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication
CVE: CVE-2026-27446
Component: org.apache.artemis
CWE: CWE-306
Severity: Important
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-04T06:06:00+00:00

A flaw was found in Apache Artemis and Apache ActiveMQ Artemis. An unauthenticated remote attacker can exploit a missing authentication for critical function vulnerability by using the Core protocol. This allows the attacker to force a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker. The primary consequence is the potential for message injection into any queue and/or message exfiltration from any queue via the rogue broker.

Statement: This IMPORTANT vulnerability in Apache Artemis and Apache ActiveMQ Artemis allows an unauthenticated remote attacker to inject or exfiltrate messages by forcing a target broker to establish an outbound Core federation connection to an attacker-controlled rogue broker.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings.

The References section of this erratum contains a download link (you must log in to download the update).
To mitigate this issue, restrict Core protocol support on acceptors receiving connections from untrusted sources. The default "artemis" acceptor on port 61616 supports all protocols, including Core. Modify the acceptor URL to explicitly exclude the Core protocol using the "protocols" URL parameter. Alternatively, configure two-way SSL with certificate-based authentication to prevent unauthenticated exploitation. A service restart or reload may be required for changes to take effect.
Avahi: Denial of Service via recursive CNAME record in mDNS response
CVE: CVE-2026-24401
Component: avahi
CWE: CWE-674
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-24T01:25:02.294000+00:00

A flaw was found in Avahi, a system that enables devices to discover services on a local network. A remote attacker can exploit this vulnerability by sending a specially crafted mDNS (multicast Domain Name System) response containing a recursive CNAME (Canonical Name) record. This triggers an uncontrolled recursion within the avahi-daemon process, leading to stack exhaustion and causing the service to crash. This results in a denial of service (DoS) for affected systems.

Statement: This MODERATE impact flaw in Avahi's `avahi-daemon` can lead to a denial of service. An attacker on the local network could send a specially crafted, unsolicited mDNS response containing a recursive CNAME record, causing unbounded recursion and a crash. This affects systems where Avahi's record browsers explicitly use multicast, such as those utilizing `nss-mdns`.

Remediation:
To mitigate this issue, disable the avahi-daemon service if mDNS/DNS-SD functionality is not required on the system.

```bash
sudo systemctl disable --now avahi-daemon.service
sudo systemctl mask avahi-daemon.service
```

Disabling this service may impact applications relying on mDNS for local network service discovery. A system reboot or service reload may be required for the changes to take full effect.
Vim: Integrity impact due to stack-buffer-overflow via wide terminal statusline rendering
CVE: CVE-2026-28422
Component: vim
CWE: CWE-135
Severity: Low
CVSS v3: 2.3/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-02-27T22:08:11.384000+00:00

A flaw was found in Vim, an open-source command-line text editor. A local user could exploit a stack-buffer-overflow vulnerability in the `build_stl_str_hl()` function by rendering a statusline with a multi-byte fill character on a very wide terminal. This could lead to an integrity impact, where data might be modified.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation
CVE: CVE-2026-25210
Component: libexpat
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.9/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L
Release date: 2026-01-30T06:40:27.917000+00:00

A flaw was found in libexpat. A local attacker could exploit an integer overflow vulnerability in the doContent function. This flaw occurs because the buffer size is not properly determined during tag buffer reallocation, which can lead to memory corruption. Successful exploitation may result in information disclosure and data integrity issues.


Remediation:
OpenLDAP LMDB: Denial of Service and Information Disclosure via Heap Buffer Underflow
CVE: CVE-2026-22185
Component: OpenLDAP
CWE: CWE-191
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-01-07T20:26:30.054000+00:00

A flaw was found in OpenLDAP Lightning Memory-Mapped Database (LMDB) mdb_load. When processing malformed input, a local attacker can exploit a heap buffer underflow vulnerability in the readline() function. This can lead to an out-of-bounds read, potentially causing a denial of service (DoS) and limited disclosure of heap memory contents.

Statement: This vulnerability is classified as Moderate rather than Important because its impact and exploitability are limited in scope and consequence. The flaw results in a one-byte heap out-of-bounds read caused by an integer underflow in mdb_load, which is a local, administrative utility rather than a long-running network-exposed service. Exploitation requires local execution and the ability to supply a malformed LMDB input file, significantly reducing the attack surface. While the issue can reliably trigger a process crash and may disclose minimal adjacent heap data, it does not allow memory corruption, privilege escalation, or arbitrary code execution. The confidentiality impact is low and bounded, and the availability impact is confined to the mdb_load invocation itself, not to the OpenLDAP daemon or directory service at runtime.

Remediation:
To reduce the risk from this vulnerability, administrators should avoid processing untrusted or externally supplied LMDB database files with mdb_load and restrict its use to trusted, local users only.
Pydantic AI: Arbitrary code execution and information disclosure via path traversal in web UI
CVE: CVE-2026-25640
Component: Pydantic AI
CWE: CWE-22
Severity: Important
CVSS v3: 7.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2026-02-06T20:01:53.892000+00:00

A flaw was found in Pydantic AI. A remote attacker can exploit a path traversal vulnerability in the Pydantic AI web UI by crafting a malicious URL. This vulnerability arises from insufficient validation of the version query parameter, allowing the server to fetch and serve attacker-controlled HTML or JavaScript. If a victim clicks on such a link, malicious code can execute in their browser, potentially leading to the theft of sensitive client-side data, including chat history.

Statement: This IMPORTANT vulnerability in Pydantic AI, as included in Red Hat Enterprise Linux AI, involves a path traversal flaw in the web UI's CDN URL construction. An attacker can exploit this by crafting a malicious URL, leading to arbitrary JavaScript execution in a victim's browser if they click the link. This primarily affects deployments utilizing Agent.to_web or clai web for chat interfaces.

Remediation:
To reduce exposure, restrict network access to the Pydantic AI web interface. If the application is deployed on a remote server, configure firewall rules to limit access to trusted networks or localhost. This prevents untrusted clients from reaching the vulnerable component. After applying firewall changes, ensure the rules are persistent and the firewall service is reloaded.
Pillow: Out-of-bounds Write via Specially Crafted PSD Image
CVE: CVE-2026-25990
Component: pillow
CWE: CWE-787
Severity: Important
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-02-11T20:53:52.524000+00:00

A flaw was found the Pillow Python imaging library. Providing a specially crafted PSD image  may lead to an out-of-bounds write. This could potentially allow for arbitrary code execution or information disclosure.


Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:4128
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP has a Heap-buffer-overflow in audio_formats_free
CVE: CVE-2026-24682
Component: freerdp
CWE: CWE-131
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:21:39.733000+00:00

A heap buffer overflow has been discovered in FreeRDP. audin_server_recv_formats frees an incorrect number of audio formats on parse failure (i + i), leading to out-of-bounds access in audio_formats_free.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
btrfs: zlib: fix the folio leak on S390 hardware acceleration
CVE: CVE-2026-23147
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A memory leak flaw was found in the Linux kernel's btrfs filesystem zlib compression code when using S390 hardware acceleration. Due to a missing folio_put() call in the copy_data_into_buffer() function, page cache folios are not released after use during compression operations. This can lead to gradual memory exhaustion on affected S390 systems using btrfs with compression enabled.

Statement: This vulnerability is specific to S390 architecture systems using btrfs with zlib compression and hardware acceleration enabled. The flaw was introduced by a code refactor and requires sustained filesystem compression activity to cause noticeable memory pressure.

Remediation:
GraphQL Injection Leading to Platform-Wide Denial of Service (DoS) in RH Developer Hub Orchestrator Plugin
CVE: CVE-2026-3118
Component: rhdh
CWE: CWE-89
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T00:00:00+00:00

A security flaw was identified in the Orchestrator Plugin of Red Hat Developer Hub (Backstage). The issue occurs due to insufficient input validation in GraphQL query handling. An authenticated user can inject specially crafted input into API requests, which disrupts backend query processing. This results in the entire Backstage application crashing and restarting, leading to a platform-wide Denial of Service (DoS). As a result, legitimate users temporarily lose access to the platform.

Statement: This MODERATE impact vulnerability in the Orchestrator Plugin of Red Hat Developer Hub (Backstage) allows an authenticated attacker to cause a platform-wide Denial of Service. By injecting specially crafted input into GraphQL API requests, an attacker can disrupt backend query processing, leading to the application crashing and restarting. This issue temporarily prevents legitimate users from accessing the platform.

Remediation:
To mitigate this issue, restrict network access to the Red Hat Developer Hub instance to trusted users and networks only. This limits the exposure of the vulnerable Orchestrator Plugin to unauthorized access.
Multer: Denial of Service via dropped file upload connections
CVE: CVE-2026-2359
Component: multer
CWE: CWE-772
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-27T15:42:08.088000+00:00

A flaw was found in Multer, a Node.js middleware for handling `multipart/form-data`. A remote attacker can exploit this vulnerability by intentionally dropping a connection during a file upload. This can lead to a Denial of Service (DoS) due to resource exhaustion on the affected system.


Remediation:
GMT: Stack-based Buffer Overflow in gmt_remote_dataset_id
CVE: CVE-2026-33147
Component: gmt
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-20T20:10:28.066000+00:00

A flaw was found in GMT (Generic Mapping Tools), an open-source collection of command-line tools. This vulnerability, a stack-based buffer overflow, occurs when a specially crafted long string is used as a dataset identifier. An attacker could exploit this to cause the application to crash or potentially execute unauthorized code. This could lead to a compromise of the affected system.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Jenkins: Origin validation bypass via DNS rebinding in CLI WebSocket endpoint
CVE: CVE-2026-33002
Component: jenkins
CWE: CWE-346
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2026-03-18T15:15:25.002000+00:00

A flaw was found in Jenkins. A remote attacker could exploit a vulnerability in the origin validation of requests made through the Command Line Interface (CLI) WebSocket endpoint. By manipulating the Host or X-Forwarded-Host HTTP headers, an attacker can perform Domain Name System (DNS) rebinding attacks. This allows bypassing the origin validation, potentially leading to unauthorized actions within the Jenkins environment.

Statement: This vulnerability is rated as Moderate by Red Hat, as the possible impacts of successful exploitation are tied to the permissions assigned to the anonymous user.

Remediation:
Apache Shiro: Brute force attack possible to determine valid user names
CVE: CVE-2026-23901
Component: org.apache.shiro/shiro-core
CWE: CWE-208
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-10T09:25:51.765000+00:00

Observable Timing Discrepancy vulnerability in Apache Shiro.

This issue affects Apache Shiro: from 1.*, 2.* before 2.0.7.

Users are recommended to upgrade to version 2.0.7 or later, which fixes the issue.

Prior to Shiro 2.0.7, code paths for non-existent vs. existing users are different enough,
that a brute-force attack may be able to tell, by timing the requests only, determine if
the request failed because of a non-existent user vs. wrong password.

The most likely attack vector is a local attack only.
Shiro security model  https://shiro.apache.org/security-model.html#username_enumeration  discusses this as well.

Typically, brute force attack can be mitigated at the infrastructure level.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
HDF5: Denial of Service due to heap buffer overflow when parsing a crafted h5 file
CVE: CVE-2026-26200
Component: hdf5
CWE: CWE-131
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-19T19:19:10.512000+00:00

HDF5 is software for managing data. Prior to version 1.14.4-2, an attacker who can control an `h5` file parsed by HDF5 can trigger a write-based heap buffer overflow condition. This can lead to a denial-of-service condition, and potentially further issues such as remote code execution depending on the practical exploitability of the heap overflow against modern operating systems. Real-world exploitability of this issue in terms of remote-code execution is currently unknown. Version 1.14.4-2 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
lib/buildid: use __kernel_read() for sleepable context
CVE: CVE-2026-23002
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

lib/buildid: use __kernel_read() for sleepable context

Prevent a "BUG: unable to handle kernel NULL pointer dereference in
filemap_read_folio".

For the sleepable context, convert freader to use __kernel_read() instead
of direct page cache access via read_cache_folio().  This simplifies the
faultable code path by using the standard kernel file reading interface
which handles all the complexity of reading file data.

At the moment we are not changing the code for non-sleepable context which
uses filemap_get_folio() and only succeeds if the target folios are
already in memory and up-to-date.  The reason is to keep the patch simple
and easier to backport to stable kernels.

Syzbot repro does not crash the kernel anymore and the selftests run
successfully.

In the follow up we will make __kernel_read() with IOCB_NOWAIT work for
non-sleepable contexts.  In addition, I would like to replace the
secretmem check with a more generic approach and will add fstest for the
buildid code.

Statement: A kernel NULL pointer dereference could be triggered in the lib buildid sleepable parsing path because it accessed file data through direct page cache folio operations and could reach filemap_read_folio in an unsafe state. This leads to a host kernel crash and denial of service. For the CVSS the PR is L because triggering typically requires a local user to exercise buildid parsing through available kernel interfaces such as BPF or related tooling and to provide inputs that force the faultable read path. The issue is not network reachable by itself and depends on local access and system configuration. Impact is denial of service only.

Remediation:
fast-xml-parser: Stack overflow leads to Denial of Service
CVE: CVE-2026-27942
Component: fast-xml-parser
CWE: CWE-776
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-26T01:22:11.383000+00:00

A flaw was found in fast-xml-parser. A user can exploit this flaw by processing specially crafted XML data with the XML builder when the `preserveOrder` option is enabled. This can lead to a stack overflow, causing the application to crash and resulting in a Denial of Service (DoS).


Remediation:
To mitigate this vulnerability, configure applications using the `fast-xml-parser` XML builder to set the `preserveOrder` option to `false`. Alternatively, ensure that all XML input data is thoroughly validated before being passed to the builder to prevent the processing of malicious or malformed content.
minimatch: Denial of Service via specially crafted glob patterns
CVE: CVE-2026-26996
Component: minimatch
CWE: CWE-1333
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-20T03:05:21.105000+00:00

A flaw was found in minimatch. A remote attacker could exploit this Regular Expression Denial of Service (ReDoS) vulnerability by providing a specially crafted glob pattern. This pattern, containing numerous consecutive wildcard characters, causes excessive processing and exponential backtracking in the regular expression engine. Successful exploitation leads to a Denial of Service (DoS), making the application unresponsive.

Statement: Exploitation of this flaw requires that a user or service processes untrusted input.

Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258