huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
mm, shmem: prevent infinite loop on truncate race
CVE: CVE-2026-23177
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

An infinite loop vulnerability was found in the Linux kernel's shmem (shared memory) truncate handling. When truncating a large swap entry where the index points to the middle of the entry, the code can enter an infinite loop repeatedly finding and failing to free the same entry, causing a system hang.

Statement: This affects systems using tmpfs/shmem with large folios and swap. A local user can trigger the infinite loop by performing truncate operations on shmem files with specific swap entry alignments. The result is denial of service but no privilege escalation or data exposure.

Remediation:
GStreamer: Remote Code Execution via heap-based buffer overflow in JPEG parser
CVE: CVE-2026-3082
Component: GStreamer
CWE: CWE-120
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:39:33.772000+00:00

A flaw was found in GStreamer. A remote attacker can exploit a heap-based buffer overflow vulnerability in the GStreamer JPEG parser by providing a specially crafted JPEG file. This issue is caused by improper validation of Huffman table lengths, which can lead to arbitrary code execution in the context of the current process.

Statement: This is an IMPORTANT heap-based buffer overflow vulnerability in the GStreamer JPEG parser. The flaw allows remote code execution when processing a specially crafted JPEG file due to improper validation of Huffman table lengths. Red Hat products utilizing GStreamer to process untrusted JPEG content are affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
astral-tokio-tar: Potential archive misinterpretation via malformed PAX extensions
CVE: CVE-2026-32766
Component: astral-tokio-tar
CWE: CWE-1286
Severity: Low
CVSS v3: 2.5/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-03-20T00:07:36.444000+00:00

A flaw was found in astral-tokio-tar, a software component for handling tar archives. This flaw causes malformed PAX (Portable Archive eXchange) extensions within an archive to be silently ignored. An attacker could leverage this to create a specially crafted archive that, when processed by astral-tokio-tar and then by another vulnerable tar program, could be interpreted differently. This 'parser differential' might lead to misinterpretation of the archive's contents, but it requires a separate vulnerability in the secondary tar program for exploitation.

Statement: This is a LOW impact flaw in `astral-tokio-tar` where malformed PAX extensions are silently ignored, potentially leading to a parser differential. Exploitation requires a secondary, vulnerable tar program that misinterprets these extensions. Red Hat products are only affected if they integrate `astral-tokio-tar` with such a vulnerable secondary parser.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
bn.js: Denial of Service via calling maskn(0)
CVE: CVE-2026-2739
Component: bn.js
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-20T05:00:08.253000+00:00

A flaw was found in bn.js. When calling the `maskn(0)` function on a BN instance, there is potential for this action to corrupt the internal state of the library, causing critical methods such as `toString()` and `divmod()` to enter an infinite loop. The primary consequence is a Denial of Service (DoS), where the affected process hangs indefinitely.


Remediation:
Strimzi: Unauthorized authentication via misconfigured mTLS CA chain
CVE: CVE-2026-27134
Component: strimzi-kafka-operator
CWE: CWE-295
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-20T23:05:04.320000+00:00

Strimzi provides a way to run an Apache Kafka cluster on Kubernetes or OpenShift in various deployment configurations. In versions  0.49.0 through 0.50.0, when using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs, Strimzi incorrectly configures the trusted certificates for mTLS authentication on the internal as well as user-configured listeners. All CAs from the CA chain will be trusted. And users with certificates signed by any of the CAs in the chain will be able to authenticate. This issue affects only users using a custom Cluster or Clients CA with a multistage CA chain consisting of multiple CAs. It does not affect users using the Strimzi-managed Cluster and Clients CAs. It also does not affect users using custom Cluster or Clients CA with only a single CA (i.e., no CA chain with multiple CAs). This issue has been fixed in version 0.50.1. To workaround this issue, instead of providing the full CA chain as the custom CA, users can provide only the single CA that should be used.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service via infinite recursion in MSL <write> command
CVE: CVE-2026-23874
Component: ImageMagick
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:52:52.916000+00:00

A flaw was found in ImageMagick. A local user could exploit this vulnerability by providing a specially crafted Magick Scripting Language (MSL) file. This file, when processed, could trigger infinite recursion within the `<write>` command, leading to a stack overflow. Successful exploitation results in a Denial of Service (DoS) condition, making the application unavailable.

Statement: This vulnerability is rated Moderate for Red Hat products. It affects ImageMagick, where a stack overflow can occur due to infinite recursion when processing a specially crafted Magick Scripting Language (MSL) file. Exploitation requires an attacker to provide a malicious MSL file to a user or service that processes image files using ImageMagick in affected versions of Red Hat Enterprise Linux and Community Projects.

Remediation:
To mitigate this issue, restrict ImageMagick's ability to process Magick Scripting Language (MSL) files. This can be achieved by adding a policy entry to disable the MSL coder. Create or modify the ImageMagick policy file (e.g., `/etc/ImageMagick-7/policy.xml` or `/etc/ImageMagick/policy.xml`) to include the following line within the `<policymap>` tags:

```xml
<policy domain="coder" rights="none" pattern="MSL" />
```

After modifying the policy file, services or applications that use ImageMagick may need to be restarted for the changes to take effect. This may impact functionality that relies on processing MSL files.
libsoup: Buffer overread due to integer underflow when handling zero-length resources
CVE: CVE-2026-2369
Component: libsoup
CWE: CWE-191
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-02-11T11:11:00+00:00

A flaw was found in libsoup. An integer underflow vulnerability occurs when processing content with a zero-length resource, leading to a buffer overread. This can allow an attacker to potentially access sensitive information or cause an application level denial of service.

Statement: This MODERATE impact flaw in libsoup arises from an integer underflow when processing content with zero-length resources, leading to a buffer overread. This vulnerability could allow an attacker to potentially access sensitive information or cause an application-level denial of service. Red Hat Enterprise Linux and Fedora systems utilizing libsoup are affected when applications process such malformed content.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service via uninitialized pointer dereference in JBIG decoder
CVE: CVE-2026-28691
Component: ImageMagick
CWE: CWE-824
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-09T21:40:42.117000+00:00

A flaw was found in ImageMagick. This vulnerability, an uninitialized pointer dereference, exists in the JBIG decoder due to a missing check. A remote attacker could exploit this by providing a specially crafted image file, leading to a denial of service. This could make the ImageMagick application unavailable to users.

Statement: This is an IMPORTANT vulnerability affecting ImageMagick, present in Red Hat Enterprise Linux 6 ELS and 7 ELS. An uninitialized pointer dereference in the JBIG decoder could lead to a denial of service when processing a specially crafted JBIG image.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Improperly Controlled Sequential Memory Allocation in Wireshark
CVE: CVE-2026-3201
Component: wireshark
CWE: CWE-1325
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-25T14:35:50.969000+00:00

A flaw was found in the USB HID dissector in Wireshark. This issue occurs when malformed packets are decoded from a pcap file or the network, causing an excessive consumption of memory, resulting in a denial of service.

Statement: This issue will cause a crash in Wireshark with no other security impact. Also, this flaw can only be exploited when a malformed pcap file is processed. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
If the USB HID protocol dissector is not being used, it can be disabled via the "Enabled Protocols" dialog box in the Wireshark GUI application. This will also disable the protocol dissector when using "tshark", the command line tool.

See the links below for instructions to disable a protocol in Wireshark, specifically the "Control Protocol Dissection" section and the "disabled_protos" configuration file option.

https://www.wireshark.org/docs/wsug_html_chunked/ChCustProtocolDissectionSection.html
https://www.wireshark.org/docs/wsug_html_chunked/ChAppFilesConfigurationSection.html
CVE: CVE-2026-2040
Component: PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability
Release date: 2026-02-19T14:24:40.432000+00:00

PDF-XChange Editor TrackerUpdate Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of PDF-XChange Editor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the TrackerUpdate process. The product loads a library from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute code in the context of a target user. Was ZDI-CAN-27788.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
pypdf: Denial of Service via crafted PDF with ASCIIHexDecode filter
CVE: CVE-2026-28804
Component: pypdf
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-06T06:46:28.890000+00:00

pypdf is a free and open-source pure-python PDF library. Prior to version 6.7.5, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires accessing a stream which uses the /ASCIIHexDecode filter. This issue has been patched in version 6.7.5.


Remediation:
To mitigate this issue, avoid processing untrusted PDF documents with applications that use the pypdf library. If processing untrusted PDFs is unavoidable, consider sandboxing the application responsible for PDF processing to limit potential resource exhaustion.
thunderbird: Uninitialized memory in the Graphics: Text component
CVE: CVE-2026-2806
Component: firefox
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-02-24T13:33:33.407000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Uninitialized memory in the Graphics: Text component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
FreeRDP heap-buffer-overflow
CVE: CVE-2026-22859
Component: freerdp
CWE: CWE-125
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Release date: 2026-01-14T17:57:37+00:00

A heap based buffer overflow has been discovered in FreeRDP. In affected versions the URBDRC client does not perform bounds checking on server‑supplied MSUSB_INTERFACE_DESCRIPTOR values and uses them as indices in libusb_udev_complete_msconfig_setup, causing an out‑of‑bounds read.

Statement: Red Hat products in their default configuration employ Address Space Layout Randomization (ASLR) which drastically increases the complexity of the successful exploitation of this flaw.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
platform/x86/amd: Fix memory leak in wbrf_record()
CVE: CVE-2026-23065
Component: kernel
Severity: Moderate
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

platform/x86/amd: Fix memory leak in wbrf_record()

The tmp buffer is allocated using kcalloc() but is not freed if
acpi_evaluate_dsm() fails. This causes a memory leak in the error path.

Fix this by explicitly freeing the tmp buffer in the error handling
path of acpi_evaluate_dsm().


Remediation:
Keycloak: Information Disclosure via improper role enforcement in UMA 2.0 Protection API
CVE: CVE-2026-3190
Component: keycloak
CWE: CWE-280
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-25T07:07:00+00:00

No description is available for this CVE.

Statement: The issue was rated as Moderate. This flaw in Keycloak allows information disclosure due to improper role enforcement in the UMA 2.0 Protection API. An authenticated user with a token issued for a resource server client, even without the `uma_protection` role, can enumerate all permission tickets in the system.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Integer overflow in the Libraries component in NSS
CVE: CVE-2026-2781
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:15.551000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Integer overflow in the Libraries component in NSS

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Insufficient policy enforcement in PDF
CVE: CVE-2026-3939
Component: chromium-browser
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-03-10T00:00:00+00:00

An insufficient policy enforcement flaw was found in the PDF component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=40058077

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
pypdf: Denial of Service via malformed PDF /FlateDecode stream
CVE: CVE-2026-27026
Component: pypdf
CWE: CWE-1050
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-20T21:12:33.537000+00:00

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes. This requires a malformed /FlateDecode stream, where the byte-by-byte decompression is used. This vulnerability is fixed in 6.7.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Spring Boot: Authentication bypass via misconfigured Health Group additional path
CVE: CVE-2026-22731
Component: Spring Boot
CWE: CWE-305
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Release date: 2026-03-19T22:36:15.112000+00:00

A flaw was found in Spring Boot. This vulnerability, an authentication bypass, occurs when an application endpoint requiring authentication is declared under a specific path already configured for a Health Group additional path. A remote attacker could exploit this to bypass authentication, potentially gaining unauthorized access to sensitive application endpoints. This could lead to information disclosure or unauthorized actions.


Remediation:
To mitigate, ensure that application endpoints requiring authentication are not declared under paths already configured as Health Group additional paths within Spring Boot applications using Actuator. Review and adjust your application's configuration to prevent this overlap. A redeployment of the application is required for changes to take effect.
FTP GVfs backend: Arbitrary FTP command injection via CRLF sequences in file paths
CVE: CVE-2026-28296
Component: gvfs
CWE: CWE-93
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2026-02-26T00:00:00+00:00

A flaw was found in the FTP GVfs backend. A remote attacker could exploit this input validation vulnerability by supplying specially crafted file paths containing carriage return and line feed (CRLF) sequences. These unsanitized sequences allow the attacker to terminate intended FTP commands and inject arbitrary FTP commands, potentially leading to arbitrary code execution or other severe impacts.

Statement: The GVfs FTP backend is vulnerable to command injection due to improper sanitization of user-supplied file paths. An attacker could craft a malicious FTP path containing CRLF sequences to inject arbitrary FTP commands. This primarily impacts systems where users interact with untrusted FTP servers or open specially crafted FTP links through applications utilizing GVfs, typically in desktop environments.

Remediation:
To reduce the risk associated with this vulnerability, users should avoid connecting to untrusted FTP servers or opening FTP links from unverified sources. Implementing network-level restrictions, such as firewall rules, to limit outbound connections to only trusted FTP servers can further mitigate potential exposure. If the GVfs FTP backend is not essential for daily operations, consider removing or disabling packages that provide this functionality, though this action may affect other desktop environment features that rely on GVfs for FTP access.
Linux kernel: Denial of Service in L2TP due to data-race during tunnel deletion
CVE: CVE-2026-23120
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP) implementation. A local user can exploit a data-race condition during L2TP tunnel deletion. This occurs when the l2tp_tunnel_del_work function attempts to read socket information without proper synchronization while the underlying socket is concurrently closed. Successfully exploiting this timing window can lead to a kernel crash or system hang, resulting in a Denial of Service (DoS).

Statement: A race exists in the L2TP tunnel deletion workqueue path where l2tp_tunnel_del_work read sk->sk_socket without synchronization while another task could concurrently orphan and close the underlying socket. KCSAN reports a data race where sk_socket changes from a valid pointer to NULL during the work execution. This is primarily a stability issue that can lead to incorrect behavior and potentially a kernel crash or hang depending on timing and follow on code paths. For the CVSS the PR is L because a local user can create and close sockets and can trigger L2TP teardown operations through normal interfaces. The attack complexity is high because it requires winning a narrow timing window between socket close and the deferred tunnel deletion work. Impact is mainly availability due to potential kernel crash.

Remediation:
Heap buffer overflow in libvpx
CVE: CVE-2026-2447
Component: libvpx
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-16T14:13:23.559000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Heap buffer overflow in libvpx.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Information disclosure in the Networking component
CVE: CVE-2026-0883
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-13T13:30:56.043000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Information disclosure in the Networking component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Out of bounds memory access in WebGL
CVE: CVE-2026-4439
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An out of bounds memory access flaw was found in the WebGL component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=475877320

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Ettercap: Denial of Service via out-of-bounds read in etterfilter
CVE: CVE-2026-3606
Component: Ettercap
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-03-05T22:02:07.360000+00:00

A flaw was found in Ettercap. A local user can exploit an out-of-bounds read vulnerability within the `add_data_segment` function of the `etterfilter` component. By manipulating input, an attacker can trigger this flaw, potentially leading to a denial of service.

Statement: This MODERATE vulnerability in Ettercap's etterfilter component allows a local authenticated user to trigger an out-of-bounds read. Exploitation requires local access and low privileges, with low impact to confidentiality and availability. Red Hat products are affected if Ettercap is installed.

Remediation: