huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers
CVE: CVE-2026-22732
Component: Spring Security
CWE: CWE-166
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-19T22:47:38.199000+00:00

A flaw was found in Spring Security. When applications using Spring Security specify HTTP response headers for servlet applications, these headers may not be written. This can lead to a bypass of security policies or information disclosure, potentially allowing an attacker to gain unauthorized access to sensitive data or compromise the integrity of the application.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
GVfs FTP backend: Information disclosure via untrusted PASV responses
CVE: CVE-2026-28295
Component: gvfs
CWE: CWE-918
Severity: Low
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2026-02-26T00:00:00+00:00

A flaw was found in the FTP GVfs backend. A malicious FTP server can exploit this vulnerability by providing an arbitrary IP address and port in its passive mode (PASV) response. The client unconditionally trusts this information and attempts to connect to the specified endpoint, allowing the malicious server to probe for open ports accessible from the client's network.

Statement: This is a LOW impact information disclosure flaw in the GVfs FTP backend. A client connecting to a malicious FTP server could be coerced into probing for open ports accessible from the client's network, as the client unconditionally trusts the IP address and port provided in passive mode (PASV) responses. This vulnerability requires user interaction with a compromised or malicious FTP server.

Remediation:
To mitigate this issue, users should avoid connecting to untrusted or unknown FTP servers when using applications that rely on the GVfs FTP backend. This vulnerability requires the client to interact with a malicious FTP server for exploitation.
CPython: Logging Bypass in Legacy .pyc File Handling
CVE: CVE-2026-2297
Component: cpython
CWE: CWE-778
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-03-04T22:10:43.297000+00:00

A flaw was found in CPython. This vulnerability allows a local user with low privileges to bypass security auditing mechanisms. The issue occurs because the SourcelessFileLoader component, responsible for handling older Python compiled files (.pyc), does not properly trigger system audit events. This oversight could enable malicious activities to go undetected, compromising the integrity of the system.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Privilege escalation in the Netmonitor component
CVE: CVE-2026-2782
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:16.262000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Privilege escalation in the Netmonitor component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
pypdf: Denial of Service via crafted PDF with large font values
CVE: CVE-2026-27025
Component: pypdf
CWE: CWE-1050
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-20T21:11:20.441000+00:00

pypdf is a free and open-source pure-python PDF library. Prior to 6.7.1, an attacker who uses this vulnerability can craft a PDF which leads to long runtimes and large memory consumption. This requires parsing the /ToUnicode entry of a font with unusually large values, for example during text extraction. This vulnerability is fixed in 6.7.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Linux kernel: Denial of Service via unsafe requeue in rxrpc_recvmsg
CVE: CVE-2026-23066
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 7.3/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel. A local unprivileged process can exploit an unsafe requeue path in the `rxrpc_recvmsg` function by using `AF_RXRPC` sockets with `MSG_DONTWAIT` and `MSG_PEEK` flags. This improper handling of the receive message queue can lead to memory corruption, such as Use-After-Frees (UAFs) or reference count underruns. The most likely outcome is a kernel crash or memory safety warning, resulting in a denial of service. There is also a conservative possibility of broader impact if the memory corruption is exploitable.

Statement: An unsafe requeue path in rxrpc_recvmsg can corrupt the recvmsg queue because a call is requeued unconditionally even if it is already on the queue due to MSG_PEEK or a concurrent IO thread requeue. This can corrupt the linked list bookkeeping and can manifest as use after free or refcount underrun in RXRPC call objects. The most likely outcome is a kernel crash or memory safety warning which results in denial of service. For the CVSS the PR is N because a local unprivileged process can trigger the behavior by using AF_RXRPC sockets and recvmsg with MSG_DONTWAIT and MSG_PEEK patterns. The issue is not directly network reachable as a pure remote packet trigger because the vulnerable operation is in the local recvmsg path. Remote traffic can influence timing and queue state but a local caller is still needed to exercise the buggy logic. Impact is primarily availability with a conservative possibility of broader impact if the memory corruption is exploitable.

Remediation:
To mitigate this issue, prevent module rxrpc from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Tornado: Denial of Service via large multipart bodies
CVE: CVE-2026-31958
Component: tornado-python
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-11T19:27:23.380000+00:00

A flaw was found in tornado-python. A remote attacker can exploit this vulnerability by sending a specially crafted, very large multipart body with numerous parts. Because the parsing of these large bodies occurs synchronously on the main thread, it can consume excessive resources, leading to a denial of service (DoS) for the application.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Public Dashboards time range restriction on annotations can be bypassed
CVE: CVE-2026-21722
Component: grafana
CWE: CWE-200
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-12T08:49:05.678000+00:00

A flaw was found in Grafana. Public dashboards with annotations enabled fail to limit their annotation time range to the locked time range of the public dashboard. This flaw allows an attacker to retrieve the entire history of annotations visible on that dashboard, including those outside the locked time range.

Statement: This issue only exposes annotations that would otherwise be visible on the public dashboard if the time range were different, it does not leak annotations from private dashboards or data that is restricted by other permission models. Due to this reason, this vulnerability has been rated with a moderate severity.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Django: SQL Injection via crafted column aliases
CVE: CVE-2026-1287
Component: Django
CWE: CWE-89
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2026-02-03T14:36:03.630000+00:00

A flaw was found in Django. This vulnerability allows a remote attacker to perform SQL injection by using specially crafted control characters within column aliases. When these crafted aliases are passed through dictionary expansion to `QuerySet` methods like `annotate()` or `values()`, it can lead to the execution of arbitrary SQL commands. This could result in unauthorized access to sensitive data or modification of information within the database.

Statement: This IMPORTANT SQL injection flaw in Django allows a remote attacker to execute arbitrary SQL commands by crafting column aliases. This vulnerability affects Red Hat products that incorporate Django, such as Red Hat Ansible Automation Platform, Red Hat Discovery, Red Hat Satellite, Insights, and Ansible Services, potentially leading to unauthorized data access or modification.

Remediation:
For details on how to apply this update, refer to Ansible Automation Platform documentation.
For details on how to apply this update, refer to Ansible Automation Platform documentation.
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
thunderbird: Sandbox escape due to integer overflow in the Graphics component
CVE: CVE-2026-0880
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T13:30:54.679000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape due to integer overflow in the Graphics component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Kernel: Denial of Service in ath12k wifi driver due to incorrect dma_free_coherent() pointer
CVE: CVE-2026-23135
Component: kernel
CWE: CWE-763
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's ath12k wifi driver. A local attacker could exploit this vulnerability by triggering the device driver teardown path. The driver incorrectly passes aligned memory addresses to dma_free_coherent() instead of the original unaligned addresses during cleanup. This improper memory deallocation can lead to memory leaks, data corruption, or kernel crashes, ultimately resulting in a denial of service.

Statement: A bug exists in the ath12k copy engine ring tear down path where dma_free_coherent is called with pointers that do not match those returned by dma_alloc_coherent. The driver allocates descriptor rings using  dma_alloc_coherent and stores the original CPU and DMA addresses in base_addr_owner_space_unaligned and base_addr_ce_space_unaligned. It then derives aligned addresses for runtime use. During cleanup, the driver incorrectly passed the aligned CPU and DMA addresses to dma_free_coherent instead of the original unaligned values. The DMA API requires that the exact addresses returned by dma_alloc_coherent be used for freeing. Freeing with a shifted aligned pointer can result in invalid free behavior such as freeing the wrong address, memory leaks of DMA coherent memory, allocator metadata corruption, warnings, or kernel crashes. Because this occurs in a device driver teardown path, the most realistic impact is denial of service through kernel instability.

Remediation:
Octeontx2-af: Add proper checks for fwdata
CVE: CVE-2026-23070
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Octeontx2-af: Add proper checks for fwdata

firmware populates MAC address, link modes (supported, advertised)
and EEPROM data in shared firmware structure which kernel access
via MAC block(CGX/RPM).

Accessing fwdata, on boards booted with out MAC block leading to
kernel panics.

Internal error: Oops: 0000000096000005 [#1]  SMP
[   10.460721] Modules linked in:
[   10.463779] CPU: 0 UID: 0 PID: 174 Comm: kworker/0:3 Not tainted 6.19.0-rc5-00154-g76ec646abdf7-dirty #3 PREEMPT
[   10.474045] Hardware name: Marvell OcteonTX CN98XX board (DT)
[   10.479793] Workqueue: events work_for_cpu_fn
[   10.484159] pstate: 80400009 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[   10.491124] pc : rvu_sdp_init+0x18/0x114
[   10.495051] lr : rvu_probe+0xe58/0x1d18

Statement: A kernel crash can occur in the OcteonTX2 AF driver on boards that boot without the MAC block because the driver may access firmware shared data through rvu fwdata without verifying it is mapped. In that configuration rvu_sdp_init can dereference rvu fwdata unconditionally when checking channel_data valid. This triggers a NULL pointer dereference and panics the kernel during initialization or during later mailbox based operations such as link mode handling. For the CVSS the PR is typically H because triggering the affected paths usually requires administrative control over the device environment and operations like driver probing or privileged net device configuration. The issue is not network reachable and is specific to certain hardware and firmware configurations. Impact is denial of service through a kernel panic.

Remediation:
Hibernate: Information disclosure and data deletion via second-order SQL injection
CVE: CVE-2026-0603
Component: org.hibernate/hibernate-core
CWE: CWE-89
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2026-01-19T10:10:00+00:00

A flaw was found in Hibernate. A remote attacker with low privileges could exploit a second-order SQL injection vulnerability by providing specially crafted, unsanitized non-alphanumeric characters in the ID column when the InlineIdsOrClauseBuilder is used. This could lead to sensitive information disclosure, such as reading system files, and allow for data manipulation or deletion within the application's database, resulting in an application level denial of service.

Statement: This vulnerability is rated Important for Red Hat products as it allows a remote attacker with low privileges to perform second-order SQL injection in applications using Hibernate's InlineIdsOrClauseBuilder with unsanitized non-alphanumeric characters in the ID column. This could lead to sensitive information disclosure and data manipulation or deletion.Affected Hibernate ORM versions are 5.2.8 through 5.6.15 (inclusive); earlier versions are not affected.

Remediation:
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android
CVE: CVE-2026-2794
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:25.399000+00:00

Information disclosure due to uninitialized memory in Firefox and Firefox Focus for Android. This vulnerability affects Firefox < 148.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics component
CVE: CVE-2026-0879
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T13:30:54.207000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape due to incorrect boundary conditions in the Graphics component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
ImageMagick: Denial of Service via crafted image file
CVE: CVE-2026-25798
Component: ImageMagick
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T01:02:30.911000+00:00

A flaw was found in ImageMagick. A remote attacker can exploit a NULL pointer dereference vulnerability by supplying a specially crafted image file. This can cause any application linked against ImageMagick to crash, leading to a Denial of Service (DoS).

Statement: MODERATE: This flaw in ImageMagick allows a remote attacker to cause a denial of service by providing a specially crafted image file. Applications linked against ImageMagick in Red Hat Enterprise Linux 6 and 7 are affected if they process untrusted image files. Exploitation requires the processing of a malicious image.

Remediation:
To mitigate this issue, restrict the processing of untrusted image files by applications that utilize ImageMagick. Implement input validation and sanitization for all image files originating from external or untrusted sources. If possible, run applications processing untrusted images in a sandboxed environment to limit potential impact.
drm/xe/nvm: Fix double-free on aux add failure
CVE: CVE-2026-23162
Component: kernel
CWE: CWE-1341
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A double-free vulnerability was found in the Intel Xe GPU driver's NVM (non-volatile memory) initialization. When auxiliary_device_add() fails after auxiliary_device_init() succeeds, the driver incorrectly frees memory that will also be freed by the device release callback, leading to a double-free condition.

Statement: This vulnerability affects systems with Intel Xe discrete GPUs (Arc series). Exploitation requires triggering a specific error path during device initialization, which is difficult to achieve reliably. The double-free could potentially lead to memory corruption but practical exploitation for code execution is unlikely.

Remediation:
FreeRDP: Denial of Service and potential code execution via client-side heap buffer overflow
CVE: CVE-2026-23532
Component: freerdp
CWE: CWE-122
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-01-19T17:03:51.328000+00:00

A flaw was found in FreeRDP. A malicious server can exploit a client-side heap buffer overflow vulnerability in the `gdi_SurfaceToSurface` path. This vulnerability, caused by a mismatch in memory handling, can lead to a crash (Denial of Service) of the client application. Furthermore, it carries a risk of heap corruption, which could potentially enable arbitrary code execution on the affected system.

Statement: For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.

Remediation:
WebSockets pre-auth memory DoS
CVE: CVE-2026-27571
Component: nats-server
CWE: CWE-770
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T15:59:17.926000+00:00

A flaw was found in nats-server. The WebSockets implementation fails to enforce a memory allocation limit during the decompression of WebSocket messages. A malicious compressed payload allows an attacker to cause an excessive memory consumption, eventually resulting in a server crash and a complete denial of service.

Statement: This flaw does not require valid NATS credentials to be exploited as the use of compression is negotiated before the authentication process. However, only deployments using WebSockets and that are exposed to untrusted network endpoints are vulnerable to this issue, limiting its exposure. Due to these reasons, this issue has been rated with a moderate severity.

Remediation:
For more details, see the Red Hat Advanced Cluster Management for Kubernetes documentation:

https://docs.redhat.com/documentation/en-us/red_hat_advanced_cluster_management_for_kubernetes/2.14/html/multicluster_global_hub/index
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
vLLM: Denial of Service via specially crafted image in multimodal model serving
CVE: CVE-2026-22773
Component: vllm
CWE: CWE-770
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-10T06:39:02.276000+00:00

A flaw was found in vLLM, an inference and serving engine for large language models (LLMs). A remote attacker can exploit this vulnerability by sending a specially crafted 1x1 pixel image to a vLLM engine serving multimodal models that use the Idefics3 vision model implementation. This leads to a tensor dimension mismatch, causing an unhandled runtime error and resulting in complete server termination, effectively a Denial of Service (DoS).

Statement: This vulnerability is rated Moderate for Red Hat products. A remote attacker can trigger a denial of service in vLLM engines serving multimodal models that use the Idefics3 vision model by sending a specially crafted image, leading to complete server termination. This affects Red Hat AI Inference Server and Red Hat OpenShift AI (RHOAI) when configured with the vulnerable vLLM versions.

Remediation:
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.