huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
OpenEXR: Denial of Service via heap-buffer-overflow when parsing a malformed EXR file
CVE: CVE-2026-26981
Component: openexr
CWE: CWE-191
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-24T02:26:16.659000+00:00

A flaw was found in OpenEXR. A remote attacker could exploit a heap-buffer-overflow vulnerability in the `istream_nonparallel_read` function by tricking a user into opening a specially crafted EXR file. This occurs when a signed integer subtraction results in a negative value that is then converted to a large unsigned size, leading to an out-of-bounds read during a memory copy operation. Successful exploitation of this vulnerability could lead to a denial of service.

Statement: ```

The vulnerable code was introduced in OpenEXR 3.3.0 via commit https://github.com/AcademySoftwareFoundation/openexr/commit/c3e212e9c76c4d174f5624564f9103dc49ca1fd8.

OpenEXR 1.x (shipped in RHEL 6 and RHEL 7) and OpenEXR 2.x (shipped in RHEL 8) do not include the affected context implementation and are therefore not impacted. RHEL 9, RHEL 10 and RHIVOS-2 ship OpenEXR 3.1.x versions, which predate the introduction of the vulnerable code path and are also not affected.

```

```

Aditionally, Starting with OpenEXR 3.x, IlmBase was split out into a separate project named Imath. Imath provides math and numerical types, while OpenEXR contains all EXR file parsing logic.

This vulnerability exists within OpenEXR’s file parsing logic and does not affect the separate IlmBase or Imath libraries, which contain only mathematical and utility components and no file decoding functionality

```

Remediation:
wolfSSL: Confidentiality compromise via missing cryptographic step in TLS 1.3 HelloRetryRequest handshake
CVE: CVE-2026-3230
Component: wolfssl
CVSS v3: 2.7/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-19T20:59:54.021000+00:00

A flaw was found in wolfSSL. A remote attacker could exploit a missing cryptographic step in the Transport Layer Security (TLS) 1.3 client HelloRetryRequest handshake logic. By sending a crafted HelloRetryRequest followed by a ServerHello message that omits the required key_share extension, an attacker could cause the derivation of predictable traffic secrets from the (Elliptic Curve) Diffie-Hellman Ephemeral ((EC)DHE) shared secret. This could lead to a compromise in the confidentiality of TLS-protected communications.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
AssertJ: Information disclosure and denial of service via XML External Entity (XXE)
CVE: CVE-2026-24400
Component: assertj
CWE: CWE-611
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L
Release date: 2026-01-26T22:19:02.161000+00:00

A flaw was found in AssertJ. An XML External Entity (XXE) vulnerability exists in the `XmlStringPrettyFormatter` component, which is used by the `isXmlEqualTo(CharSequence)` assertion. If an application processes untrusted XML input using these methods, a remote attacker could exploit this flaw to read arbitrary local files, perform Server-Side Request Forgery (SSRF) by making the server request arbitrary URLs, or cause a Denial of Service (DoS) through entity expansion attacks.

Statement: Exploitation of this vulnerability requires that a user processes untrusted content with the affected package.

Remediation:
Sensitive Information Exposure Through Log Files in Llama Stack PGVector Integration
CVE: CVE-2026-25211
Component: llamastack/llama-stack
CWE: CWE-532
Severity: Low
CVSS v3: 3.5/AV:L/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
Release date: 2026-01-07T12:15:22.610000+00:00

A security issue was identified in the Llama Stack server when PGVector is used as a vector store provider. During initialization, the server logs print the PGVector database password in clear text. This occurs due to insufficient redaction of sensitive configuration fields. As a result, anyone with access to the application logs can retrieve database credentials, increasing the risk of unauthorized database access.

Statement: The vulnerability has a Low impact.The flaw involves information exposure through log files in the Llama Stack server when PGVector is configured, where database passwords are logged in plaintext.

Remediation:
zlib: Arbitrary code execution via buffer overflow in untgz utility
CVE: CVE-2026-22184
Component: zlib
CWE: CWE-120
Severity: Important
CVSS v3: 8.6/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-01-07T20:25:19.892000+00:00

A flaw was found in zlib. A global buffer overflow vulnerability exists in the `untgz` utility, specifically within the `TGZfname()` function. This flaw allows an attacker to provide an archive name longer than 1024 bytes, leading to an out-of-bounds write. This can result in memory corruption, denial of service, and potentially arbitrary code execution on the affected system.

Statement: This vulnerability is rated Important rather than Critical because, although it allows a classic global buffer overflow that can compromise the availability of the affected process and potentially impact integrity, it does not meet the criteria for easy, remote, unauthenticated system compromise. The flaw is confined to the untgz command-line utility and is triggered only through attacker-controlled command-line arguments, not through automatic processing of network data or background services. Exploitation therefore generally requires local access or a cooperating application or script that passes untrusted input to untgz, which places it outside the class of wormable or directly remote exploits. While the vulnerability can reliably cause a denial of service and may lead to code execution under specific build and runtime conditions, such outcomes are highly dependent on compiler hardening, memory layout, and execution context, making exploitation less straightforward than required for a Critical rating.

Remediation:
To mitigate this vulnerability, avoid using the `untgz` utility with untrusted archive names or from untrusted sources. System administrators should ensure that any automated processes or user interactions involving `untgz` validate the length of archive names to prevent triggering the buffer overflow. If the `untgz` utility is not essential for system operation, consider restricting its execution permissions or removing the package that provides it, if applicable.
CVE: CVE-2026-0762
Component: GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-01-09T16:35:18.890000+00:00

GPT Academic stream_daas Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Interaction with a malicious DAAS server is required to exploit this vulnerability but attack vectors may vary depending on the implementation.

The specific flaw exists within the stream_daas function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27956.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
GLib: Memory corruption via integer overflow in Unicode case conversion
CVE: CVE-2026-1489
Component: Glib
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Release date: 2026-01-27T00:00:00+00:00

A flaw was found in GLib. An integer overflow vulnerability in its Unicode case conversion implementation can lead to memory corruption. By processing specially crafted and extremely large Unicode strings, an attacker could trigger an undersized memory allocation, resulting in out-of-bounds writes. This could cause applications utilizing GLib for string conversion to crash or become unstable.

Statement: This vulnerability is rated Moderate for Red Hat products. A flaw in GLib's Unicode case conversion implementation can lead to memory corruption due to an integer overflow when processing specially crafted and extremely large Unicode strings. Applications that handle untrusted, large Unicode input and utilize GLib for string conversion may be susceptible, potentially resulting in crashes or instability.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Devise: Unauthorized email confirmation due to a race condition
CVE: CVE-2026-32700
Component: devise
CVSS v3: 7.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-18T20:55:55.034000+00:00

A flaw was found in Devise, an authentication solution for Rails. A race condition in the Confirmable module allows a remote attacker to confirm an email address they do not own. By sending two concurrent email change requests, an attacker can desynchronize the confirmation token and unconfirmed email fields. This enables the attacker to confirm a victim's email on their own account, potentially leading to unauthorized account manipulation.

Statement: This MODERATE race condition vulnerability in Devise's Confirmable module allows authenticated attackers to confirm emails they don't own. Exploitation requires high complexity (precise timing of concurrent requests) and a valid account. The scope change to S:C is questionable as the attack stays within Devise's auth boundary. Impact is high to confidentiality and integrity through unauthorized email association. Affects applications using reconfirmable (default). Fixed in Devise 5.0.3.

Remediation:
Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check
CVE: CVE-2026-23111
Component: kernel
CWE: CWE-672
Severity: Moderate
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-13T00:00:00+00:00

A flaw was found in the Linux kernel's nf_tables component. A logic bug in nft_map_catchall_activate causes an inverted element activity check during the abort path of a failed transaction. This can lead to a use-after-free vulnerability, as catchall verdict elements may still reference a freed chain. A local low privileged user can exploit this to cause a denial of service or potentially achieve privilege escalation.

Statement: A logic bug in nf_tables nft_map_catchall_activate uses an inverted element active check during the abort path of a failed transaction. This can prevent re activation of catchall map elements and for NFT_GOTO verdict elements it can skip restoring the chain use reference count. Repeating an abort sequence can permanently decrement chain use until DELCHAIN frees the chain while catchall elements still reference it which can result in a use after free. For the CVSS the PR is L, but in the paranoid scenario the unprivileged users may reach nf_tables via user namespaces with delegated CAP_NET_ADMIN. The issue is not directly network reachable and is triggered by local nftables control plane operations. Impact can range from denial of service to potential privilege escalation depending on heap reuse.

Remediation:
To mitigate this issue, prevent module nf_tables from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
net: hv_netvsc: reject RSS hash key programming without RX indirection table
CVE: CVE-2026-23054
Component: kernel
Severity: Low
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: hv_netvsc: reject RSS hash key programming without RX indirection table

RSS configuration requires a valid RX indirection table. When the device
reports a single receive queue, rndis_filter_device_add() does not
allocate an indirection table, accepting RSS hash key updates in this
state leads to a hang.

Fix this by gating netvsc_set_rxfh() on ndc->rx_table_sz and return
-EOPNOTSUPP when the table is absent. This aligns set_rxfh with the device
capabilities and prevents incorrect behavior.


Remediation:
uTLS: Fingerprint mismatch allows client identification during GREASE ECH
CVE: CVE-2026-27017
Component: utls
CVSS v3: 3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Release date: 2026-02-20T02:47:17.899000+00:00

A flaw was found in uTLS. When using GREASE Encrypted ClientHello (ECH), uTLS versions 1.6.0 through 1.8.0 may exhibit a fingerprint mismatch with Chrome. This occurs due to an inconsistent selection of cipher suites between the outer ClientHello and the ECH, potentially allowing a remote observer to distinguish the uTLS client from a standard Chrome browser. This could lead to a low impact information disclosure regarding the client's identity.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Seroval: Denial of Service via large encoded array lengths
CVE: CVE-2026-23957
Component: seroval
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-22T01:26:53.869000+00:00

A flaw was found in seroval. A remote attacker can exploit this vulnerability by providing specially crafted input that overrides encoded array lengths with an excessively large value during the deserialization process. This manipulation causes the application to significantly increase processing time, leading to a Denial of Service (DoS).

Statement: This vulnerability is rated Important for Red Hat because seroval, a JavaScript value stringification library, can be exploited to cause a Denial of Service. An attacker can provide an excessively large value for encoded array lengths during deserialization, leading to a significant increase in processing time. This affects versions 1.4.0 and below of seroval, which is used in components like forgejo in Fedora and EPEL.

Remediation:
ublk: fix use-after-free in ublk_partition_scan_work
CVE: CVE-2026-22995
Component: kernel
Severity: Moderate
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ublk: fix use-after-free in ublk_partition_scan_work

A race condition exists between the async partition scan work and device
teardown that can lead to a use-after-free of ub->ub_disk:

1. ublk_ctrl_start_dev() schedules partition_scan_work after add_disk()
2. ublk_stop_dev() calls ublk_stop_dev_unlocked() which does:
   - del_gendisk(ub->ub_disk)
   - ublk_detach_disk() sets ub->ub_disk = NULL
   - put_disk() which may free the disk
3. The worker ublk_partition_scan_work() then dereferences ub->ub_disk
   leading to UAF

Fix this by using ublk_get_disk()/ublk_put_disk() in the worker to hold
a reference to the disk during the partition scan. The spinlock in
ublk_get_disk() synchronizes with ublk_detach_disk() ensuring the worker
either gets a valid reference or sees NULL and exits early.

Also change flush_work() to cancel_work_sync() to avoid running the
partition scan work unnecessarily when the disk is already detached.


Remediation:
Kibana: Unauthorized system control via missing authorization
CVE: CVE-2026-26939
Component: Kibana
CWE: CWE-1220
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-03-19T17:11:16.507000+00:00

A flaw was found in Kibana. An authenticated attacker with rule management privileges could exploit a missing authorization vulnerability in the server-side Detection Rule Management. This allows the attacker to configure unauthorized endpoint response actions, such as host isolation, process termination, and process suspension. This could lead to a denial of service or impact on system integrity.


Remediation:
romfs: check sb_set_blocksize() return value
CVE: CVE-2026-23238
Component: kernel
CWE: CWE-252
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-04T00:00:00+00:00

A flaw was found in the Linux kernel's romfs filesystem implementation. The romfs_fill_super() function ignores the return value of sb_set_blocksize(). When mounting a romfs filesystem on a device with an incompatible block size (larger than PAGE_SIZE), the mount proceeds with an incorrect block size, eventually triggering a kernel BUG in folio_set_bh() when attempting I/O operations.

Statement: This flaw requires the ability to configure a loop device's block size and mount a romfs filesystem on it. While the configuration sequence requires privileged access, once set up, the kernel BUG triggers during normal filesystem operations. Romfs is a read-only filesystem primarily used in embedded systems and initramfs.

Remediation:
To mitigate this issue, prevent the romfs module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.
SQL injection via process names in TimescaleDB export
CVE: CVE-2026-30930
Component: glances
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-10T16:16:59.991000+00:00

A flaw was found in glances. The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize() method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as process names, filesystem mount points, network interface names, or container names.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Red Hat Satellite: Remote Code Execution in rubyipmi via malicious BMC username
CVE: CVE-2026-0980
Component: rubyipmi
CWE: CWE-78
Severity: Moderate
CVSS v3: 8.6/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Release date: 2026-01-01T00:00:00+00:00

A flaw was found in rubyipmi, a gem used in the Baseboard Management Controller (BMC) component of Red Hat Satellite. An authenticated attacker with host creation or update permissions could exploit this vulnerability by crafting a malicious username for the BMC interface. This could lead to remote code execution (RCE) on the system.

Statement: This vulnerability is rated Moderate for Red Hat Satellite because it requires the BMC component to be enabled and configured to use `ipmitool` as the IPMI implementation. An authenticated attacker with host creation or update permissions can exploit this by crafting a malicious BMC username. Exploitation is limited to environments meeting these specific configuration and permission requirements.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Spring Data Geode: Information disclosure via insecure temporary directory for snapshot imports
CVE: CVE-2026-2817
Component: org.springframework.data/spring-data-geode
CWE: CWE-379
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-02-19T17:18:09.839000+00:00

Use of insecure directory in Spring Data Geode snapshot import extracts archives into predictable, permissive directories under the system temp location. On shared hosts, a local user with basic privileges can access another user’s extracted snapshot contents, leading to unintended exposure of cache data.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Suricata: Denial of service due to stack overflow when saving large datasets
CVE: CVE-2026-22262
Component: suricata
Release date: 2026-01-27T18:18:52.922000+00:00

A flaw was found in Suricata, a network intrusion detection/prevention system (IDS/IPS). When saving a dataset, the system uses a stack buffer to process the data. If an attacker provides excessively large data within a dataset, it can cause a stack overflow. This vulnerability could lead to a denial of service, making the system unavailable.

Statement: The vulnerability in Suricata, rated as MODERATE, involves a stack overflow when saving a dataset if the data exceeds the allocated buffer size. This flaw affects Suricata versions prior to 8.0.3 and 7.0.14. Red Hat customers running affected versions of Suricata are impacted if their intrusion detection rules utilize the `save` or `state` options with datasets, which can lead to a denial of service.

Remediation:
REST/WebUI lacks host validation and remains exposed to DNS rebinding
CVE: CVE-2026-32632
Component: glances
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Release date: 2026-03-18T17:47:25.929000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Memory leak in idpf driver can lead to denial of service
CVE: CVE-2026-23023
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

A flaw was found in the Linux kernel's idpf driver. This memory leak occurs because the `idpf_vport_rel()` function fails to free allocated memory during a reset operation. A local attacker could exploit this vulnerability to exhaust system memory, leading to a denial of service (DoS).

Statement: A memory leak in the Intel idpf driver can occur because vport rx_ptype_lkup is not freed when a vport is released during reset. Over repeated resets this can accumulate and increase kernel memory usage until resources are exhausted and the system becomes unstable. For the CVSS the PR is typically H because controlling driver load reset and recovery operations is usually limited to administrators. The issue is not directly network reachable and it is triggered through local device management and reset behavior. Impact is denial of service via resource exhaustion rather than information disclosure or privilege escalation.

Remediation: