huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
FreeRDP: Heap buffer overflow via crafted RDPGFX surface updates leads to denial of service and potential code execution.
CVE: CVE-2026-23531
Component: freerdp
CWE: CWE-122
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-01-19T17:01:01.380000+00:00

A flaw was found in FreeRDP. A malicious server can exploit an out-of-bounds read/write vulnerability in the ClearCodec component by sending crafted RDPGFX surface updates. This can trigger a client-side heap buffer overflow, leading to a crash (Denial of Service (DoS)) and potential heap corruption with a risk of arbitrary code execution. For this vulnerability to be exploited, a client must connect to a maliciously-configured server.

Statement: For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.

Remediation:
ImageMagick: Denial of Service via integer overflow in XWD encoder
CVE: CVE-2026-30937
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-03-09T21:50:15.495000+00:00

A flaw was found in ImageMagick, a software suite for editing and manipulating digital images. An integer overflow vulnerability exists in the XWD (X Windows) encoder when processing extremely large images. This flaw can lead to an undersized memory allocation, resulting in an out-of-bounds write to the heap. A local attacker could exploit this to cause a denial of service (DoS) or potentially impact data integrity.

Statement: A MODERATE impact heap buffer overflow exists in ImageMagick's XWD encoder, `WriteXWDImage`. This flaw occurs when processing extremely large images, leading to an undersized heap buffer allocation and a potential out-of-bounds write. Red Hat products shipping ImageMagick are affected if configured to generate or convert excessively large images into the XWD format.

Remediation:
To mitigate this issue, restrict ImageMagick's processing of untrusted or excessively large XWD image files. Implement input validation to ensure that image dimensions and sizes are within expected operational limits before processing them with ImageMagick.
perf/core: Fix refcount bug and potential UAF in perf_mmap
CVE: CVE-2026-23248
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's perf subsystem. A race condition exists in perf_mmap() between a failing mmap() setup and concurrent mmap() operations on dependent events. When map_range() fails, the cleanup path runs while the mmap_mutex is released, allowing another thread to observe and access a ring buffer whose reference count has already reached zero. This can result in use-after-free or refcount corruption.

Statement: This flaw was discovered by syzkaller and affects the perf event subsystem used for performance monitoring. The race requires concurrent mmap operations on related perf events (via inheritance or output redirection), making exploitation timing-sensitive but achievable. Successful exploitation could lead to kernel memory corruption or information disclosure through the freed ring buffer.

Remediation:
libssh: Denial of Service due to malformed SFTP message
CVE: CVE-2026-0968
Component: libssh
CWE: CWE-476
Severity: Low
CVSS v3: 3.0/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-10T18:46:58.858000+00:00

No description is available for this CVE.


Remediation:
ImageMagick: Denial of Service via crafted image processing
CVE: CVE-2026-30936
Component: ImageMagick
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-09T21:49:36.015000+00:00

A flaw was found in ImageMagick, a free and open-source software for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted image to a user, which, when processed with the -wavelet-denoise operation, could lead to an out-of-bounds heap write. This issue can result in a denial of service (DoS), causing the application to become unstable or crash.

Statement: This is a MODERATE impact vulnerability. ImageMagick in Red Hat Enterprise Linux 6 ELS and 7 ELS is affected by a heap buffer overflow. This flaw occurs when processing a specially crafted image using the -wavelet-denoise operation, which could lead to an out-of-bounds write. Exploitation requires user interaction to process the malicious image.

Remediation:
To reduce the risk of exploitation, avoid processing untrusted or unverified image files with ImageMagick. Users should exercise caution when handling images from unknown sources. Additionally, consider restricting ImageMagick's capabilities through its policy file to limit exposure to potentially vulnerable operations or file formats.
xfs: check for deleted cursors when revalidating two btrees
CVE: CVE-2026-23249
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's XFS filesystem scrub/repair code. In xrep_revalidate_allocbt(), when revalidating both the BNOBT and CNTBT btrees, if the first btree validation fails during cross-reference, the second btree cursor is nullified. The code then attempts to revalidate the second btree using the NULL cursor, causing a kernel crash.

Statement: This flaw affects XFS filesystems when using the online scrub/repair functionality (xfs_scrub). The crash can be triggered via the XFS_IOC_SCRUBV_METADATA ioctl, potentially in combination with error injection. The vulnerability is in the repair validation path and requires privileged access to invoke filesystem scrub operations. Similar issues exist in xrep_revalidate_iallocbt().

Remediation:
jsPDF: Denial of Service due to excessive memory allocation from crafted BMP images
CVE: CVE-2026-24133
Component: jsPDF
CWE: CWE-1285
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-02T20:32:37.631000+00:00

A flaw was found in jsPDF. A remote attacker can exploit this vulnerability by providing specially crafted BMP image data or URLs to the addImage or html methods. This can cause the application to allocate excessive memory, leading to an out-of-memory error and a denial of service (DoS).

Statement: This MODERATE impact flaw in the jsPDF library, affecting Red Hat Advanced Cluster Security, allows a remote attacker to trigger a denial of service. By providing specially crafted BMP image data or URLs to the `addImage` or `html` methods, an attacker can cause the application to consume excessive memory, leading to an out-of-memory error.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Central Browser autodiscovery leaks reusable credentials to Zeroconf-spoofed servers
CVE: CVE-2026-32634
Component: glances
CVSS v3: 8.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-18T17:55:30.552000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Suricata detect/alert: heap-use-after-free on alert queue expansion
CVE: CVE-2026-22264
Component: suricata
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-01-27T18:33:50.354000+00:00

Suricata is a network IDS, IPS and NSM engine. Prior to version 8.0.3 and 7.0.14, an unsigned integer overflow can lead to a heap use-after-free condition when generating excessive amounts of alerts for a single packet. Versions 8.0.3 and 7.0.14 contain a patch. As a workaround, do not run untrusted rulesets or run with less than 65536 signatures that can match on the same packet.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
quickjs-ng: Use-after-free vulnerability via js_iterator_concat_return function manipulation
CVE: CVE-2026-3979
Component: quickjs-ng
CVSS v3: 5.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-03-12T03:32:14.860000+00:00

A flaw was found in quickjs-ng. A local attacker could exploit a use-after-free vulnerability by manipulating the `js_iterator_concat_return` function. This could potentially lead to information disclosure, denial of service, or limited arbitrary code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
qs's arrayLimit bypass in comma parsing allows denial of service
CVE: CVE-2026-2391
Component: qs
CWE: CWE-179
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-12T04:39:42.914000+00:00

A denial of service flaw has been discovered in the qs npm package. When the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service via heap-buffer-overflow in PCL encode
CVE: CVE-2026-28686
Component: ImageMagick
CWE: CWE-131
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-03-09T21:33:15.782000+00:00

A flaw was found in ImageMagick, free and open-source software used for editing and manipulating digital images. A local attacker could exploit a heap-buffer-overflow vulnerability in the PCL encode due to an undersized output buffer allocation. This could lead to a denial of service (DoS), making the software unavailable, and potentially impact data integrity.

Statement: This MODERATE impact vulnerability in ImageMagick involves a heap-buffer-overflow within the PCL encoder. Processing a specially crafted image could trigger this flaw, potentially leading to denial of service or other impacts. This affects Red Hat Enterprise Linux 6 ELS and 7 ELS, as well as community projects like Fedora and EPEL, where ImageMagick is used for image processing.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Envoy Gateway: Unauthorized access to secrets via Lua script credential leakage
CVE: CVE-2026-22771
Component: envoyproxy/gateway
CWE: CWE-94
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-12T18:08:22.532000+00:00

A flaw was found in Envoy Gateway. EnvoyExtensionPolicy Lua scripts, when executed by the Envoy proxy, can be exploited to leak the proxy's credentials. An attacker can then use these credentials to communicate with the control plane and gain unauthorized access to all secrets managed by the Envoy proxy, including sensitive TLS private keys. This vulnerability leads to critical information disclosure, potentially compromising the security of communications.

Statement: Red Hat products do not contain the affected components.

Remediation:
libsoup: HTTP Request Smuggling via malformed chunk headers
CVE: CVE-2026-1801
Component: libsoup
CWE: CWE-444
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Release date: 2026-02-03T00:00:00+00:00

A flaw was found in libsoup, an HTTP client/server library. This HTTP Request Smuggling vulnerability arises from non-RFC-compliant parsing in the soup_filter_input_stream_read_line() logic, where libsoup accepts malformed chunk headers, such as lone line feed (LF) characters instead of the required carriage return and line feed (CRLF). A remote attacker can exploit this without authentication or user interaction by sending specially crafted chunked requests. This allows libsoup to parse and process multiple HTTP requests from a single network message, potentially leading to information disclosure.

Statement: This issue has a LOW impact. The libsoup library is vulnerable to HTTP Request Smuggling due to non-RFC-compliant parsing of chunk headers. While exploitation is possible remotely without authentication, the impact on Red Hat products is limited as the SoupServer component, which is affected by this flaw, is not commonly deployed in internet-facing infrastructure.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
octeon_ep: Fix memory leak in octep_device_setup()
CVE: CVE-2026-23160
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A memory leak was found in the Marvell Octeon endpoint driver. When octep_ctrl_net_init() fails in octep_device_setup(), the function returns without unmapping already-mapped resources or freeing allocated configuration memory, causing a resource leak.

Statement: This affects systems with Marvell Octeon endpoint network hardware. The leak occurs only on the error path when network control initialization fails during device setup. The issue was found via static analysis and only compile-tested, indicating it's a theoretical rather than observed bug.

Remediation:
FreeRDP: Heap buffer overflow leading to denial of service and potential code execution from a malicious server.
CVE: CVE-2026-23530
Component: freerdp
CWE: CWE-122
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-01-19T16:58:46.712000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. This vulnerability occurs because the `freerdp_bitmap_decompress_planar` function does not properly validate bitmap dimensions when decompressing planar bitmap data. A malicious server can exploit this by sending specially crafted bitmap data, leading to a client-side heap buffer overflow. This can cause a crash (Denial of Service) and potentially allow for arbitrary code execution on the client system.

Statement: For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.

Remediation:
re2c: Denial of Service via null pointer dereference
CVE: CVE-2026-2903
Component: re2c
CWE: CWE-476
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-22T00:32:09.412000+00:00

A flaw was found in re2c. A local user can exploit this vulnerability by manipulating the `check_and_merge_special_rules` function. This manipulation causes a null pointer dereference, which can lead to a denial of service (DoS).


Remediation:
Multer: Denial of Service via malformed requests
CVE: CVE-2026-3304
Component: multer
CWE: CWE-459
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-27T15:44:37.187000+00:00

A flaw was found in Multer, a Node.js middleware. A remote attacker could exploit this vulnerability by sending specially crafted malformed requests. This could lead to resource exhaustion, resulting in a Denial of Service (DoS) for the application using Multer.


Remediation:
thunderbird: JIT miscompilation in the JavaScript: WebAssembly component
CVE: CVE-2026-2796
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:26.775000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
JIT miscompilation in the JavaScript: WebAssembly component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
joserfc: Denial of Service via unbounded PBKDF2 iteration count in JWE decryption
CVE: CVE-2026-27932
Component: joserfc
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-03T22:48:21.306000+00:00

joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards. In 1.6.2 and earlier, a resource exhaustion vulnerability in joserfc allows an unauthenticated attacker to cause a Denial of Service (DoS) via CPU exhaustion. When the library decrypts a JSON Web Encryption (JWE) token using Password-Based Encryption (PBES2) algorithms, it reads the p2c (PBES2 Count) parameter directly from the token's protected header. This parameter defines the number of iterations for the PBKDF2 key derivation function. Because joserfc does not validate or bound this value, an attacker can specify an extremely large iteration count (e.g., 2^31 - 1), forcing the server to expend massive CPU resources processing a single token. This vulnerability exists at the JWA layer and impacts all high-level JWE and JWT decryption interfaces if PBES2 algorithms are allowed by the application's policy.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Backstage SCM Integration: Unauthorized access to SCM APIs via path traversal
CVE: CVE-2026-29185
Component: @backstage/integration
CWE: CWE-22
Severity: Low
CVSS v3: 3.7/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-07T15:02:04.986000+00:00

Backstage is an open framework for building developer portals. Prior to version 1.20.1, a vulnerability in the SCM URL parsing used by Backstage integrations allowed path traversal sequences in encoded form to be included in file paths. When these URLs were processed by integration functions that construct API URLs, the traversal segments could redirect requests to unintended SCM provider API endpoints using the configured server-side integration credentials. This issue has been patched in version 1.20.1.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Vaultwarden: Information disclosure via API partial update
CVE: CVE-2026-27898
Component: vaultwarden
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-04T21:44:45.461000+00:00

A flaw was found in Vaultwarden, an unofficial Bitwarden compatible server. An authenticated regular user can exploit this by specifying another user’s cipher identifier (cipher_id) and making a partial update request to the API. This action bypasses standard access controls, leading to the exposure of sensitive cipher details, such as names, notes, and data, belonging to other users. This vulnerability results in information disclosure.

Statement: This MODERATE information disclosure vulnerability in Vaultwarden allows an authenticated user to retrieve another user's cipher details via the partial update API endpoint (CWE-639 IDOR). Exploitation requires network access and valid authentication (PR:L). Impact is limited to high confidentiality loss (exposure of names, notes, secure notes); no integrity or availability impact. Affects versions prior to 1.35.4. Red Hat does not ship Vaultwarden.

Remediation:
l2tp: Fix memleak in l2tp_udp_encap_recv()
CVE: CVE-2026-23072
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A memory leak vulnerability was found in the Linux kernel's L2TP (Layer 2 Tunneling Protocol) implementation. After a code refactoring that moved protocol version validation in l2tp_udp_encap_recv(), the error handling path fails to call l2tp_session_put() to release the session reference. This causes l2tp_session, l2tp_tunnel, and associated socket structures to leak on each failed validation.

Statement: This memory leak was discovered by syzkaller and affects systems using L2TP tunneling. Repeated triggering of the error path through malformed L2TP packets can gradually exhaust kernel memory, leading to denial of service. The leak requires the ability to send L2TP traffic to the affected system.

Remediation:
To mitigate this issue, prevent the l2tp_core module from being loaded if L2TP tunneling is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
of: unittest: Fix memory leak in unittest_data_add()
CVE: CVE-2026-23137
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

of: unittest: Fix memory leak in unittest_data_add()

In unittest_data_add(), if of_resolve_phandles() fails, the allocated
unittest_data is not freed, leading to a memory leak.

Fix this by using scope-based cleanup helper __free(kfree) for automatic
resource cleanup. This ensures unittest_data is automatically freed when
it goes out of scope in error paths.

For the success path, use retain_and_null_ptr() to transfer ownership
of the memory to the device tree and prevent double freeing.


Remediation:
Integer overflow in Skia
CVE: CVE-2026-3538
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-03T00:00:00+00:00

Integer overflow in Skia in Google Chrome prior to 145.0.7632.159 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Critical)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Apache ZooKeeper: Information disclosure via improper handling of configuration values
CVE: CVE-2026-24308
Component: Apache ZooKeeper
CWE: CWE-117
Severity: Moderate
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-07T08:51:17.567000+00:00

A flaw was found in Apache ZooKeeper. Improper handling of configuration values in ZKConfig allows an attacker to expose sensitive information. This occurs when sensitive client configuration values are logged at an INFO level in the client's logfile. This vulnerability can lead to information disclosure, potentially revealing critical system details to unauthorized parties.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.