huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
OpenSSH GSSAPI: Information disclosure or denial of service due to uninitialized variables
CVE: CVE-2026-3497
Component: openssh
CWE: CWE-824
Severity: Important
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-03-12T18:27:44.917000+00:00

A flaw was found in the OpenSSH GSSAPI (Generic Security Service Application Program Interface) delta patches, as included in various Linux distributions. A remote attacker could exploit this by sending an unexpected GSSAPI message type during the key exchange process. This occurs because the `sshpkt_disconnect()` function, when called on an error, does not properly terminate the process, leading to the continued execution of the program with uninitialized connection variables. Accessing these uninitialized variables can lead to undefined behavior, potentially resulting in information disclosure or a denial of service.

Statement: IMPORTANT: This vulnerability affects the OpenSSH GSSAPI delta as implemented in Red Hat Enterprise Linux and OpenShift Container Platform. An unauthenticated attacker could send a specially crafted GSSAPI message during key exchange, leading to the use of uninitialized variables and potentially undefined behavior. The severity of the impact is dependent on compiler hardening configurations.

Remediation:
To mitigate this issue, disable GSSAPI key exchange in the OpenSSH server configuration. This prevents the server from processing GSSAPI messages, eliminating the vulnerability's attack surface.

Edit `/etc/ssh/sshd_config` and add or modify the line:
```
GSSAPIKeyExchange no
```

After saving the changes, restart the `sshd` service for the mitigation to take effect. This action will prevent users from authenticating via GSSAPI.

```
# systemctl restart sshd
```
netrom: fix double-free in nr_route_frame()
CVE: CVE-2026-23098
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

netrom: fix double-free in nr_route_frame()

In nr_route_frame(), old_skb is immediately freed without checking if
nr_neigh->ax25 pointer is NULL. Therefore, if nr_neigh->ax25 is NULL,
the caller function will free old_skb again, causing a double-free bug.

Therefore, to prevent this, we need to modify it to check whether
nr_neigh->ax25 is NULL before freeing old_skb.


Remediation:
drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind
CVE: CVE-2026-23132
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/bridge: synopsys: dw-dp: fix error paths of dw_dp_bind

Fix several issues in dw_dp_bind() error handling:

1. Missing return after drm_bridge_attach() failure - the function
   continued execution instead of returning an error.

2. Resource leak: drm_dp_aux_register() is not a devm function, so
   drm_dp_aux_unregister() must be called on all error paths after
   aux registration succeeds. This affects errors from:
   - drm_bridge_attach()
   - phy_init()
   - devm_add_action_or_reset()
   - platform_get_irq()
   - devm_request_threaded_irq()

3. Bug fix: platform_get_irq() returns the IRQ number or a negative
   error code, but the error path was returning ERR_PTR(ret) instead
   of ERR_PTR(dp->irq).

Use a goto label for cleanup to ensure consistent error handling.


Remediation:
zlib: Denial of Service via infinite loop in CRC32 combine functions
CVE: CVE-2026-27171
Component: zlib
CWE: CWE-835
Severity: Low
CVSS v3: 2.8/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-18T02:36:19.509000+00:00

A flaw was found in zlib. An attacker providing specially crafted input to the `crc32_combine64` or `crc32_combine_gen64` functions could trigger an infinite loop within the `x2nmodp` function. This leads to excessive CPU consumption, which can result in a Denial of Service (DoS) for the affected system.


Remediation:
ZITADEL: Authentication bypass allows sign-in with other organization's users
CVE: CVE-2026-33132
Component: github.com/zitadel
CWE: CWE-306
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-20T10:21:19.373000+00:00

A flaw was found in ZITADEL, an open-source identity management platform. A user could bypass organization enforcement during authentication due to missing controls in device authorization requests and specific login and OIDC API endpoints. This allowed users to sign in with credentials from other organizations, potentially leading to unauthorized information access.


Remediation:
Rekor denial of service
CVE: CVE-2026-23831
Component: github.com/sigstore/rekor
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-22T21:26:22.183000+00:00

Rekor’s cose v0.0.1 entry implementation can panic on attacker-controlled input when canonicalizing a proposed entry with an empty spec.message. validate() returns nil (success) when message is empty, leaving sign1Msg uninitialized, and Canonicalize() later dereferences v.sign1Msg.Payload. A malformed proposed entry of the cose/v0.0.1 type can cause a panic on a thread within the Rekor process. The thread is recovered so the client receives a 500 error message and service still continues, so the availability impact of this is minimal.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Optimizer unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21949
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
thunderbird: Memory safety bugs fixed in Firefox ESR 115.33, Firefox ESR 140.8, Thunderbird ESR 140.8, Firefox 148 and Thunderbird 148
CVE: CVE-2026-2793
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:23.571000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Memory safety bugs present in Firefox ESR 115.32, Firefox ESR 140.7, Thunderbird ESR 140.7, Firefox 147 and Thunderbird 147. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
@backstage/plugin-auth-backend: SSRF in experimental CIMD metadata fetch
CVE: CVE-2026-32236
Component: @backstage/plugin-auth-backend
CWE: CWE-918
Severity: None
CVSS v3: 0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
Release date: 2026-03-12T18:37:11.330000+00:00

A server side request forgery flaw has been discovered in the npm @backstage/plugin-auth-backend package. The CIMD metadata fetch validates the initial client_id hostname against private IP ranges but does not apply the same validation after HTTP redirects. The practical impact is limited. The attacker cannot read the response body from the internal request, cannot control request headers or method, and the feature must be explicitly enabled via an experimental flag that is off by default. Deployments that restrict allowedClientIdPatterns to specific trusted domains are not affected.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Grafana: Unauthorized data source deletion via time-of-create-to-time-of-use (TOCTOU) vulnerability
CVE: CVE-2026-21725
Component: grafana
CWE: CWE-367
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-25T12:35:43.104000+00:00

A flaw was found in Grafana. This vulnerability, known as a time-of-create-to-time-of-use (TOCTOU) issue, allows an attacker to delete a data source without proper authorization. For this to occur, the attacker must have previously managed the data source, and it must be recreated with the same unique identifier (UID) within a 30-second window on the same Grafana server. The consequence is the unauthorized deletion of a data source, which can lead to a denial of service for that specific resource.


Remediation:
Out-of-Bounds Read in libsoup handle_partial_get() Leading to Heap Information Disclosure
CVE: CVE-2026-2443
Component: libsoup
CWE: CWE-125
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-13T00:00:00+00:00

A flaw was identified in libsoup, a widely used HTTP library in GNOME-based systems. When processing specially crafted HTTP Range headers, the library may improperly validate requested byte ranges. In certain build configurations, this could allow a remote attacker to access portions of server memory beyond the intended response. Exploitation requires a vulnerable configuration and access to a server using the embedded SoupServer component.

Statement: This issue has a LOW impact. An out-of-bounds read vulnerability in libsoup, when processing HTTP Range headers, can lead to heap information disclosure. Although upstream exploitation may allow disclosure of heap memory contents, Red Hat does not build GLib with G_DISABLE_CHECKS, which prevents creation of out-of-bounds byte slices in supported products. As a result, the risk of meaningful information disclosure in shipped configurations is limited. The issue primarily affects applications exposing the SoupServer component and processing untrusted HTTP Range headers.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
thunderbird: Clickjacking issue, information disclosure in the PDF Viewer component
CVE: CVE-2026-0887
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-13T13:30:57.847000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Clickjacking issue, information disclosure in the PDF Viewer component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events
CVE: CVE-2026-22735
Component: org.springframework/spring-webmvc
CWE: CWE-115
Severity: Low
CVSS v3: 2.7/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:L/A:N
Release date: 2026-03-19T23:37:35.587000+00:00

A flaw was found in Spring MVC and WebFlux. A remote attacker with low privileges could exploit this vulnerability, requiring user interaction. This could lead to stream corruption, potentially affecting the integrity of data being transmitted.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2026-0757
Component: MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability
Release date: 2026-01-09T16:23:45.975000+00:00

MCP Manager for Claude Desktop execute-command Command Injection Sandbox Escape Vulnerability. This vulnerability allows remote attackers to bypass the sandbox on affected installations of MCP Manager for Claude Desktop. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the processing of MCP config objects. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escape the sandbox and execute arbitrary code in the context of the current process at medium integrity. Was ZDI-CAN-27810.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Gradio: Information disclosure due to hardcoded secret in session cookie signing, allowing remote attackers to steal Hugging Face tokens.
CVE: CVE-2026-27167
Component: Gradio
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-27T21:40:57.917000+00:00

A flaw was found in Gradio. When Gradio applications run outside of Hugging Face Spaces and use OAuth components, they automatically enable "mocked" OAuth routes. A remote attacker can exploit this by visiting the /login/huggingface endpoint, which causes the server to retrieve its Hugging Face (HF) access token and store it in the visitor's session cookie. Since the session cookie is signed with a hardcoded secret, the attacker can easily decode the payload and steal the server owner's HF token, leading to information disclosure.

Statement: This vulnerability in Gradio applications, specifically affecting `ansible-chatbot-service` in Ansible Services, allows a remote attacker to obtain the server owner's Hugging Face access token. This occurs when network-accessible Gradio applications utilize OAuth components outside of Hugging Face Spaces, leading to the automatic enablement of "mocked" OAuth routes. The session cookie, containing the token, is signed with a hardcoded secret, making it trivially decodable.

Remediation:
simple-git: Remote Code Execution via bypass of prior security fixes
CVE: CVE-2026-28292
Component: simple-git
CWE: CWE-76
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-10T18:34:21.717000+00:00

A vulnerability was discovered in the simple-git Node.js library. The issue is caused by improper validation of user-supplied input when constructing Git commands. An attacker able to supply specially crafted repository URLs or arguments could exploit Git’s ext:: protocol handler to execute arbitrary commands on the underlying system.
This flaw bypasses earlier mitigations intended to restrict unsafe Git protocols. By injecting configuration options that re-enable the ext:: protocol, an attacker could cause the application to execute arbitrary external commands through the Git client.
If a vulnerable application passes untrusted input to simple-git operations such as repository cloning or fetching, a remote attacker could exploit this flaw to execute arbitrary commands on the host system with the privileges of the application process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Linux kernel: Data race in IPv6 neighbor discovery leads to limited availability
CVE: CVE-2026-23124
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's IPv6 neighbor discovery component. A remote attacker on an adjacent network can exploit a data race in the `ndisc_router_discovery` function by sending specially crafted Internet Control Message Protocol version 6 (ICMPv6) Router Advertisement (RA) messages. This allows for inconsistent updates to the `ra_mtu` value, leading to transient or incorrect Maximum Transmission Unit (MTU) state and spurious interface information notifications. The primary impact is limited availability of the affected system.

Statement: A data race exists in IPv6 neighbor discovery because ndisc_router_discovery can read and write in6_dev ra_mtu without holding a lock while processing Router Advertisement MTU options. Under concurrent RA processing the ra_mtu value can be observed and updated inconsistently which can result in transient or incorrect MTU state and spurious ifinfo notifications. For the CVSS the PR is N because the input comes from ICMPv6 Router Advertisements and does not require local privileges on the target. The issue is network reachable in an adjacent network because RA traffic is typically limited to the local link. Realistic impact is limited availability and configuration stability rather than a direct kernel crash.

Remediation:
Linux kernel: Denial of Service in kvaser_usb CAN driver due to memory leak
CVE: CVE-2026-23061
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's kvaser_usb Controller Area Network (CAN) driver. A local, low-privileged user could exploit a memory leak in the kvaser_usb_read_bulk_callback() function. This occurs because USB Request Blocks (URBs) are not properly unanchored and freed, leading to memory exhaustion and a denial of service.


Remediation:
thunderbird: Invalid pointer in the JavaScript Engine component
CVE: CVE-2026-2785
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:18.254000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Invalid pointer in the JavaScript Engine component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Calibre: Arbitrary Code Execution via malicious custom template file during ebook conversion
CVE: CVE-2026-25731
Component: calibre
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-06T20:14:35.822000+00:00

A flaw was found in Calibre, an e-book manager. This Server-Side Template Injection (SSTI) vulnerability in Calibre's Templite templating engine allows an attacker to achieve arbitrary code execution. This occurs when a user converts an ebook using a specially crafted malicious custom template file, provided via the --template-html or --template-html-index command-line options. This could lead to a complete compromise of the affected system.

Statement: This is an IMPORTANT arbitrary code execution vulnerability in Calibre's HTML export functionality. It occurs when a user processes an ebook with a specially crafted custom template file using the `--template-html` or `--template-html-index` command-line options. This issue affects Calibre versions prior to 9.2.0, as distributed in Fedora 42 and Fedora 43.

Remediation:
thunderbird: Race condition in the JavaScript: GC component
CVE: CVE-2026-2802
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:30.784000+00:00

Race condition in the JavaScript: GC component. This vulnerability affects Firefox < 148 and Thunderbird < 148.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Nodejs denial of service
CVE: CVE-2026-21637
Component: nodejs
CWE: CWE-248
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T20:41:55.352000+00:00

A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Django: Incorrect file permissions due to race condition
CVE: CVE-2026-25674
Component: django
CWE: CWE-367
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-03T14:28:37.751000+00:00

An issue was discovered in 6.0 before 6.0.3, 5.2 before 5.2.12, and 4.2 before 4.2.29.
Race condition in file-system storage and file-based cache backends in Django allows an attacker to cause file system objects to be created with incorrect permissions via concurrent requests, where one thread's temporary `umask` change affects other threads in multi-threaded environments.
Earlier, unsupported Django series (such as 5.0.x, 4.1.x, and 3.2.x) were not evaluated and may also be affected.
Django would like to thank Tarek Nakkouch for reporting this issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
GIMP: Remote Code Execution via uninitialized memory in PGM file parsing
CVE: CVE-2026-2044
Component: gimp
CWE: CWE-908
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-20T22:23:23.266000+00:00

A flaw was found in GIMP. This uninitialized memory vulnerability allows a remote attacker to execute arbitrary code on affected installations. Successful exploitation requires user interaction, where the target must open a specially crafted PGM (Portable Graymap) image file. This can lead to arbitrary code execution in the context of the current process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Fastify: Denial of Service via unbounded buffering in Web Streams response handling
CVE: CVE-2026-25224
Component: Fastify
CWE: CWE-770
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-03T21:21:35.437000+00:00

A flaw was found in Fastify. A remote client can exploit this denial-of-service vulnerability by sending a slow or non-reading request when the application returns a ReadableStream (or Response with a Web Stream body) via reply.send(). This can lead to unbounded buffering, exhausting server memory. The consequence is a Denial of Service (DoS), potentially causing process crashes or severe degradation of the server.

Statement: LOW. A denial-of-service flaw exists in Fastify's Web Streams response handling. This issue can lead to unbounded buffering and memory exhaustion when a remote client sends a slow or non-reading request to an application that uses `reply.send()` with a `ReadableStream` or `Response` with a Web Stream body. Red Hat products utilizing Fastify in this configuration are affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.