huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Suricata dnp3: unbounded transaction growth
CVE: CVE-2026-22259
Component: suricata
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-27T17:13:11.057000+00:00

Suricata is a network IDS, IPS and NSM engine. Prior to versions 8.0.3 and 7.0.14, specially crafted traffic can cause Suricata to consume large amounts of memory while parsing DNP3 traffic. This can lead to the process slowing down and running out of memory, potentially leading to it getting killed by the OOM killer. Versions 8.0.3 or 7.0.14 contain a patch. As a workaround, disable the DNP3 parser in the suricata yaml (disabled by default).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Glances has Incomplete Secrets Redaction: /api/v4/args Endpoint Leaks Password Hash and SNMP Credentials
CVE: CVE-2026-32609
Component: nicolargo.github.io/glances
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-18T14:30:37.786000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
btrfs: release path before initializing extent tree in btrfs_read_locked_inode()
CVE: CVE-2026-23018
Component: kernel
CWE: CWE-833
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

A potential deadlock vulnerability was found in the Linux kernel's Btrfs filesystem. In btrfs_read_locked_inode(), the function calls btrfs_init_file_extent_tree() while holding a read-locked leaf from the subvolume tree. Since btrfs_init_file_extent_tree() may perform GFP_KERNEL memory allocation, it can trigger memory reclaim which creates a circular lock dependency between the btree lock, fs_reclaim, and the delayed_node mutex.

Statement: This is a lockdep-detected circular locking dependency that can theoretically cause a deadlock under memory pressure. The chain involves: fs_reclaim → btrfs-tree lock → delayed_node mutex → fs_reclaim. While lockdep warns about this pattern, triggering an actual deadlock requires specific memory pressure conditions during inode lookup operations.

Remediation:
FreeRDP has a heap-buffer-overflow in ecam_encoder_compress_h264
CVE: CVE-2026-24677
Component: freerdp
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T18:16:44.715000+00:00

A heap buffer overflow has been discovered in FreeRDP. ecam_encoder_compress_h264 trusts server-controlled dimensions and does not validate the source buffer size, leading to an out-of-bounds read in sws_scale.

Statement: Availability impact is limited to the FreeRDP instance on Red Hat Products. General system availability is not at risk.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Local File Disclosure via Path Traversal
CVE: CVE-2026-25965
Component: ImageMagick
CWE: CWE-22
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-02-24T01:20:44.175000+00:00

A flaw was found in ImageMagick. ImageMagick's path security policy, which is designed to restrict access to certain file paths, is enforced on the raw filename string before the operating system resolves the full path. This allows an attacker to bypass security policies, such as those preventing access to sensitive directories like /etc/*, by using a path traversal technique. This vulnerability enables local file disclosure, allowing an attacker to read sensitive files even when security policies are in place.

Statement: This IMPORTANT vulnerability in ImageMagick allows for local file disclosure due to a path traversal flaw. ImageMagick's security policy, which is intended to restrict file access, can be bypassed because it evaluates the filename before the operating system resolves path traversals. This affects ImageMagick in Red Hat Enterprise Linux and community projects, potentially allowing an attacker to read restricted content despite configured security policies.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
stack-based buffer overflow in sixel encoder
CVE: CVE-2026-32259
Component: ImageMagick
CWE: CWE-121
Severity: Moderate
CVSS v3: 5.3/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
Release date: 2026-03-12T19:38:12.192000+00:00

A flaw was found in ImageMagick. Processing a specially crafted file with the sixel encoder can cause a stack-based buffer overflow when a memory allocation fails, leading to a denial of service.

Statement: To exploit this issue, an attacker needs to convince a user to process a specially crafted file that makes ImageMagick use the sixel encoder. Furthermore, this flaw is only triggered when a memory allocation fails, limiting the possibility of exploitation even further.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability to a denial of service.

Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
To mitigate this vulnerability, disable the vulnerable encoder by adding the following line to the ImageMagick policy.xml file, typically located in the directory /etc/ImageMagick-7/, /etc/ImageMagick-6/ or /etc/ImageMagick/:

~~~
<policy domain="coder" rights="none" pattern="sixel" />
~~~

To reduce the risk of exploitation, avoid processing sixel files from untrusted sources. If ImageMagick is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.
Keycloak SAML broker: Authentication bypass due to disabled SAML client completing IdP-initiated login
CVE: CVE-2026-3047
Component: org.keycloak.broker.saml
CWE: CWE-305
Severity: Important
CVSS v3: 9.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-03-05T11:24:00+00:00

A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

Statement: CRITICAL: This flaw allows a disabled SAML client in Keycloak, when configured as an IdP-initiated broker landing target, to still facilitate a successful login. This bypasses the intended security control, granting an authenticated user access to other enabled clients without re-authentication. This issue affects Keycloak instances where a disabled SAML client is configured for IdP-initiated brokering and the user exists in the external Identity Provider.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
To mitigate this issue, ensure that any SAML client intended to be disabled is not configured as an IdP-initiated broker landing target within Keycloak. Review your Keycloak realm configurations to identify and remove any such associations for disabled clients.
pip: Information disclosure via path traversal when installing crafted wheel archives
CVE: CVE-2026-1703
Component: pip
CWE: CWE-22
Severity: Low
CVSS v3: 4.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-02-02T14:43:02.919000+00:00

A flaw was found in pip. A remote attacker could exploit this path traversal vulnerability by tricking a user into installing a maliciously crafted wheel archive. This could lead to files being extracted outside the intended installation directory, potentially disclosing sensitive information.

Statement: This LOW impact flaw in pip allows information disclosure via path traversal when installing crafted wheel archives. While files may be extracted outside the installation directory, the traversal is limited to prefixes of the installation directory, preventing injection or overwriting of executable files in typical Red Hat environments.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
hex_core, hex, rebar3: Denial of Service due to uncontrolled resource consumption
CVE: CVE-2026-21619
Component: hex_core
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-27T17:57:11.513000+00:00

A flaw was found in the hex_core, hex, and rebar3 components. This vulnerability, stemming from uncontrolled resource consumption and deserialization of untrusted data, allows a remote attacker to perform object injection and excessive memory allocation. By sending specially crafted data, an attacker can trigger a denial of service (DoS) condition, rendering the affected system unresponsive.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels
CVE: CVE-2026-23274
Component: kernel
CWE: CWE-908
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter: xt_IDLETIMER module. This vulnerability occurs when revision 0 rules attempt to reuse a timer label previously created by revision 1 with alarm timer semantics. This action can lead to calling mod_timer() on an uninitialized timer list. A local attacker could potentially trigger debug object warnings and, under certain configurations, cause a kernel panic, leading to a Denial of Service (DoS).


Remediation:
Stack buffer overflow in WebRTC
CVE: CVE-2026-4444
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A stack buffer overflow flaw was found in the WebRTC component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=486349161

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Compress::Raw::Zlib: Vulnerabilities due to outdated zlib library
CVE: CVE-2026-3381
Component: compress-raw-zlib
CWE: CWE-1104
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-05T01:28:48.062000+00:00

Compress::Raw::Zlib versions through 2.219 for Perl use potentially insecure versions of zlib.

Compress::Raw::Zlib includes a copy of the zlib library. Compress::Raw::Zlib version 2.220 includes zlib 1.3.2, which addresses findings fron the 7ASecurity audit of zlib. The includes fixs for CVE-2026-27171.

Statement: This has been rated as moderate as the older version of zlib only has two known flaws, and one of them is a bufferoverflow that is in the  contrib directory, and so are not part of zlib.

Remediation:
ntpd-rs: Denial of Service via malformed NTS packets requesting excessive cookies
CVE: CVE-2026-26076
Component: ntpd-rs
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-12T21:48:44.651000+00:00

ntpd-rs is a full-featured implementation of the Network Time Protocol. Prior to 1.7.1, an attacker can remotely induce moderate increases (2-4 times above normal) in cpu usage. When having NTS enabled on an ntpd-rs server, an attacker can create malformed NTS packets that take significantly more effort for the server to respond to by requesting a large number of cookies. This can lead to degraded server performance even when a server could otherwise handle the load. This vulnerability is fixed in 1.7.1.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CVE: CVE-2026-0779
Component: ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:51:48.538000+00:00

ALGO 8180 IP Audio Alerter Ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-25568.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap buffer overflow in Codecs
CVE: CVE-2026-2314
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-10T00:00:00+00:00

Heap buffer overflow in Codecs in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
PHPUnit: Arbitrary code execution via unsafe deserialization of code coverage files
CVE: CVE-2026-24765
Component: phpunit
CVSS v3: 7.9/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-27T21:35:54.292000+00:00

A flaw was found in PHPUnit, a testing framework for PHP. This vulnerability involves unsafe deserialization of code coverage data during PHPT test execution. An attacker with local file write access can exploit this by placing a malicious serialized object into the file system. This can lead to arbitrary code execution when tests are run with code coverage instrumentation enabled.

Statement: This is an IMPORTANT vulnerability in PHPUnit that allows arbitrary code execution. It requires an attacker to have local file write access to the system where PHPUnit tests are executed with code coverage instrumentation enabled. This typically impacts development and CI/CD environments, where malicious `.coverage` files could be introduced.

Remediation:
ImageMagick: Information disclosure or denial of service via crafted image with invalid pixel index
CVE: CVE-2026-25898
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Release date: 2026-02-24T01:18:33.031000+00:00

A flaw was found in ImageMagick. A remote attacker can exploit this vulnerability by crafting a malicious image file. The UIL and XPM image encoders do not properly validate pixel index values, which can become negative in High Dynamic Range Imaging (HDRI) builds. This improper validation leads to a global buffer overflow read, potentially resulting in information disclosure or a denial of service (DoS) due to a process crash.

Statement: This MODERATE impact vulnerability in ImageMagick's UIL and XPM image encoders allows for a global buffer overflow read when processing specially crafted images with negative pixel index values. This flaw can lead to information disclosure or a denial of service. Red Hat Enterprise Linux and Community Projects that include ImageMagick are affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
HTSlib: CRAM decoder vulnerable to buffer overflow
CVE: CVE-2026-31971
Component: htslib
CVSS v3: 7.4/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
Release date: 2026-03-18T19:55:20.379000+00:00

A flaw was found in HTSlib, a library used for bioinformatics file formats. When reading CRAM (Compressed Reference-oriented Alignment Map) files, the `cram_byte_array_len_decode()` function did not properly validate the size of incoming data against the allocated buffer. This memory corruption vulnerability allows a remote attacker to cause a heap or stack overflow by tricking a user into opening a specially crafted CRAM file. Successful exploitation could lead to arbitrary code execution, program crashes, or data corruption.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Heap buffer overflow in WebML
CVE: CVE-2026-3913
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

A heap buffer overflow flaw was found in the WebML component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=483445078

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
CVE: CVE-2026-0796
Component: ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:56:16.540000+00:00

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28322.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
NLTK: Arbitrary file read via improper path validation in `filestring()` function
CVE: CVE-2026-0846
Component: nltk
CWE: CWE-22
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-09T19:19:09.464000+00:00

A flaw was found in the `nltk` component. This vulnerability, specifically within the `filestring()` function of the `nltk.util` module, allows an attacker to perform arbitrary file reads. By providing specially crafted input paths, either absolute or using directory traversal, an attacker can bypass input validation and access sensitive system files. This can be exploited both locally and remotely, particularly when the function processes user-supplied input in applications like web APIs.

Statement: This IMPORTANT vulnerability in NLTK allows arbitrary file reads through the `nltk.util.filestring()` function. Exploitation requires no authentication and is network-accessible when the function is exposed to untrusted input. Impact is high confidentiality loss as sensitive files like credentials and configuration can be read. Red Hat products using NLTK with exposed file input handling are affected.

Remediation:
snowflake-jdbc: Denial of Service via inefficient regular expression processing
CVE: CVE-2026-3293
Component: snowflake-jdbc
CWE: CWE-1333
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-27T05:32:09.400000+00:00

A flaw was found in snowflake-jdbc. A local user can exploit a vulnerability in the `SdkProxyRoutePlanner` function by manipulating the `nonProxyHosts` argument. This manipulation leads to inefficient regular expression complexity, which can result in a Denial of Service (DoS) condition.


Remediation:
seroval: Prototype pollution via improper input validation during JSON deserialization
CVE: CVE-2026-23736
Component: seroval
CVSS v3: 7.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-01-21T23:01:10.114000+00:00

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, due to improper input validation, a malicious object key can lead to prototype pollution during JSON deserialization. This vulnerability affects only JSON deserialization functionality. This issue is fixed in version 1.4.1.

Statement: This vulnerability is rated Important for Red Hat as it affects the `seroval` library, which is utilized in `forgejo` within Fedora and EPEL. The flaw allows for prototype pollution during JSON deserialization due to improper input validation in versions 1.4.0 and below. Exploitation requires processing of malicious JSON input.

Remediation:
xfs: fix UAF in xchk_btree_check_block_owner
CVE: CVE-2026-23223
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-18T00:00:00+00:00

A use-after-free flaw was found in the Linux kernel's XFS filesystem scrub functionality. In xchk_btree_check_block_owner(), the code dereferences bs->cur to check if it aliases with bs->sc->sa.bno_cur or bs->sc->sa.rmap_cur after these cursors may have already been freed. This incorrect temporal ordering was introduced when the xfs_btnum_t type was removed, potentially leading to a use-after-free condition during filesystem consistency checks.

Statement: This flaw occurs in the XFS online filesystem scrub code path, which is typically invoked via the xfs_scrub utility with elevated privileges. The race window is narrow and requires specific scrub operations on XFS filesystems. Systems not using XFS or not running filesystem scrub operations are unaffected.

Remediation: