huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
libarchive: Information disclosure via heap out-of-bounds read in RAR archive processing
CVE: CVE-2026-4424
Component: libarchive
CWE: CWE-125
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-19T00:00:00+00:00

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

Statement: IMPORTANT: This heap out-of-bounds read vulnerability in libarchive's RAR archive processing logic can lead to information disclosure. A remote attacker can exploit this flaw by providing a specially crafted RAR archive, potentially revealing sensitive heap memory information without requiring authentication or user interaction on systems that process untrusted archives.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
GnuPG: Stack-based buffer overflow in tpm2daemon allows arbitrary code execution
CVE: CVE-2026-24882
Component: GnuPG
CWE: CWE-121
Severity: Important
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-27T18:40:18.166000+00:00

A flaw was found in GnuPG. This vulnerability, a stack-based buffer overflow, occurs in the `tpm2daemon` component when processing PKDECRYPT commands for cryptographic keys secured by a Trusted Platform Module (TPM). A local attacker could exploit this to execute unauthorized code, potentially gaining full control of the system, or disrupt its operation, leading to a denial of service.

Statement: This is an IMPORTANT vulnerability in GnuPG's tpm2daemon, affecting systems configured to use TPM-backed RSA and ECC keys. A stack-based buffer overflow can occur when processing PKDECRYPT commands, potentially leading to denial of service or arbitrary code execution. Red Hat Enterprise Linux and Fedora systems are impacted if utilizing TPM-backed keys with GnuPG.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
email header injection due to unquoted newlines
CVE: CVE-2026-1299
Component: cpython
CWE: CWE-93
Severity: Moderate
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N
Release date: 2026-01-23T16:27:13.346000+00:00

A flaw was found in the email module in the Python standard library. When serializing an email message, the BytesGenerator class fails to properly quote newline characters for email headers. This issue is exploitable when the LiteralHeader class is used as it does not respect email folding rules, allowing an attacker to inject email headers and potentially modify message recipients or the email body, and spoof sender information.

Statement: This issue can only be exploitable by Python applications using the LiteralHeader class to write email headers, as it does not respect email folding rules. Additionally, this issue allows attackers to modify message recipients or the email body and spoof sender identity but it does not cause memory corruption or arbitrary code execution. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
To mitigate this issue, applications accepting user-supplied data for email headers should sanitize the input by stripping or rejecting any strings containing carriage return or line feed characters, '\r' or '\n', respectively, preventing malicious sequences that could lead to header manipulation.
Keycloak: Unauthorized modification of unmanaged user attributes by administrators
CVE: CVE-2026-0871
Component: org.keycloak/keycloak-services
CWE: CWE-266
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-01-01T00:00:00+00:00

A flaw was found in Keycloak. An administrator with `manage-users` permission can bypass the "Only administrators can view" setting for unmanaged attributes, allowing them to modify these attributes. This improper access control can lead to unauthorized changes to user profiles, even when the system is configured to restrict such modifications.

Statement: This vulnerability is rated Moderate for Red Hat. An administrator with `manage-users` permission can modify unmanaged user attributes in Keycloak, even when the "Only administrators can view" setting is enabled. This bypass requires the realm to be configured with unmanaged attributes set to "Only administrators can view" and the administrator to possess `manage-users` permission.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Optimizer unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21950
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).  Supported versions that are affected are 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server.  Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 6.5 (Availability impacts).  CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
pypdf: Denial of Service via crafted PDF with missing /Root object
CVE: CVE-2026-22690
Component: pypdf
CWE: CWE-400
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-10T04:41:20.773000+00:00

pypdf is a free and open-source pure-python PDF library. Prior to version 6.6.0, pypdf has possible long runtimes for missing /Root object with large /Size values. An attacker who uses this vulnerability can craft a PDF which leads to possibly long runtimes for actually invalid files. This can be achieved by omitting the /Root entry in the trailer, while using a rather large /Size value. Only the non-strict reading mode is affected. This issue has been patched in version 6.6.0.

Statement: This vulnerability is rated Moderate. The `pypdf` library, when processing a specially crafted PDF file that omits the `/Root` entry and uses a large `/Size` value in non-strict mode, can lead to excessively long processing times, resulting in a Denial of Service. This affects various components within Red Hat Ansible Automation Platform, OpenShift Lightspeed, Red Hat Enterprise Linux AI, Red Hat OpenShift AI, and Ansible Services.

Remediation:
CVE: CVE-2026-0758
Component: mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability
Release date: 2026-01-09T16:26:12.442000+00:00

mcp-server-siri-shortcuts shortcutName Command Injection Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of mcp-server-siri-shortcuts. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the shortcutName parameter. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-27910.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
thunderbird: Use-after-free in the JavaScript Engine component
CVE: CVE-2026-2765
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:03.943000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the JavaScript Engine component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Linux kernel: Denial of Service in intel-xway PHY driver due to OF node reference count leakage
CVE: CVE-2026-23081
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's intel-xway PHY (Physical Layer) driver. This vulnerability involves an improper management of Open Firmware (OF) node reference counts. A local attacker could exploit this by repeatedly triggering a specific condition, leading to resource exhaustion and ultimately a denial of service (DoS) on the system.


Remediation:
ImageMagick: Denial of Service via crafted image leading to an infinite loop
CVE: CVE-2026-26283
Component: ImageMagick
CWE: CWE-835
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T01:55:59.350000+00:00

A flaw was found in ImageMagick. An attacker can exploit this vulnerability by providing a specially crafted image. This crafted image can trigger an infinite loop within the JPEG encoder, causing the software to consume 100% of the CPU and become unresponsive. This leads to a Denial of Service (DoS), preventing legitimate users from accessing the image processing functionality.

Statement: This MODERATE impact denial of service flaw in ImageMagick can be triggered by processing a specially crafted image, leading to an infinite loop and 100% CPU consumption. Red Hat Enterprise Linux 6 and 7, along with Fedora and EPEL, are affected by this vulnerability. Exploitation requires an attacker to provide a malicious image file to a system utilizing ImageMagick for image processing.

Remediation:
To mitigate this issue, avoid processing untrusted JPEG images with ImageMagick. If ImageMagick is deployed in a service context, consider implementing sandboxing mechanisms or restricting access to trusted sources to limit potential exposure.
spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer
CVE: CVE-2026-23202
Component: kernel
CWE: CWE-364
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A race condition was found in the Tegra210 Quad SPI driver. The curr_xfer field is cleared without holding the spinlock, allowing the IRQ handler to read a partially updated or stale value, potentially leading to NULL pointer dereference or use-after-free.

Statement: This affects NVIDIA Tegra210-based systems using the Quad SPI controller. The race requires specific timing between SPI transfer completion and interrupt handling, making exploitation difficult but potentially causing system crashes.

Remediation:
Information disclosure in the XML component
CVE: CVE-2026-0888
Component: firefox
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-01-13T13:30:58.296000+00:00

Information disclosure in the XML component. This vulnerability affects Firefox < 147 and Thunderbird < 147.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Sentencepiece: Invalid memory access leading to potential arbitrary code execution via a crafted model file.
CVE: CVE-2026-1260
Component: sentencepiece
CWE: CWE-119
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-22T17:06:17.340000+00:00

A flaw was found in Sentencepiece. This flaw involves invalid memory access when the software processes a specially crafted, vulnerable model file. A local attacker could exploit this by tricking a user into loading such a file. Successful exploitation could lead to a denial of service, information disclosure, or potentially arbitrary code execution.

Statement: This IMPORTANT flaw in Sentencepiece allows invalid memory access when processing a specially crafted model file. A local attacker could exploit this by deceiving a user into loading a malicious file, potentially leading to denial of service, information disclosure, or arbitrary code execution. Red Hat products utilizing Sentencepiece, such as Red Hat AI Inference Server and Red Hat OpenShift AI, are affected if they process untrusted model files.

Remediation:
For Red Hat OpenShift AI 2.25.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
For Red Hat OpenShift AI 3.3 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/
pnpm: Arbitrary code execution via path traversal in bin linking
CVE: CVE-2026-23890
Component: pnpm
CWE: CWE-23
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Release date: 2026-01-26T21:53:40.810000+00:00

A flaw was found in pnpm, a package manager. A remote attacker can exploit a path traversal vulnerability by crafting malicious npm packages. This vulnerability allows the attacker to bypass validation by using bin names starting with an "@" symbol, enabling them to create executable shims or symbolic links (symlinks) outside of the designated `node_modules/.bin` directory. This could lead to arbitrary code execution or privilege escalation on the affected system.

Statement: This vulnerability is rated Moderate for Red Hat. It affects systems using pnpm where malicious npm packages can exploit a path traversal flaw during bin linking. This allows the creation of executable files or symlinks outside of the `node_modules/.bin` directory, posing a risk in environments that install untrusted npm packages, such as development or CI/CD pipelines.

Remediation:
To mitigate this issue, ensure that only trusted npm packages are installed when utilizing pnpm. Restrict the use of pnpm for package installation to controlled environments, such as secure CI/CD pipelines, to prevent the introduction of malicious packages. Implement robust package source validation and integrity checks to minimize exposure.
drm/gud: fix NULL fb and crtc dereferences on USB disconnect
CVE: CVE-2026-23039
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's GUD (Generic USB Display) driver. When a USB display is disconnected, drm_atomic_helper_disable_all() sets the framebuffer and CRTC pointers to NULL before invoking a commit. The driver then attempts to dereference these NULL pointers, causing a kernel crash on every USB display disconnect event.

Statement: This vulnerability affects systems using USB displays with the GUD driver. Every disconnect of a GUD-compatible USB display causes a kernel crash, making the driver effectively unusable for hot-plug scenarios. Physical access to connect/disconnect USB displays is required to trigger the crash.

Remediation:
To mitigate this issue, prevent the gud module from being loaded if USB displays are not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()
CVE: CVE-2026-23193
Component: kernel
CWE: CWE-364
Severity: Moderate
CVSS v3: 7.2/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count()

In iscsit_dec_session_usage_count(), the function calls complete() while
holding the sess->session_usage_lock. Similar to the connection usage count
logic, the waiter signaled by complete() (e.g., in the session release
path) may wake up and free the iscsit_session structure immediately.

This creates a race condition where the current thread may attempt to
execute spin_unlock_bh() on a session structure that has already been
deallocated, resulting in a KASAN slab-use-after-free.

To resolve this, release the session_usage_lock before calling complete()
to ensure all dereferences of the sess pointer are finished before the
waiter is allowed to proceed with deallocation.

Statement: A use after free can occur in the iSCSI target session usage count logic because iscsit_dec_session_usage_count can call complete while holding session_usage_lock. A waiting thread in the session release path can wake up and free the session structure immediately after the completion is signaled. The current thread may then attempt to unlock or otherwise access fields in a session object that has already been deallocated which can trigger a slab use after free and crash the kernel. The attack surface is adjacent network because iSCSI targets are typically reachable only inside storage or data center networks. Impact can be denial of service. A conservative assessment also considers potential confidentiality and integrity impact due to kernel memory corruption from a use after free.

Remediation:
To mitigate this issue, prevent module iscsi_target_mod from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
Next.js: Unbounded postponed resume buffering can lead to DoS
CVE: CVE-2026-27979
Component: next.js
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-18T00:13:29.748000+00:00

A denial of service flaw has been discovered in Next.js. A request containing the `next-resume: 1` header (corresponding with a PPR resume request) would buffer request bodies without consistently enforcing `maxPostponedStateSize` in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments remained vulnerable to the same unbounded postponed resume-body buffering behavior. In applications using the App Router with Partial Prerendering capability enabled (via `experimental.ppr` or `cacheComponents`), an attacker could send oversized `next-resume` POST payloads that were buffered without consistent size enforcement in non-minimal deployments, causing excessive memory usage and potential denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Gitea Organization Projects Cross-Organization Authorization Bypass via Project ID (IDOR)
CVE: CVE-2026-20750
Component: gitea
CWE: CWE-284
Severity: Critical
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-01-22T22:01:49.948000+00:00

Gitea does not properly validate project ownership in organization project operations. A user with project write access in one organization may be able to modify projects belonging to a different organization.


Remediation:
net: add proper RCU protection to /proc/net/ptype
CVE: CVE-2026-23255
Component: kernel
CWE: CWE-362
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.

Statement: This is an RCU synchronization bug in /proc/net/ptype iteration, where ptype_seq_next() and ptype_seq_show() accessed shared state without proper RCU-safe reads. A local attacker or stress tool may trigger the race by reading /proc/net/ptype while packet type or device state changes concurrently, leading mainly to RCU stalls or denial of service.

Remediation:
Vim: Information disclosure and denial of service via malformed tags file
CVE: CVE-2026-28419
Component: vim
CWE: CWE-124
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-02-27T22:02:55.952000+00:00

A flaw was found in Vim, an open-source command-line text editor. This vulnerability, a heap-based buffer underflow, occurs when Vim processes a specially crafted Emacs-style tags file. If a malicious file with a delimiter at the start of a line is opened, Vim attempts to read memory outside its designated area. This could lead to the disclosure of sensitive information or cause the application to crash, resulting in a denial of service.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Apache Solr: Insufficient file-access checking in standalone core-creation requests
CVE: CVE-2026-22444
Component: org.apache.solr/solr-core
CWE: CWE-20
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-01-21T13:40:24.979000+00:00

The "create core" API of Apache Solr 8.6 through 9.10.0 lacks sufficient input validation on some API parameters, which can cause Solr to check the existence of and attempt to read file-system paths that should be disallowed by Solr's  "allowPaths" security setting https://https://solr.apache.org/guide/solr/latest/configuration-guide/configuring-solr-xml.html#the-solr-element .  These read-only accesses can allow users to create cores using unexpected configsets if any are accessible via the filesystem.  On Windows systems configured to allow UNC paths this can additionally cause disclosure of NTLM "user" hashes. 

Solr deployments are subject to this vulnerability if they meet the following criteria:
  *  Solr is running in its "standalone" mode.
  *  Solr's "allowPath" setting is being used to restrict file access to certain directories.
  *  Solr's "create core" API is exposed and accessible to untrusted users.  This can happen if Solr's  RuleBasedAuthorizationPlugin https://solr.apache.org/guide/solr/latest/deployment-guide/rule-based-authorization-plugin.html  is disabled, or if it is enabled but the "core-admin-edit" predefined permission (or an equivalent custom permission) is given to low-trust (i.e. non-admin) user roles.

Users can mitigate this by enabling Solr's RuleBasedAuthorizationPlugin (if disabled) and configuring a permission-list that prevents untrusted users from creating new Solr cores.  Users should also upgrade to Apache Solr 9.10.1 or greater, which contain fixes for this issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.