huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
ImageMagick: Policy bypass allows unauthorized access to standard streams via fd:<n> pseudo-filenames
CVE: CVE-2026-25966
Component: ImageMagick
CWE: CWE-184
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-02-24T01:27:53.943000+00:00

A flaw was found in ImageMagick. The "secure" security policy, intended to prevent reading and writing from standard streams, can be bypassed. An attacker can exploit this by using fd:<n> pseudo-filenames, which are not properly blocked by the policy. This allows the attacker to circumvent the intended security restrictions, potentially leading to unauthorized access to standard input/output (stdin/stdout) and subsequent information disclosure or data manipulation.

Statement: This MODERATE impact flaw in ImageMagick allows a security policy bypass through the use of `fd:<n>` pseudo-filenames, enabling unauthorized access to standard input/output despite the "secure" policy. Red Hat Enterprise Linux 6 ELS and 7 ELS, as well as community projects like Fedora and EPEL, are affected by this vulnerability. Exploitation requires an attacker to provide a specially crafted image or command that leverages this bypass.

Remediation:
To mitigate this issue, modify the ImageMagick security policy file, typically located at `/etc/ImageMagick-X/policy.xml` (where X is the version), to explicitly deny access to `fd:` pseudo-filenames. Add a policy rule similar to `<policy domain="delegate" rights="none" pattern="fd:*" />` within the `<policymap>` section. This change will prevent ImageMagick from processing `fd:` paths, thereby closing the bypass. A restart of any services utilizing ImageMagick may be required for the policy change to take effect.
MediaWiki VisualData Extension: Denial of Service via inefficient regular expression
CVE: CVE-2026-0668
Component: MediaWiki
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-01-07T17:36:19.258000+00:00

A flaw was found in Wikimedia Foundation MediaWiki - VisualData Extension. A remote attacker could exploit an inefficient regular expression, leading to a Regular Expression Denial of Service (ReDoS). This vulnerability allows an attacker to provide specially crafted input that causes the regular expression engine to consume excessive processing time, resulting in a denial of service for the affected system.

Statement: This vulnerability is rated Moderate for Red Hat. The MediaWiki VisualData Extension is vulnerable to a Regular Expression Denial of Service (ReDoS) attack. Exploitation requires an attacker to provide crafted user input, which can lead to a denial of service by consuming excessive resources. This issue affects MediaWiki - VisualData Extension version 1.45.

Remediation:
To mitigate this issue, disable the VisualData extension in MediaWiki if it is not essential for your deployment. This can typically be done by commenting out or removing the `wfLoadExtension('VisualData');` line in `LocalSettings.php`. A restart of the web server or PHP-FPM service may be required for the changes to take effect.
denial of service via memory exhaustion in PasswordHash API endpoint
CVE: CVE-2026-28342
Component: OliveTin
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-05T19:33:44.300000+00:00

OliveTin gives access to predefined shell commands from a web interface. Prior to version 3000.10.2, the PasswordHash API endpoint allows unauthenticated users to trigger excessive memory allocation by sending concurrent password hashing requests. By issuing multiple parallel requests, an attacker can exhaust available container memory, leading to service degradation or complete denial of service (DoS). The issue occurs because the endpoint performs computationally and memory-intensive hashing operations without request throttling, authentication requirements, or resource limits. This issue has been patched in version 3000.10.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ImageMagick: Denial of Service via crafted SVG file
CVE: CVE-2026-25989
Component: ImageMagick
CWE: CWE-193
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-24T01:50:12.995000+00:00

A flaw was found in ImageMagick, a software used for editing and manipulating digital images. A remote attacker could exploit an off-by-one boundary check vulnerability by providing a specially crafted SVG (Scalable Vector Graphics) file. This could lead to a denial of service (DoS) condition, making the software unavailable to legitimate users.

Statement: This is a MODERATE impact flaw in ImageMagick that could lead to a denial of service when processing a specially crafted SVG file. Red Hat Enterprise Linux 6 ELS and 7 ELS, as well as Community Projects like Fedora and EPEL, include ImageMagick. Exploitation requires an attacker to provide a malicious SVG file to a system utilizing ImageMagick for image processing.

Remediation:
To mitigate this issue, avoid processing untrusted SVG files with ImageMagick. If ImageMagick is used in an automated or server-side context, consider implementing sandboxing mechanisms or restricting the input sources to trusted origins to limit exposure to specially crafted SVG files.
Undici: Denial of Service via excessive decompression steps
CVE: CVE-2026-22036
Component: undici
CWE: CWE-770
Severity: Low
CVSS v3: 3.6/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-14T19:07:13.745000+00:00

A flaw was found in Undici, an HTTP/1.1 client for Node.js. A remote attacker could exploit this vulnerability by sending a specially crafted HTTP response with an unbounded number of links in the decompression chain. This could lead to high CPU usage and excessive memory allocation, resulting in a Denial of Service (DoS) for the affected system.

Statement: This vulnerability is rated Low for Red Hat products. The flaw in Undici, an HTTP/1.1 client for Node.js, allows a remote malicious server to trigger a Denial of Service by sending a specially crafted HTTP response with excessive decompression steps. This can lead to high CPU usage and memory allocation on the client system. Red Hat products utilizing Undici that connect to untrusted external HTTP servers are potentially affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
phpseclib: Information disclosure via padding oracle timing attack when using AES in CBC mode
CVE: CVE-2026-32935
Component: phpseclib
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-20T02:48:59.778000+00:00

A flaw was found in phpseclib, a PHP secure communications library. When using Advanced Encryption Standard (AES) in Cipher Block Chaining (CBC) mode, a remote attacker can exploit a padding oracle timing attack. This vulnerability may allow the attacker to decrypt sensitive information by observing the time differences in processing malformed ciphertexts.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
infinite recursion in GBNF grammar via nested repetition
CVE: CVE-2026-2069
Component: llama.cpp
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-06T22:02:08.933000+00:00

A flaw has been found in ggml-org llama.cpp up to 55abc39. Impacted is the function llama_grammar_advance_stack of the file llama.cpp/src/llama-grammar.cpp of the component GBNF Grammar Handler. This manipulation causes stack-based buffer overflow. The attack needs to be launched locally. The exploit has been published and may be used. Patch name: 18993. To fix this issue, it is recommended to deploy a patch.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
CVE: CVE-2026-23277
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T00:00:00+00:00

A flaw was found in the Linux kernel. A null pointer dereference vulnerability exists in the Traffic Equalizer (TEQL) module's interaction with the IP tunneling framework. When a Generic Routing Encapsulation (GRE) tap tunnel acts as a TEQL slave, the system attempts to access uninitialized statistics data, leading to a system crash. This can result in a Denial of Service (DoS).


Remediation:
Inappropriate implementation in V8
CVE: CVE-2026-4447
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An inappropriate implementation flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=486657483

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Backstage SSRF when reading from allowed URL's in `backend.reading.allow`
CVE: CVE-2026-24048
Component: @backstage/backend-defaults
CWE: CWE-918
Severity: Low
CVSS v3: 3.3/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
Release date: 2026-01-21T22:51:44.015000+00:00

Backstage is an open framework for building developer portals, and @backstage/backend-defaults provides the default implementations and setup for a standard Backstage backend app. Prior to versions 0.12.2, 0.13.2, 0.14.1, and 0.15.0, the `FetchUrlReader` component, used by the catalog and other plugins to fetch content from URLs, followed HTTP redirects automatically. This allowed an attacker who controls a host listed in `backend.reading.allow` to redirect requests to internal or sensitive URLs that are not on the allowlist, bypassing the URL allowlist security control. This is a Server-Side Request Forgery (SSRF) vulnerability that could allow access to internal resources, but it does not allow attackers to include additional request headers. This vulnerability is fixed in `@backstage/backend-defaults` version 0.12.2, 0.13.2, 0.14.1, and 0.15.0. Users should upgrade to this version or later. Some workarounds are available. Restrict `backend.reading.allow` to only trusted hosts that you control and that do not issue redirects, ensure allowed hosts do not have open redirect vulnerabilities, and/or use network-level controls to block access from Backstage to sensitive internal endpoints.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ASP.NET Core: Denial of Service via uncontrolled resource allocation
CVE: CVE-2026-26130
Component: asp.net
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-10T17:05:22.367000+00:00

A flaw was found in ASP.NET Core. This vulnerability allows an unauthorized attacker to perform a Denial of Service (DoS) attack over a network by allocating resources without limits or throttling. This can lead to the unavailability of the service for legitimate users.


Remediation:
To mitigate this issue, configure resource limits and throttling for ASP.NET Core applications. This can be achieved by implementing request limits within the application configuration or by utilizing resource quotas provided by container orchestration platforms like OpenShift/Kubernetes. Additionally, web servers acting as reverse proxies can be configured to rate limit incoming requests.

Example for OpenShift/Kubernetes ResourceQuotas:
```yaml
apiVersion: v1
kind: ResourceQuota
metadata:
  name: aspnet-core-quotas
spec:
  hard:
    requests.cpu: "1"
    requests.memory: "1Gi"
    limits.cpu: "2"
    limits.memory: "2Gi"
```

Consult ASP.NET Core documentation for application-level request throttling configurations. Ensure that any changes to resource limits or throttling are thoroughly tested to avoid unintended service disruptions. A service restart or reload may be required for changes to take effect.
Traefik: Denial of Service due to incomplete TLS handshake
CVE: CVE-2026-26999
Component: github.com/traefik/traefik
CWE: CWE-772
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-05T16:15:36.437000+00:00

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.38 and 3.6.9, there is a potential vulnerability in Traefik managing TLS handshake on TCP routers. When Traefik processes a TLS connection on a TCP router, the read deadline used to bound protocol sniffing is cleared before the TLS handshake is completed. When a TLS handshake read error occurs, the code attempts a second handshake with different connection parameters, silently ignoring the initial error. A remote unauthenticated client can exploit this by sending an incomplete TLS record and stopping further data transmission, causing the TLS handshake to stall indefinitely and holding connections open. By opening many such stalled connections in parallel, an attacker can exhaust file descriptors and goroutines, degrading availability of all services on the affected entrypoint. This issue has been patched in versions 2.11.38 and 3.6.9.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Inappropriate implementation in V8
CVE: CVE-2026-3910
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-12T00:00:00+00:00

An inappropriate implementation flaw was found in the V8 component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=491410818

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
CVE: CVE-2026-0795
Component: ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T15:56:09.543000+00:00

ALGO 8180 IP Audio Alerter Web UI Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of ALGO 8180 IP Audio Alerter devices. Authentication is required to exploit this vulnerability.

The specific flaw exists within the web-based user interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the device. Was ZDI-CAN-28321.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Flare: Unauthorized information disclosure due to improper access control in the thumbnail endpoint.
CVE: CVE-2026-30230
Component: flare
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-06T21:09:59.726000+00:00

A flaw was found in Flare, a file sharing platform. A remote attacker could exploit this vulnerability due to improper access control in the thumbnail endpoint. This flaw allows an attacker to access thumbnails of password-protected files without providing the correct password, leading to unauthorized information disclosure.

Statement: This MODERATE vulnerability in Flare allows unauthenticated remote attackers to access thumbnails of password-protected files. The thumbnail endpoint skips password verification while other endpoints enforce it, exposing image previews without authorization. Impact is limited to low confidentiality loss as only thumbnails are exposed, not full file contents.

Remediation:
SAMtools: Information Disclosure and Denial of Service via use-after-free vulnerability in mpileup command
CVE: CVE-2026-31972
Component: samtools
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-03-18T20:32:29.862000+00:00

A flaw was found in SAMtools. During the `mpileup` command, data could be prematurely discarded, leading to an attempt to read from memory that has already been freed. This use-after-free vulnerability may allow for the disclosure of sensitive program state information or cause the program to crash, resulting in a Denial of Service (DoS).

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Istio: Information disclosure and authentication bypass via JWKS resolver unavailability
CVE: CVE-2026-31837
Component: istio
CWE: CWE-1392
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-10T21:57:44.387000+00:00

A flaw was found in Istio. A user of Istio could be impacted if the JSON Web Key Set (JWKS) resolver becomes unavailable or fails to fetch keys. This vulnerability can lead to the exposure of hardcoded default settings, potentially bypassing authentication mechanisms and allowing unauthorized access.


Remediation:
fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()
CVE: CVE-2026-23109
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's writeback subsystem. The wait_sb_inodes() function waits for all pages under writeback, including those from FUSE filesystems that traditionally do not have data integrity semantics. If a faulty FUSE server fails to reply to write requests, sync operations can hang indefinitely, causing a denial of service.

Statement: This regression affects systems using FUSE filesystems where the userspace server may be unresponsive or faulty. The hang occurs during sync() operations and can block system shutdown or other processes waiting for I/O completion. The fix restores the prior behavior where FUSE mappings are skipped during data integrity waits.

Remediation:
Inappropriate implementation in Animation
CVE: CVE-2026-2317
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-10T00:00:00+00:00

Inappropriate implementation in Animation in Google Chrome prior to 145.0.7632.45 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths
CVE: CVE-2026-23220
Component: kernel
Severity: None
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ksmbd: fix infinite loop caused by next_smb2_rcv_hdr_off reset in error paths

The problem occurs when a signed request fails smb2 signature verification
check. In __process_request(), if check_sign_req() returns an error,
set_smb2_rsp_status(work, STATUS_ACCESS_DENIED) is called.
set_smb2_rsp_status() set work->next_smb2_rcv_hdr_off as zero. By resetting
next_smb2_rcv_hdr_off to zero, the pointer to the next command in the chain
is lost. Consequently, is_chained_smb2_message() continues to point to
the same request header instead of advancing. If the header's NextCommand
field is non-zero, the function returns true, causing __handle_ksmbd_work()
to repeatedly process the same failed request in an infinite loop.
This results in the kernel log being flooded with "bad smb2 signature"
messages and high CPU usage.

This patch fixes the issue by changing the return value from
SERVER_HANDLER_CONTINUE to SERVER_HANDLER_ABORT. This ensures that
the processing loop terminates immediately rather than attempting to
continue from an invalidated offset.


Remediation:
Inappropriate implementation in V8
CVE: CVE-2026-0900
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T00:00:00+00:00

Inappropriate implementation in V8 in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
ImageMagick: Denial of Service and data corruption due to crafted DJVU image processing
CVE: CVE-2026-27799
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
Release date: 2026-02-25T23:20:25.204000+00:00

A flaw was found in ImageMagick, a software suite used for editing and manipulating digital images. This vulnerability, a heap buffer over-read, exists within the component that handles DJVU image files. A local attacker could exploit this by processing a specially crafted DJVU image, leading to an error where the software miscalculates memory allocation due to an integer truncation. This causes the software to attempt to read memory outside its designated boundaries, which can result in a denial of service or potentially corrupt data.

Statement: This MODERATE impact vulnerability in ImageMagick involves a heap buffer over-read within the DJVU image format handler. The flaw occurs due to an integer truncation during stride calculation for pixel buffer allocation, leading to out-of-bounds memory reads when processing a specially crafted DJVU image. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected.

Remediation:
To mitigate this issue, avoid processing untrusted DJVU image files with ImageMagick. For server deployments, restrict network access to services that use ImageMagick for image processing. As an additional measure, consider disabling the DJVU delegate in ImageMagick's policy.xml configuration to prevent the processing of DJVU files. This may impact functionality that relies on DJVU image support.