huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
denial of service vulnerability in parsePatch and applyPatch
CVE: CVE-2026-24001
Component: jsdiff
CWE: CWE-400
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-22T02:23:44.059000+00:00

A flaw was found in jsdiff. A specially crafted patch input containing specific line break characters can cause the parsePatch method to enter an infinite loop, leading to uncontrolled memory consumption and a process crash, resulting in a denial of service. The applyPatch method is similarly affected when called with a string representation of a patch as an argument. Additionally, a related vulnerability allows a Regular Expression Denial of Service (ReDoS) when these characters are present in a patch filename header, significantly increasing parsing time.

Statement: Applications using the parsePatch and the applyPatch methods to process patches provided by user input are vulnerable to this issue. Specifically, specially crafted patch input with line break characters such as \r, \u2028, or \u2029 can cause an infinite loop, excessive resource consumption and application crashes. This issue can occur even with small payloads or when users control filename headers, allowing a remote attacker to cause a denial of service. Due to this reason, this vulnerability has been rated with an important severity.

Remediation:
To mitigate this flaw, applications parsing user-supplied patch data should implement input validation to detect and reject input containing line break characters, such as \r, \u2028, or \u2029 before passing the input to the parsePatch and the applyPatch methods, preventing the library from entering an infinite loop and consuming excessive memory.
React Router allows a DoS via cache poisoning by forcing SPA mode
CVE: CVE-2025-43864
Component: react-router
CWE: CWE-755
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-04-25T00:18:16.058000+00:00

A flaw was found in the React Router. This vulnerability allows an attacker to trigger a rendering error via a crafted X-React-Router-SPA-Mode header, which can result in cache poisoning. If a caching system is in place, the corrupted error response may be cached and served to subsequent users, significantly impacting application availability.

Statement: The severity of this vulnerability is rated Moderate, as it does not impact system availability. The effects are confined to the application layer, specifically involving data manipulation and potential cache poisoning, without compromising the underlying system stability.

Remediation:
clk: xilinx: vcu: unregister pll_post only if registered correctly
CVE: CVE-2025-38583
Component: kernel
Severity: None
Release date: 2025-08-19T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

clk: xilinx: vcu: unregister pll_post only if registered correctly

If registration of pll_post is failed, it will be set to NULL or ERR,
unregistering same will fail with following call trace:

Unable to handle kernel NULL pointer dereference at virtual address 008
pc : clk_hw_unregister+0xc/0x20
lr : clk_hw_unregister_fixed_factor+0x18/0x30
sp : ffff800011923850
...
Call trace:
 clk_hw_unregister+0xc/0x20
 clk_hw_unregister_fixed_factor+0x18/0x30
 xvcu_unregister_clock_provider+0xcc/0xf4 [xlnx_vcu]
 xvcu_probe+0x2bc/0x53c [xlnx_vcu]


Remediation:
bus: mhi: ep: Update read pointer only after buffer is written
CVE: CVE-2025-38429
Component: kernel
Severity: None
Release date: 2025-07-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

bus: mhi: ep: Update read pointer only after buffer is written

Inside mhi_ep_ring_add_element, the read pointer (rd_offset) is updated
before the buffer is written, potentially causing race conditions where
the host sees an updated read pointer before the buffer is actually
written. Updating rd_offset prematurely can lead to the host accessing
an uninitialized or incomplete element, resulting in data corruption.

Invoke the buffer write before updating rd_offset to ensure the element
is fully written before signaling its availability.


Remediation:
Environment Variable Injection for dotenv API in zx
CVE: CVE-2025-24959
Component: zx
CVSS v3: 0/AV:A/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:N
Release date: 2025-02-03T20:48:16.507000+00:00

A flaw was discovered in the zx script utility. This flaw allows an attacker with control over environment variable values to inject unintended environment variables into `process.env`. This issue can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for security-sensitive operations. Applications that process untrusted input and pass it through `dotenv.stringify` are particularly vulnerable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Users should immediately upgrade to this version to mitigate the vulnerability. If upgrading is not feasible, users can mitigate the vulnerability by sanitizing user-controlled environment variable values before passing them to `dotenv.stringify`. Specifically, avoid using `"`, `'`, and backticks in values, or enforce strict validation of environment variables before usage.
Uncontrolled recursion in Connect2id Nimbus JOSE + JWT
CVE: CVE-2025-53864
Component: com.nimbusds/nimbus-jose-jwt
CWE: CWE-674
Severity: Moderate
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L
Release date: 2025-07-11T00:00:00+00:00

A denial of service flaw has been discovered in Connect2id Nimbus JOSE + JWT. This issue can allow a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
use-after-free when creating a Matroska demuxed track (SETUP)
CVE: CVE-2025-65405
Component: live555
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2025-12-01T00:00:00+00:00

A flaw was found in Live555. A use-after-free issue in ADTSAudioFileSource::samplingFrequency() allows attackers to cause a denial of service via a specially crafted ADTS/AAC file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Local denial-of-service via cupsd.conf update and related issues
CVE: CVE-2025-61915
Component: CUPS
CWE: CWE-1173
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Release date: 2025-11-28T00:00:00+00:00

A flaw was found in cups. A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config 
and insert a malicious line. Then the cupsd process which runs as root will parse the new config and  cause an out-of-bound write.

Statement: The highest threat of this flaw is to system availability. A local attacker with high privileges, specifically a user belonging to the `SystemGroup` as defined in `/etc/cups/cups-files.conf`, could exploit the CUPS web interface to introduce a malicious configuration line into `cupsd.conf`, leading to a denial of service.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
mtdchar: fix integer overflow in read/write ioctls
CVE: CVE-2025-68237
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-16T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

mtdchar: fix integer overflow in read/write ioctls

The "req.start" and "req.len" variables are u64 values that come from the
user at the start of the function.  We mask away the high 32 bits of
"req.len" so that's capped at U32_MAX but the "req.start" variable can go
up to U64_MAX which means that the addition can still integer overflow.

Use check_add_overflow() to fix this bug.


Remediation:
Bouncycastle Resource Exhaustion
CVE: CVE-2025-9092
Component: org.bouncycastle
CWE: CWE-400
Severity: Low
CVSS v3: 2.0/AV:L/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:L
Release date: 2025-08-16T10:29:59.417000+00:00

Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. Bouncy Castle for Java - BC-FJA 2.1.0 bc-fips (API modules) allows Excessive Allocation. This vulnerability is associated with program files org.Bouncycastle.Crypto.Fips.NativeLoader.

This issue affects Bouncy Castle for Java - BC-FJA 2.1.0: from BC-FJA 2.1.0 through 2.1.0.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Securden Unified PAM Shared SSH Key and Cloud Infrastructure
CVE: CVE-2025-6737
Component: Securden-Unified-PAM
Release date: 2025-08-25T16:17:42.677000+00:00

Securden’s Unified PAM Remote Vendor Gateway access portal shares infrastructure and access tokens across multiple tenants. A malicious actor can obtain authentication material and access the gateway server with low-privilege permissions.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
continuwuity Has an Unintended Proxy or Intermediary and Improper Input Validation
CVE: CVE-2025-68667
Component: conduit
CVSS v3: 9.8/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-12-23T22:45:25.958000+00:00

Conduit is a chat server powered by Matrix. A vulnerability that affects a number of Conduit-derived homeservers allows a remote, unauthenticated attacker to force the target server to cryptographically sign arbitrary membership events. Affected products include Conduit prior to version 0.10.10, continuwuity prior to version 0.5.0, Grapevine prior to commit `9a50c244`, and tuwunel prior to version 1.4.8. The flaw exists because the server fails to validate the origin of a signing request, provided the event's state_key is a valid user ID belonging to the target server. Attackers can forge "leave" events for any user on the target server. This forcibly removes users (including admins and bots) from rooms. This allows denial of service and/or the removal of technical protections for a room (including policy servers, if all users on the policy server are removed). Attackers can forge "invite" events from a victim user to themselves, provided they have an account on a server where there is an account that has the power level to send invites. This allows the attacker to join private or invite-only rooms accessible by the victim, exposing confidential conversation history and room state. Attackers can forge "ban" events from a victim user to any user below the victim user's power level, provided the victim has the power level to issue bans AND the target of the ban resides on the same server as the victim. This allows the attacker to ban anyone in a room who is on the same server as the vulnerable one, however cannot exploit this to ban users on other servers or the victim themself. Conduit fixes the issue in version 0.10.10. continuwuity fixes the issue in commits `7fa4fa98` and `b2bead67`, released in 0.5.0. tuwunel fixes the issue in commit `dc9314de1f8a6e040c5aa331fe52efbe62e6a2c3`, released in 1.4.8. Grapevine fixes the issue in commit `9a50c2448abba6e2b7d79c64243bb438b351616c`. As a workaround, block access to the `PUT /_matrix/federation/v2/invite/{roomId}/{eventId}` endpoint using your reverse proxy.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
nbd: defer config put in recv_work
CVE: CVE-2025-68372
Component: kernel
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-12-24T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

nbd: defer config put in recv_work

There is one uaf issue in recv_work when running NBD_CLEAR_SOCK and
NBD_CMD_RECONFIGURE:
  nbd_genl_connect     // conf_ref=2 (connect and recv_work A)
  nbd_open	       // conf_ref=3
  recv_work A done     // conf_ref=2
  NBD_CLEAR_SOCK       // conf_ref=1
  nbd_genl_reconfigure // conf_ref=2 (trigger recv_work B)
  close nbd	       // conf_ref=1
  recv_work B
    config_put         // conf_ref=0
    atomic_dec(&config->recv_threads); -> UAF

Or only running NBD_CLEAR_SOCK:
  nbd_genl_connect   // conf_ref=2
  nbd_open 	     // conf_ref=3
  NBD_CLEAR_SOCK     // conf_ref=2
  close nbd
    nbd_release
      config_put     // conf_ref=1
  recv_work
    config_put 	     // conf_ref=0
    atomic_dec(&config->recv_threads); -> UAF

Commit 87aac3a80af5 ("nbd: call nbd_config_put() before notifying the
waiter") moved nbd_config_put() to run before waking up the waiter in
recv_work, in order to ensure that nbd_start_device_ioctl() would not
be woken up while nbd->task_recv was still uncleared.

However, in nbd_start_device_ioctl(), after being woken up it explicitly
calls flush_workqueue() to make sure all current works are finished.
Therefore, there is no need to move the config put ahead of the wakeup.

Move nbd_config_put() to the end of recv_work, so that the reference is
held for the whole lifetime of the worker thread. This makes sure the
config cannot be freed while recv_work is still running, even if clear
+ reconfigure interleave.

In addition, we don't need to worry about recv_work dropping the last
nbd_put (which causes deadlock):

path A (netlink with NBD_CFLAG_DESTROY_ON_DISCONNECT):
  connect  // nbd_refs=1 (trigger recv_work)
  open nbd // nbd_refs=2
  NBD_CLEAR_SOCK
  close nbd
    nbd_release
      nbd_disconnect_and_put
        flush_workqueue // recv_work done
      nbd_config_put
        nbd_put // nbd_refs=1
      nbd_put // nbd_refs=0
        queue_work

path B (netlink without NBD_CFLAG_DESTROY_ON_DISCONNECT):
  connect  // nbd_refs=2 (trigger recv_work)
  open nbd // nbd_refs=3
  NBD_CLEAR_SOCK // conf_refs=2
  close nbd
    nbd_release
      nbd_config_put // conf_refs=1
      nbd_put // nbd_refs=2
  recv_work done // conf_refs=0, nbd_refs=1
  rmmod // nbd_refs=0

Depends-on: e2daec488c57 ("nbd: Fix hungtask when nbd_config_put")


Remediation:
Linux kernel ksmbd: Memory leak leading to denial of service
CVE: CVE-2025-71153
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in the Linux kernel's ksmbd component. This memory leak vulnerability occurs in the `get_file_all_info()` function when `vfs_getattr()` fails, causing the allocated filename not to be freed. A local attacker could exploit this to exhaust system memory, leading to a denial of service (DoS).


Remediation:
iio: light: as73211: Ensure buffer holes are zeroed
CVE: CVE-2025-39687
Component: kernel
Severity: None
Release date: 2025-09-05T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

iio: light: as73211: Ensure buffer holes are zeroed

Given that the buffer is copied to a kfifo that ultimately user space
can read, ensure we zero it.


Remediation:
OOB write when attempting to parse font subglyph structures related to TrueType GX and variable font files
CVE: CVE-2025-27363
Component: freetype
CWE: CWE-787
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2025-03-11T13:28:31.705000+00:00

A flaw was found in FreeType. In affected versions, an out-of-bounds write condition may be triggered when attempting to parse font subglyph structures related to TrueType GX and variable font files. The vulnerable code assigns a signed short value to an unsigned long and then adds a static value, causing it to wrap around and allocate a heap buffer that is too small. The code then writes up to 6 signed long integers out of bounds relative to this buffer. This issue could result in arbitrary code execution or other undefined behavior.

Statement: This vulnerability stems from improper handling of data types within the FreeType library during the parsing of font subglyph structures. This could causes incorrect calculations that result in heap buffer allocation being too small. This could allow the library write data beyond the allocated buffer, affecting adjacent memory areas, leading into arbitrary code executions compromising the entire system and system stability such as misleading behaviors in applications which relies on FreeType, or causing possible crashes impacting the entire system.

Remediation:
For OpenShift Container Platform 4.12 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

     https://docs.redhat.com/en/documentation/openshift_container_platform/4.12/html/release_notes

You may download the oc tool and use it to inspect release image metadata for the x86_64 architecture. The image digests may be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.

      The sha value for the release are as follows:

      (For x86_64 architecture)
      The image digest is sha256:24c2ea09853e520e47bdd03e5fc9b865f0a8bac7a38aad458e9785fe0f7546ac

All OpenShift Container Platform 4.12 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.openshift.com/container-platform/4.12/updating/updating-cluster-cli.html
By restricting the sources from which font files can be loaded allowing only fonts from trusted sources, as well as validating the input for font files to avoid malformed font structures or any data which could trigger the vulnerability would reduce the risk and mitigate this vulnerability until the fix is provided.
Vega: Arbitrary code execution through malicious visualization definitions
CVE: CVE-2025-65110
Component: vega-selections
CVSS v3: 8.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Release date: 2025-01-01T00:00:00+00:00

A flaw was found in Vega, a library used for creating interactive data visualizations. This vulnerability affects applications that expose the Vega library globally and process user-provided visualization definitions. A remote attacker could exploit this by convincing a user to open a specially crafted Vega specification. Successful exploitation allows the attacker to execute unauthorized code within the application, potentially leading to the theft of sensitive data or manipulation of information.

Statement: This vulnerability is rated Important for Red Hat products. It affects applications that expose the Vega library globally and process user-provided visualization definitions, such as JupyterLab in Fedora and EPEL, and certain cloud.redhat.com services. Exploitation requires user interaction with a malicious Vega specification.

Remediation:
To mitigate this issue, applications using the Vega library should avoid attaching `vega` or `vega.View` instances to global variables or the window object in production environments. This practice is intended for development and debugging only and should not be used when processing untrusted Vega specifications.
CVE: CVE-2025-14403
Component: PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability
Release date: 2025-12-11T20:58:41.335000+00:00

PDFsam Enhanced Launch Insufficient UI Warning Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of PDFsam Enhanced. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the implementation of the Launch action. The issue results from allowing the execution of dangerous script without user warning. An attacker can leverage this vulnerability to execute code in the context of the current user. Was ZDI-CAN-27500.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux Kernel: Denial of Service in iwlwifi due to improper firmware error handling
CVE: CVE-2025-38096
Component: kernel
CWE: CWE-99
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2025-07-03T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: don't warn when if there is a FW error

iwl_trans_reclaim is warning if it is called when the FW is not alive.
But if it is called when there is a pending restart, i.e. after a FW
error, there is no need to warn, instead - return silently.


Remediation:
xenbus: Use kref to track req lifetime
CVE: CVE-2025-37949
Component: kernel
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-05-20T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

xenbus: Use kref to track req lifetime

Marek reported seeing a NULL pointer fault in the xenbus_thread
callstack:
BUG: kernel NULL pointer dereference, address: 0000000000000000
RIP: e030:__wake_up_common+0x4c/0x180
Call Trace:
 <TASK>
 __wake_up_common_lock+0x82/0xd0
 process_msg+0x18e/0x2f0
 xenbus_thread+0x165/0x1c0

process_msg+0x18e is req->cb(req).  req->cb is set to xs_wake_up(), a
thin wrapper around wake_up(), or xenbus_dev_queue_reply().  It seems
like it was xs_wake_up() in this case.

It seems like req may have woken up the xs_wait_for_reply(), which
kfree()ed the req.  When xenbus_thread resumes, it faults on the zero-ed
data.

Linux Device Drivers 2nd edition states:
"Normally, a wake_up call can cause an immediate reschedule to happen,
meaning that other processes might run before wake_up returns."
... which would match the behaviour observed.

Change to keeping two krefs on each request.  One for the caller, and
one for xenbus_thread.  Each will kref_put() when finished, and the last
will free it.

This use of kref matches the description in
Documentation/core-api/kref.rst

Statement: Local issue in Xen guest kernel requiring privileged access. No remote vector or privilege escalation; only potential DoS via NULL dereference.

Remediation:
Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()
CVE: CVE-2025-21937
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2025-04-01T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name()

Add check for the return value of mgmt_alloc_skb() in
mgmt_remote_name() to prevent null pointer dereference.


Remediation: