huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Apache ZooKeeper: Impersonation of servers or clients via reverse DNS spoofing
CVE: CVE-2026-24281
Component: Apache ZooKeeper
CWE: CWE-295
Severity: Moderate
CVSS v3: 7.4/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-07T08:50:32.525000+00:00

A flaw was found in Apache ZooKeeper. The ZKTrustManager component's hostname verification process can fall back to reverse DNS (PTR) lookup when IP Subject Alternative Name (SAN) validation fails. This vulnerability allows an attacker who can control or spoof PTR records to impersonate ZooKeeper servers or clients, provided they possess a valid certificate for the PTR name. This could lead to unauthorized access or manipulation of ZooKeeper services.


Remediation:
To mitigate this issue, disable reverse DNS lookup in Apache ZooKeeper's client and quorum protocols. This can be achieved by configuring the `zookeeper.ssl.hostnameVerification.disableReverseDns` property to `true`. This configuration option is available in Apache ZooKeeper versions 3.8.6 and 3.9.5 and later. A restart of the ZooKeeper service will be required for the change to take effect.
arm64/fpsimd: ptrace: Fix SVE writes on !SME systems
CVE: CVE-2026-23114
Component: kernel
CWE: CWE-371
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's arm64 floating-point/SIMD state management. On systems with SVE but without SME support, a ptrace write to the NT_ARM_SVE regset can leave the tracee in an inconsistent state where SVE data is stored but the TIF_SVE flag is not set. This triggers a kernel warning in fpsimd_restore_current_state(), though the function self-corrects by setting the flag before any observable issue occurs.

Statement: This is a code quality issue that triggers a kernel warning but has no functional impact. The state inconsistency is automatically corrected by fpsimd_restore_current_state() before it can affect program execution. The fix ensures consistent flag setting during ptrace SVE register writes on arm64 systems without SME.

Remediation:
undici: Denial of Service via unbounded memory consumption during WebSocket permessage-deflate decompression
CVE: CVE-2026-1526
Component: undici
CWE: CWE-770
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-12T20:08:05.950000+00:00

A flaw was found in undici. A remote attacker can exploit this vulnerability by sending a specially crafted compressed frame, known as a "decompression bomb," during permessage-deflate decompression. The undici WebSocket client does not properly limit the size of decompressed data, leading to unbounded memory consumption. This can cause the Node.js process to exhaust available memory, resulting in a denial of service (DoS) where the process crashes or becomes unresponsive.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Flare: Information disclosure via authenticated path traversal
CVE: CVE-2026-30942
Component: flare
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-10T16:44:10.305000+00:00

A flaw was found in Flare, a file sharing platform. An authenticated path traversal vulnerability exists in the /api/avatars/[filename] endpoint, allowing a logged-in user to read arbitrary files from the application container. This occurs because the filename parameter is not properly sanitized, enabling specially crafted sequences to bypass directory restrictions. If open registration is enabled, an attacker can self-register and exploit this vulnerability, leading to sensitive information disclosure.

Statement: This IMPORTANT path traversal vulnerability in Flare allows authenticated users to read arbitrary files from the /app/ directory via the avatars endpoint. Exploitation requires authentication (PR:L), but instances with default open registration allow attackers to self-register and immediately exploit. Impact is high confidentiality loss; no integrity or availability impact. Fixed in version 1.7.3.

Remediation:
GStreamer: Arbitrary code execution via ASF file processing
CVE: CVE-2026-2920
Component: GStreamer
CWE: CWE-120
Severity: Important
CVSS v3: 7.7/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T20:38:27.802000+00:00

A flaw was found in GStreamer. This heap-based buffer overflow vulnerability in the ASF Demuxer component allows a remote attacker to execute arbitrary code. The issue arises from insufficient validation of user-supplied data length when processing stream headers within ASF (Advanced Systems Format) files, leading to data being copied to a fixed-length heap-based buffer without proper bounds checking. Successful exploitation can result in arbitrary code execution in the context of the current process.

Statement: This is an IMPORTANT heap-based buffer overflow vulnerability in the GStreamer ASF Demuxer. The flaw allows remote code execution when processing specially crafted ASF files due to improper validation of stream header lengths. Red Hat products utilizing GStreamer for multimedia processing are affected if they handle untrusted ASF content.

Remediation:
Avoid processing untrusted ASF (Advanced Systems Format) media files. This vulnerability in the GStreamer ASF Demuxer requires user interaction, such as opening a malicious ASF file, to trigger the heap-based buffer overflow. Limiting exposure to untrusted media content can reduce the attack surface.
libsoup: HTTP Smuggling and Server-Side Request Forgery via Malformed Hostnames
CVE: CVE-2026-3632
Component: libsoup
CWE: CWE-1286
Severity: Low
CVSS v3: 4.3/AV:N/AC:H/PR:H/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-03-06T05:05:00+00:00

A flaw was found in libsoup, a library used by applications to send network requests. This vulnerability occurs because libsoup does not properly validate hostnames, allowing special characters to be injected into HTTP headers. A remote attacker could exploit this to perform HTTP smuggling, where they can send hidden, malicious requests alongside legitimate ones. In certain situations, this could lead to Server-Side Request Forgery (SSRF), enabling an attacker to force the server to make unauthorized requests to other internal or external systems. The impact is low, as SoupServer is not actually used in internet infrastructure.

Statement: This vulnerability has a LOW impact on Red Hat products. The `libsoup` library, when used as a client, does not adequately validate hostnames, allowing for HTTP header injection. This could lead to HTTP smuggling or Server-Side Request Forgery (SSRF) if an application processes attacker-controlled URLs.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
libceph: replace overzealous BUG_ON in osdmap_apply_incremental()
CVE: CVE-2026-22990
Component: kernel
CWE: CWE-617
Severity: Moderate
CVSS v3: 7.3/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: replace overzealous BUG_ON in osdmap_apply_incremental()

If the osdmap is (maliciously) corrupted such that the incremental
osdmap epoch is different from what is expected, there is no need to
BUG.  Instead, just declare the incremental osdmap to be invalid.

Statement: This is a reachable kernel BUG triggered by malformed (or maliciously corrupted) Ceph incremental OSD map data: an unexpected epoch value could hit a BUG_ON() and panic the kernel. The trigger is received over the Ceph protocol in established Ceph sessions (i.e., within the trusted/authorized cluster communication model), but it breaks that model by allowing a peer to cause a hard host crash.

Remediation:
If Ceph not being used, then possible to disable it. To mitigate this issue, prevent module libceph from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
PlantUML: Arbitrary script execution via Stored Cross-Site Scripting in GraphViz diagrams
CVE: CVE-2026-0858
Component: plantuml
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-16T05:00:06.808000+00:00

A flaw was found in PlantUML. This vulnerability, known as Stored Cross-Site Scripting (XSS), occurs due to insufficient sanitization of interactive attributes within GraphViz diagrams. A remote attacker can exploit this by crafting a malicious PlantUML diagram, which then injects harmful JavaScript into the generated Scalable Vector Graphics (SVG) output. This can lead to arbitrary script execution within applications that render the affected SVG.

Statement: This vulnerability is rated Moderate for Red Hat. It affects PlantUML versions prior to 1.2026.0, allowing Stored Cross-Site Scripting (XSS) through crafted GraphViz diagrams. When a malicious PlantUML diagram is processed, it can inject arbitrary JavaScript into the generated SVG output, which then executes in the context of applications rendering the SVG. Exploitation requires user interaction with a crafted diagram.

Remediation:
To mitigate this vulnerability, avoid processing or rendering PlantUML diagrams from untrusted sources. If processing untrusted diagrams is unavoidable, ensure that the environment where the SVG output is rendered is adequately sandboxed to limit the impact of potential script execution. This operational control helps reduce exposure to the Stored XSS flaw.
FreeRDP has a heap-buffer-overflow in bitmap_cache_put via OOB cacheId
CVE: CVE-2026-29775
Component: freerdp
CWE: CWE-787
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-13T17:28:39.641000+00:00

A heap based buffer overflow flaw has been discovered in FreeRDP. This client-side heap out-of-bounds read/write occurs in FreeRDP's bitmap cache subsystem due to an off-by-one boundary check in bitmap_cache_put. A malicious server can send a CACHE_BITMAP_ORDER (Rev1) with cacheId equal to maxCells, bypassing the guard and accessing cells[] one element past the allocated array. A malicious server can trigger a client-side heap out-of-bounds access (READ of 4 bytes, followed by potential WRITE of a pointer) on the bitmap cache cells array, causing a crash (DoS) and heap corruption. The off-by-one accesses cells[maxCells] which reads from and writes to adjacent heap memory, potentially enabling pointer overwrite for code execution depending on heap layout.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
heap-based buffer over-read in BilateralBlurImage
CVE: CVE-2026-30935
Component: ImageMagick
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-09T21:48:47.570000+00:00

A flaw was found in ImageMagick. Processing a specially crafted image with the -bilateral-blur operation in the BilateralBlurImage function can cause a heap-based buffer over-read due to an incorrect conversion, leading to a denial of service.

Statement: To exploit this flaw, an attacker needs to convince a user to process a specially crafted image with the -bilateral-blur operation. Additionally, this issue can cause a heap-based buffer over-read of only 4 bytes, limiting the security impact to a denial of service. Due to these reasons, this vulnerability has been rated with a moderate severity.

Remediation:
To reduce the risk of exploitation, avoid processing untrusted image files using the -bilateral-blur operation with ImageMagick. If ImageMagick is deployed in a way that it processes files from untrusted sources automatically, consider running the application inside a container or a restricted sandbox environment to limit the potential security impact.
kaniko: Arbitrary code execution via path traversal in build context archive unpacking
CVE: CVE-2026-28406
Component: kaniko
CWE: CWE-22
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L
Release date: 2026-02-27T21:20:52.764000+00:00

A flaw was found in kaniko, a tool used to build container images. A remote attacker can exploit this vulnerability by providing a specially crafted build context archive that contains path traversal sequences. This allows files to be written outside the intended destination directory during archive unpacking. When chained with docker credential helpers in environments with registry authentication, this can lead to arbitrary code execution within the executor process.


Remediation:
drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove
CVE: CVE-2026-23163
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

drm/amdgpu: fix NULL pointer dereference in amdgpu_gmc_filter_faults_remove

On APUs such as Raven and Renoir (GC 9.1.0, 9.2.2, 9.3.0), the ih1 and
ih2 interrupt ring buffers are not initialized. This is by design, as
these secondary IH rings are only available on discrete GPUs. See
vega10_ih_sw_init() which explicitly skips ih1/ih2 initialization when
AMD_IS_APU is set.

However, amdgpu_gmc_filter_faults_remove() unconditionally uses ih1 to
get the timestamp of the last interrupt entry. When retry faults are
enabled on APUs (noretry=0), this function is called from the SVM page
fault recovery path, resulting in a NULL pointer dereference when
amdgpu_ih_decode_iv_ts_helper() attempts to access ih->ring[].

The crash manifests as:

  BUG: kernel NULL pointer dereference, address: 0000000000000004
  RIP: 0010:amdgpu_ih_decode_iv_ts_helper+0x22/0x40 [amdgpu]
  Call Trace:
   amdgpu_gmc_filter_faults_remove+0x60/0x130 [amdgpu]
   svm_range_restore_pages+0xae5/0x11c0 [amdgpu]
   amdgpu_vm_handle_fault+0xc8/0x340 [amdgpu]
   gmc_v9_0_process_interrupt+0x191/0x220 [amdgpu]
   amdgpu_irq_dispatch+0xed/0x2c0 [amdgpu]
   amdgpu_ih_process+0x84/0x100 [amdgpu]

This issue was exposed by commit 1446226d32a4 ("drm/amdgpu: Remove GC HW
IP 9.3.0 from noretry=1") which changed the default for Renoir APU from
noretry=1 to noretry=0, enabling retry fault handling and thus
exercising the buggy code path.

Fix this by adding a check for ih1.ring_size before attempting to use
it. Also restore the soft_ih support from commit dd299441654f ("drm/amdgpu:
Rework retry fault removal").  This is needed if the hardware doesn't
support secondary HW IH rings.

v2: additional updates (Alex)

(cherry picked from commit 6ce8d536c80aa1f059e82184f0d1994436b1d526)


Remediation:
FreeRDP: Heap buffer overflow leads to denial of service and potential code execution
CVE: CVE-2026-23533
Component: freerdp
CWE: CWE-122
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
Release date: 2026-01-19T17:07:18.283000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. A malicious server can exploit a client-side heap buffer overflow vulnerability in the RDPGFX ClearCodec decode path. This occurs when maliciously crafted residual data causes out-of-bounds writes during color output. Successful exploitation can lead to a crash, resulting in a Denial of Service (DoS), and potentially heap corruption with a risk of arbitrary code execution.

Statement: For this vulnerability to be exploited, a client must connect to a maliciously-configured server. Red Hat recommends that FreeRDP clients are only used to connect to trusted servers.

Remediation:
SIPp: Denial of Service and potential Arbitrary Code Execution vulnerability
CVE: CVE-2026-0710
Component: SIPp/sipp
CVSS v3: 8.4/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-08T00:00:00+00:00

A flaw was found in SIPp. A remote attacker could exploit this by sending specially crafted Session Initiation Protocol (SIP) messages during an active call. This vulnerability, a NULL pointer dereference, can cause the application to crash, leading to a denial of service. Under specific conditions, it may also allow an attacker to execute unauthorized code, compromising the system's integrity and availability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Zabbix: Confidentiality loss via improper access control in configuration.import API
CVE: CVE-2026-23925
Component: zabbix
CVSS v3: 7.8/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
Release date: 2026-03-06T08:24:15.428000+00:00

A flaw was found in Zabbix. An authenticated user with the 'User' role, who also possesses write permissions for templates or hosts, can exploit the `configuration.import` API. This allows them to create unauthorized objects, such as hosts, which can lead to a loss of confidentiality within the system.

Statement: This MODERATE impact vulnerability in Zabbix allows an authenticated user with template/host write permissions to create unauthorized hosts via the configuration.import API. This bypasses the normal restrictions for the 'User' role, which typically prevents such users from creating or editing templates and hosts.

Remediation:
dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()
CVE: CVE-2026-23026
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 4.4/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

dmaengine: qcom: gpi: Fix memory leak in gpi_peripheral_config()

Fix a memory leak in gpi_peripheral_config() where the original memory
pointed to by gchan->config could be lost if krealloc() fails.

The issue occurs when:
1. gchan->config points to previously allocated memory
2. krealloc() fails and returns NULL
3. The function directly assigns NULL to gchan->config, losing the
   reference to the original memory
4. The original memory becomes unreachable and cannot be freed

Fix this by using a temporary variable to hold the krealloc() result
and only updating gchan->config when the allocation succeeds.

Found via static analysis and code review.


Remediation:
Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API
CVE: CVE-2026-3429
Component: org.keycloak.services.resources.account
CWE: CWE-284
Severity: Moderate
CVSS v3: 4.3/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-02T00:00:00+00:00

A flaw was identified in the Account REST API of Keycloak that allows a user authenticated at a lower security level to perform sensitive actions intended only for higher-assurance sessions. Specifically, an attacker who has already obtained a victim’s password can delete the victim’s registered MFA/OTP credential without first proving possession of that factor. The attacker can then register their own MFA device, effectively taking full control of the account. This weakness undermines the intended protection provided by multi-factor authentication.

Statement: This MODERATE impact vulnerability in the Keycloak Account REST API allows an attacker with a victim's primary credentials to bypass multi-factor authentication (MFA). By exploiting insufficient validation of the authentication Level of Assurance (LoA), an attacker can delete a victim's registered MFA device and register their own, leading to full account takeover. This requires network access and valid credentials, but no user interaction.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component
CVE: CVE-2026-0878
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T13:30:53.697000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Sandbox escape due to incorrect boundary conditions in the Graphics: CanvasWebGL component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
express-rate-limit: Denial of Service for IPv4 clients due to incorrect IPv6 subnet masking
CVE: CVE-2026-30827
Component: express-rate-limit
CWE: CWE-1389
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-07T05:19:08.206000+00:00

A flaw was found in express-rate-limit. The default key generator incorrectly applies IPv6 subnet masking to IPv4-mapped IPv6 addresses, which are used when an IPv4 client connects to a dual-stack server. This misconfiguration causes all IPv4 traffic to be treated as a single entity for rate limiting. Consequently, a remote attacker can exhaust the rate limit with a single client, leading to a Denial of Service (DoS) for all other IPv4 clients by causing them to receive HTTP 429 errors.


Remediation:
Restrict network access to applications utilizing the express-rate-limit middleware to trusted clients or networks. Implementing firewall rules or network access controls can prevent untrusted actors from exploiting the shared rate-limit bucket vulnerability affecting IPv4-mapped IPv6 addresses on dual-stack servers.
PostgreSQL oidvector discloses a few bytes of memory
CVE: CVE-2026-2003
Component: postgresql
CWE: CWE-1287
Severity: Moderate
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-02-12T13:00:06.108000+00:00

A type validation flaw has been discovered in postgresql. Improper validation of the type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. It is possible that this may expose confidential information but it is unlikely.


Remediation:
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service via YUV sampling factor validation error
CVE: CVE-2026-25799
Component: ImageMagick
CWE: CWE-369
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T01:05:39.405000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A logic error in the YUV sampling factor validation allows an invalid sampling factor to bypass security checks. This can trigger a division-by-zero error during image loading, leading to a reliable Denial of Service (DoS) for an affected system when processing a specially crafted image.

Statement: This MODERATE impact vulnerability in ImageMagick can lead to a denial-of-service. A logic error in YUV sampling factor validation allows an invalid sampling factor to bypass checks, triggering a division-by-zero during image loading. This affects ImageMagick as shipped in Red Hat Enterprise Linux 6 ELS and 7 ELS.

Remediation:
To mitigate this issue, avoid processing untrusted or unknown image files with ImageMagick. Limiting the exposure of ImageMagick to untrusted input sources can reduce the risk of exploitation.