huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Keycloak: Unauthorized Access via JWT authorization grant with disabled users
CVE: CVE-2026-1609
Component: org.keycloak/keycloak-quarkus-server
CWE: CWE-284
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-02-09T18:59:00+00:00

A flaw was found in Keycloak. When the JSON Web Token (JWT) authorization grant preview feature is enabled and a user account is disabled, Keycloak fails to validate the user’s disabled status during JWT authorization grant processing. A remote attacker with low privileges can exploit this improper access control vulnerability by presenting a valid assertion token from an external identity provider to obtain a JWT for a disabled user. This allows unauthorized access to sensitive resources.

Statement: The Red Hat Product Security team has assessed this vulnerability as High severity; however, it only affects upstream Keycloak version 26.5.2, which includes a preview JWT authorization grant feature. No released Red Hat Build of Keycloak (RHBK) versions are impacted, as this feature has not been shipped in any downstream product. The issue arises from improper enforcement of user disabled-state checks during JWT authorization grant processing, potentially allowing unauthorized access when the preview feature is explicitly enabled. Red Hat products remain unaffected at this time.

Remediation:
Linux kernel: Memory leak in networking due to incorrect GRO packet handling
CVE: CVE-2026-22979
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

A flaw was found in the Linux kernel's networking component. Incorrect memory accounting when handling Generic Receive Offload (GRO) packets can lead to a persistent memory leak. This occurs because the system incorrectly tracks memory usage for network packets, preventing proper cleanup of network resources. Over time, this can lead to a denial of service (DoS) as system memory is gradually exhausted.


Remediation:
possible infinite loop when loading circular /Prev entries in cross-reference streams
CVE: CVE-2026-27628
Component: pypdf
CWE: CWE-835
Severity: Moderate
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-25T02:45:37.543000+00:00

A flaw was found in pypdf. Processing a specially crafted PDF document, specifically with circular /Prev references in the cross-reference (xref) chain, can cause an infinite loop and a high consumption of CPU, resulting in a denial of service.

Statement: To exploit this flaw, an attacker must be able to supply a crafted PDF file to be processed by an application using the pypdf library. This issue can cause the application to enter an infinite loop and consume a high amount of CPU resources, eventually resulting in a denial of service with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate impact.

Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
tar: node-tar: Arbitrary file creation via path traversal bypass in hardlink security check
CVE: CVE-2026-24842
Component: node-tar
CWE: CWE-59
Severity: Important
CVSS v3: 8.2/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
Release date: 2026-01-28T00:20:13.261000+00:00

A flaw was found in node-tar, a Node.js module for handling TAR archives. This vulnerability allows a remote attacker to bypass path traversal protections by crafting a malicious TAR archive. The security check for hardlink entries uses different path resolution logic than the actual hardlink creation, enabling the attacker to create hardlinks to arbitrary files outside the intended extraction directory. This could lead to unauthorized information disclosure or further system compromise.

Statement: This is an IMPORTANT vulnerability in node-tar, a Node.js module for handling TAR archives. The flaw allows an attacker to bypass path traversal protections by crafting a malicious TAR archive. This could lead to the creation of hardlinks to arbitrary files outside the intended extraction directory, potentially resulting in unauthorized information disclosure or further system compromise in affected Red Hat products utilizing node-tar for archive processing.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Authlib: Authentication bypass via forged OpenID Connect ID Tokens
CVE: CVE-2026-28498
Component: authlib
CWE: CWE-325
Severity: Important
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-16T18:03:28.821000+00:00

A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect (OIDC) servers. This vulnerability allows a remote attacker to bypass critical integrity checks in OIDC ID Tokens. Specifically, the library's internal hash verification logic fails open when encountering an unsupported cryptographic algorithm, accepting a forged ID Token as valid. This can lead to an authentication bypass, granting unauthorized access to systems relying on Authlib for OIDC authentication.

Statement: This IMPORTANT vulnerability in Authlib allows attackers to bypass OIDC ID Token integrity verification. The at_hash and c_hash validation fails open for unknown algorithms, accepting forged tokens as valid. Exploitation requires no authentication or user interaction. Impact is high to confidentiality and integrity. Red Hat products using Authlib for OIDC validation are affected. Fixed in version 1.6.9.

Remediation:
net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv
CVE: CVE-2026-22996
Component: kernel
CWE: CWE-824
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Mellanox mlx5 Ethernet driver in the Linux kernel. The driver stores a pointer to mlx5e_priv in the devlink private data, but this structure can be zeroed out (memset to 0) when profile attachment fails. Subsequent access to the zeroed structure during device removal causes a NULL pointer dereference and kernel crash.

Statement: This vulnerability is triggered when switchdev mode enablement fails due to profile change errors. The issue manifests during device reload operations via devlink after a previous failure. While the crash requires a specific failure sequence, it can be triggered by administrative operations on Mellanox network devices.

Remediation:
Linux kernel (wifi): Information disclosure via uninitialized data in struct iw_point
CVE: CVE-2026-22978
Component: kernel
CWE: CWE-909
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-01-23T00:00:00+00:00

A flaw was found in the Linux kernel's Wi-Fi subsystem. This information disclosure vulnerability arises from a 32-bit padding hole in the `struct iw_point` on 64-bit architectures. A local user could exploit this by reading uninitialized kernel memory, potentially disclosing sensitive kernel data to user space.


Remediation:
Crypt::URandom for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom()
CVE: CVE-2026-2474
Component: crypt-urandom
CVSS v3: 4.4/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-16T20:54:51.357000+00:00

Crypt::URandom versions from 0.41 before 0.55 for Perl is vulnerable to a heap buffer overflow in the XS function crypt_urandom_getrandom().

The function does not validate that the length parameter is non-negative. If a negative value (e.g. -1) is supplied, the expression length + 1u causes an integer wraparound, resulting in a zero-byte allocation. The subsequent call to getrandom(data, length, GRND_NONBLOCK) passes the original negative value, which is implicitly converted to a large unsigned value (typically SIZE_MAX). This can result in writes beyond the allocated buffer, leading to heap memory corruption and application crash (denial of service).

In common usage, the length argument is typically hardcoded by the caller, which reduces the likelihood of attacker-controlled exploitation. Applications that pass untrusted input to this parameter may be affected.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts
CVE: CVE-2026-22997
Component: kernel
CWE: CWE-911
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

A reference count leak vulnerability was found in the Linux kernel's CAN J1939 protocol implementation. When a second RTS (Request To Send) message is received on an active session and the timer is cancelled, j1939_session_deactivate_activate_next() is not called, causing the j1939_session reference count to leak. This prevents the network device from being unregistered, resulting in "waiting for vcan0 to become free" messages.

Statement: This vulnerability affects systems using the CAN bus J1939 protocol for vehicle and industrial networking. The reference leak accumulates over time with repeated RTS message handling, eventually preventing network interface cleanup. Exploitation requires the ability to send CAN J1939 traffic, typically requiring physical CAN bus access or local socket access.

Remediation:
To mitigate this issue, prevent the can_j1939 module from being loaded if J1939 CAN protocol support is not required. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist a kernel module.
FreeRDP: Denial of Service via missing bounds check in smartcard redirection
CVE: CVE-2026-27015
Component: freerdp
CWE: CWE-120
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-25T20:44:14.152000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, a missing bounds check in `smartcard_unpack_read_size_align()` (`libfreerdp/utils/smartcard_pack.c:1703`) allows a malicious RDP server to crash the FreeRDP client via a reachable `WINPR_ASSERT` → `abort()`. The crash occurs in upstream builds where `WITH_VERBOSE_WINPR_ASSERT=ON` (default in FreeRDP 3.22.0 / current WinPR CMake defaults). Smartcard redirection must be explicitly enabled by the user (e.g., `xfreerdp /smartcard`; `/smartcard-logon` implies `/smartcard`). Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Optimizer unspecified vulnerability (CPU Jan 2026)
CVE: CVE-2026-21968
Component: mysql
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-20T00:00:00+00:00

Oracle CPU describes the issue as following: Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). Supported versions that are affected are 8.0.0-8.0.44, 8.4.0-8.4.7 and 9.0.0-9.5.0. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server.

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Oracle MySQL Critical Patch Update.

Remediation:
tar-rs: Arbitrary directory permission modification via crafted tar archive
CVE: CVE-2026-33056
Component: tar-rs
CWE: CWE-59
Severity: Moderate
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-03-20T07:11:10.448000+00:00

A flaw was found in tar-rs, a Rust library for reading and writing tar archives. When unpacking a crafted tar archive, an attacker can exploit a symbolic link vulnerability. By including a symlink followed by a directory with the same name, the library incorrectly applies file permissions to the symlink's target. This allows an attacker to modify the permissions of arbitrary directories outside the intended extraction location.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)
CVE: CVE-2026-3009
Component: org.keycloak/keycloak-services
CWE: CWE-285
Severity: Important
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-05T11:23:00+00:00

A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.

Statement: The security impact of this vulnerability is considered High because it allows bypassing an explicit administrative security control. Even though user interaction is required, an attacker can authenticate using an Identity Provider that administrators intentionally disabled. This weakens identity governance controls and may result in unauthorized access depending on the trust level of the external IdP. The root cause is insufficient authorization validation during broker login processing.

Remediation:
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
uacce: implement mremap in uacce_vm_ops to return -EPERM
CVE: CVE-2026-23056
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

uacce: implement mremap in uacce_vm_ops to return -EPERM

The current uacce_vm_ops does not support the mremap operation of
vm_operations_struct. Implement .mremap to return -EPERM to remind
users.

The reason we need to explicitly disable mremap is that when the
driver does not implement .mremap, it uses the default mremap
method. This could lead to a risk scenario:

An application might first mmap address p1, then mremap to p2,
followed by munmap(p1), and finally munmap(p2). Since the default
mremap copies the original vma's vm_private_data (i.e., q) to the
new vma, both munmap operations would trigger vma_close, causing
q->qfr to be freed twice(qfr will be set to null here, so repeated
release is ok).


Remediation:
HTSlib:  Buffer overflow in CRAM decoder
CVE: CVE-2026-31968
Component: htslib
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T19:38:11.370000+00:00

A flaw was found in HTSlib, a library for reading and writing bioinformatics file formats. Specifically, within the CRAM (Compressed Reference-oriented Alignment Map) format, incomplete validation of context in the VARINT and CONST encodings could lead to a heap or stack buffer overflow. A remote attacker could exploit this by convincing a user to open a specially crafted file, potentially causing the program to crash, overwrite data structures, alter program control flow, and possibly achieve arbitrary code execution.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
io_uring/io-wq: check IO_WQ_BIT_EXIT inside work run loop
CVE: CVE-2026-23113
Component: kernel
CWE: CWE-835
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's io_uring subsystem. When io-wq worker threads process extremely long-running I/O operations (such as large reads from /dev/msr* devices), the exit path may be delayed for an extended period because the IO_WQ_BIT_EXIT flag is only checked before the work loop begins. This can cause the io_wq_put_and_exit() function to block for over 140 seconds, triggering hung task warnings.

Statement: This is primarily a latency and responsiveness issue rather than a security vulnerability. The kernel continues to function correctly, and the delay only affects io_uring ring cleanup during process exit. No crash, memory corruption, or privilege escalation occurs.

Remediation:
CVE: CVE-2026-0760
Component: Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-01-09T16:31:39.256000+00:00

Foundation Agents MetaGPT deserialize_message Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foundation Agents MetaGPT. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the deserialize_message function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-28121.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
virtualenv: Local attacker can redirect file operations via TOCTOU race condition
CVE: CVE-2026-22702
Component: virtualenv
CWE: CWE-59
Severity: Moderate
CVSS v3: 4.5/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Release date: 2026-01-10T06:05:53.281000+00:00

A flaw was found in virtualenv, a tool for creating isolated virtual Python environments. A local attacker can exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition during directory creation operations. By performing symlink-based attacks, the attacker can redirect virtualenv's application data and lock file operations to locations they control. This could lead to information disclosure or data tampering.

Statement: This vulnerability is rated Moderate for Red Hat. It affects `virtualenv` and allows a local attacker to perform symlink-based attacks during directory creation. Exploitation requires local access and a race condition, limiting its impact in typical Red Hat deployments.

Remediation:
Given that this vulnerability requires local access and exploits a race condition during directory creation, ensuring that `virtualenv` operations are performed in trusted and controlled environments can reduce the risk. Limiting the execution of `virtualenv` by untrusted users or within sandboxed environments can help mitigate potential information disclosure or data tampering.
Vim: Denial of service and information disclosure via crafted swap file
CVE: CVE-2026-28421
Component: vim
CWE: CWE-120
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-02-27T22:06:34.312000+00:00

A flaw was found in Vim. This vulnerability, a heap-buffer-overflow and a segmentation fault, exists in the swap file recovery logic. A local attacker could exploit this by providing a specially crafted swap file. This could lead to a denial of service (DoS) or potentially information disclosure.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Gitea: Cross-Repository Authorization Bypass via Release Attachment Linking Leads to Private Attachment Disclosure
CVE: CVE-2026-20912
Component: gitea
CWE: CWE-283
Severity: Critical
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-01-22T22:01:52.026000+00:00

Gitea does not properly validate repository ownership when linking attachments to releases. An attachment uploaded to a private repository could potentially be linked to a release in a different public repository, making it accessible to unauthorized users.


Remediation:
Rekor Server-Side Request Forgery (SSRF)
CVE: CVE-2026-24117
Component: github.com/sigstore/rekor
CWE: CWE-918
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-01-22T22:05:08.136000+00:00

A Server-Side Request Forgery (SSRF) flaw has been discovered in the Rekor transparency log tool. In versions 1.4.3 and below, attackers can trigger SSRF to arbitrary internal services because /api/v1/index/retrieve supports retrieving a public key via user-provided URL. Since the SSRF only can trigger GET requests, the request cannot mutate state. The response from the GET request is not returned to the caller so data exfiltration is not possible. A malicious actor could attempt to probe an internal network through Blind SSRF.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
ImageMagick: Denial of Service via invalid MSL map element processing
CVE: CVE-2026-26983
Component: ImageMagick
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T02:01:20.113000+00:00

A flaw was found in ImageMagick, a software suite for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted image containing an invalid `<map>` element to the Magick Scripting Language (MSL) interpreter. This flaw causes a use-after-free, leading to an application crash and resulting in a Denial of Service (DoS).

Statement: MODERATE: This flaw in ImageMagick allows a use-after-free vulnerability when processing a specially crafted MSL `<map>` element. An attacker could provide a malicious image file, leading to a denial of service due to application crashes. This affects systems where ImageMagick is used to process untrusted image files.

Remediation:
To mitigate this issue, avoid processing untrusted or maliciously crafted image files with ImageMagick. If ImageMagick is used in a service, restrict access to trusted sources and ensure input validation is in place to prevent the processing of arbitrary or malformed MSL files.