huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
tracker-miners: GNOME localsearch MP3 Extractor: Denial of Service and potential information disclosure via crafted MP3 files
CVE: CVE-2026-1765
Component: localsearch
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.7/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:H
Release date: 2026-02-02T11:11:00+00:00

A flaw was found in the `tracker-extract-mp3` component of GNOME localsearch (previously known as tracker-miners). This vulnerability, a heap buffer overflow, occurs when processing specially crafted MP3 files. A remote attacker could exploit this by providing a malicious MP3 file, leading to a Denial of Service (DoS) where the application crashes. It may also potentially expose sensitive information from the system's memory.

Statement: This vulnerability has MODERATE impact. A heap buffer overflow flaw in the `tracker-extract-mp3` component of GNOME localsearch can be triggered by processing a specially crafted MP3 file. This vulnerability could lead to a denial of service (DoS) and potentially disclose sensitive information from memory.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Mitigation bypass in the DOM: Security component
CVE: CVE-2026-0877
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-01-13T13:30:52.979000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Mitigation bypass in the DOM: Security component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Insufficient policy enforcement in ChromeDriver
CVE: CVE-2026-3934
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-10T00:00:00+00:00

An insufficient policy enforcement flaw was found in the ChromeDriver component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=478783560

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Processing maliciously crafted web content may lead to an unexpected process crash
CVE: CVE-2026-20644
Component: webkitgtk
CWE: CWE-120
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling.

Statement: To exploit this issue, an attacker needs to trick a user into processing or loading malicious web content. Due to this reason, this flaw has been rated with an important severity.
Additionally, this issue can cause an unexpected process crash but the possibility of remote code execution is not discarded.

Remediation:
Do not process or load untrusted web content with WebKitGTK.

In Red Hat Enterprise Linux 7, the following packages require WebKitGTK4: evolution-data-server, glade, gnome-boxes, gnome-initial-setup, gnome-online-accounts, gnome-shell, shotwell, sushi and yelp.

This vulnerability can only be exploited when these packages are installed in the system and being used via a graphical interface to process untrusted web content, via GNOME for example. In gnome-shell, the vulnerability can be exploited by an attacker from the local network without user interaction.

To mitigate this vulnerability, consider removing these packages. Note that some of these packages are required by GNOME, removing them will also remove GNOME and other packages, breaking functionality. However, the server can still be used via the terminal interface.

Additionally, WebKitGTK3 is not required by any package. Therefore, it can be removed without consequences or break of functionality.
spi: spi-sprd-adi: Fix double free in probe error path
CVE: CVE-2026-23068
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

spi: spi-sprd-adi: Fix double free in probe error path

The driver currently uses spi_alloc_host() to allocate the controller
but registers it using devm_spi_register_controller().

If devm_register_restart_handler() fails, the code jumps to the
put_ctlr label and calls spi_controller_put(). However, since the
controller was registered via a devm function, the device core will
automatically call spi_controller_put() again when the probe fails.
This results in a double-free of the spi_controller structure.

Fix this by switching to devm_spi_alloc_host() and removing the
manual spi_controller_put() call.


Remediation:
pgvector: Information disclosure or denial of service via buffer overflow in parallel HNSW index build
CVE: CVE-2026-3172
Component: pgvector
CWE: CWE-120
Severity: Moderate
CVSS v3: 7.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
Release date: 2026-02-25T20:59:10.051000+00:00

Buffer overflow in parallel HNSW index build in pgvector 0.6.0 through 0.8.1 allows a database user to leak sensitive data from other relations or crash the database server.

Statement: A buffer overflow during parallel HNSW index builds can be exploited by a database user, potentially leading to information disclosure from other database relations or a denial of service by crashing the database server, although the high impact on availability and confidentiality Red Hat Product Security team has rated this as having a moderate severity. This happens because, besides the low privileges required, to successfully exploit this flaw the attack needs to win a race condition among several worker threads which may be a task considered of a high complexity.

Remediation:
scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()
CVE: CVE-2026-23087
Component: kernel
Severity: None
Release date: 2026-02-04T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

scsi: xen: scsiback: Fix potential memory leak in scsiback_remove()

Memory allocated for struct vscsiblk_info in scsiback_probe() is not
freed in scsiback_remove() leading to potential memory leaks on remove,
as well as in the scsiback_probe() error paths. Fix that by freeing it
in scsiback_remove().


Remediation:
thunderbird: Use-after-free in the JavaScript Engine component
CVE: CVE-2026-2763
Component: firefox
Severity: Important
CVSS v3: 7.5/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T13:33:02.514000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Use-after-free in the JavaScript Engine component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
@backstage/plugin-techdocs-node vulnerable to arbitrary code execution via MkDocs hooks
CVE: CVE-2026-25153
Component: @backstage/plugin-techdocs-node
CWE: CWE-94
Severity: Important
CVSS v3: 7.4/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:L
Release date: 2026-01-30T21:31:58.870000+00:00

A code injection flaw has been discovered in the npm @backstage/plugin-techdocs-node library.  When TechDocs is configured with `runIn: local`, a malicious actor who can submit or modify a repository's `mkdocs.yml` file can execute arbitrary Python code on the TechDocs build server via MkDocs hooks configuration.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net/sched: cls_u32: use skb_header_pointer_careful()
CVE: CVE-2026-23204
Component: kernel
CWE: CWE-1285
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_u32: use skb_header_pointer_careful()

skb_header_pointer() does not fully validate negative @offset values.

Use skb_header_pointer_careful() instead.

GangMin Kim provided a report and a repro fooling u32_classify():

BUG: KASAN: slab-out-of-bounds in u32_classify+0x1180/0x11b0
net/sched/cls_u32.c:221

Statement: An out of bounds memory access vulnerability exists in the Linux traffic control u32 classifier implementation. In u32_classify the kernel calculates offsets such as toff using key off values masks and variable offsets and then dereferences packet data using skb_header_pointer. The helper skb_header_pointer does not fully validate negative offset values. With a crafted configuration and packet layout the computed offset can become negative or otherwise invalid in a way that bypasses the existing checks and results in an out of bounds access. The most direct impact is a kernel crash causing a denial of service. Because the access pattern involves reading packet data at attacker influenced offsets it may also allow information disclosure of adjacent kernel memory and in worst cases could contribute to privilege escalation chains. Exploitation prerequisites depend on whether the system has tc u32 filters configured on a traffic path. For the CVSS the base score uses PR:L because configuring tc filters typically requires elevated privileges but can be available in containers or network namespaces with CAP_NET_ADMIN.

Remediation:
Traefik: Denial of Service via ACME TLS-ALPN fast path resource exhaustion
CVE: CVE-2026-22045
Component: traefik
CWE: CWE-770
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-15T22:44:05.423000+00:00

A flaw was found in Traefik, an HTTP reverse proxy and load balancer. This vulnerability exists in the ACME TLS-ALPN fast path, where unauthenticated clients can exploit it. By initiating numerous connections and sending a minimal ClientHello with "acme-tls/1" before ceasing communication, a malicious client can indefinitely tie up system resources such as "go routines" (lightweight threads) and file descriptors. This leads to a Denial of Service (DoS) of the entry point, making the service unavailable to legitimate users.

Statement: This vulnerability is rated Moderate for Red Hat. In the Red Hat context, this flaw affects Traefik as deployed in Red Hat OpenShift Dev Spaces. An unauthenticated attacker can exploit the ACME TLS-ALPN fast path to exhaust system resources, leading to a denial of service of the entry point.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Memory Exhaustion via Malformed DOC File Upload
CVE: CVE-2026-25780
Component: github.com/mattermost/mattermost-server
CVSS v3: 4.5/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-16T12:59:13.620000+00:00

A memory exhaustion flaw has been discovered in the Mattermost server. Affected versions fail to bound memory allocation when processing DOC files which allows an authenticated attacker to cause server memory exhaustion and denial of service via uploading a specially crafted DOC file.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Harden-Runner: Egress policy bypass via DNS over TCP
CVE: CVE-2026-32946
Component: step-security/harden-runner
CWE: CWE-791
Severity: Moderate
CVSS v3: 5.9/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-03-20T03:58:40.557000+00:00

A flaw was found in Harden-Runner, a security agent for GitHub Actions runners. An attacker with existing code execution capabilities within a GitHub Actions workflow can bypass network egress policies, which are security measures designed to control outbound network connections. This bypass occurs by utilizing DNS queries over TCP, allowing unauthorized network communication despite restrictive egress policies.


Remediation:
Kibana: Arbitrary file disclosure via specially crafted connector configuration
CVE: CVE-2026-0532
Component: Kibana
CWE: CWE-918
Severity: Important
CVSS v3: 8.5/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-01-14T10:14:57.415000+00:00

A flaw was found in Kibana. This vulnerability allows an authenticated attacker, with privileges to create or modify connectors, to disclose arbitrary files. The attacker achieves this by submitting a specially crafted configuration for the Google Gemini connector, which the server processes without proper validation, enabling arbitrary network requests and file reads.

Statement: This vulnerability is rated Important for Red Hat products as it allows an authenticated attacker with privileges to create or modify connectors in Kibana to disclose arbitrary files. Exploitation requires a specially crafted configuration for the Google Gemini connector. Red Hat products like Enterprise Application Platform, OpenShift Container Platform, Red Hat OpenStack Platform, and Red Hat OpenShift distributed tracing that include Kibana are affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Integer overflow in memalign leads to heap corruption
CVE: CVE-2026-0861
Component: glibc
CWE: CWE-190
Severity: Low
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-14T21:01:11.037000+00:00

A flaw was found in the glibc library. Passing an excessively large alignment value to the memalign suite of functions, such as memalign, posix_memalign, aligned_alloc, valloc and pvalloc, an integer overflow can occur during internal size calculations due to improper overflow checks, causing an allocation of a small chunk of memory which is subsequently used for writing. This issue can result in an application crash or heap memory corruption.

Statement: To exploit this flaw, an attacker needs to find an application linked to the glibc library that is using one of the vulnerable functions (memalign, posix_memalign, aligned_alloc, valloc or pvalloc) in a way that the alignment parameter can be user-controlled, allowing an attacker to trigger the integer overflow. However, the alignment parameter used by the functions is usually hard-coded power of two and do not allow arbitrary values, specially values supplied by a user. There is no known application vulnerable to this issue.

Also, default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and memory protections significantly increase the difficult of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this vulnerability has been rated with a low severity.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://docs.openshift.com/container-platform/latest/operators/admin/olm-upgrading-operators.html
The containers required to run Discovery can be installed through discovery-installer
RPM. See the official documentation for more details.
The Insights proxy container image provided here is downloaded by the Red Hat
Insights proxy product RPM.

Before applying this update, make sure all previously released errata relevant to
your system have been applied.
The container images provided by this release, apart from the installer, should be deployed using rhui-installer utility.
See the official documentation for more details.
Applications calling one of the vulnerable functions and allowing the alignment parameter to be set by user-controlled input can implement additional validations checks, ensuring the alignment value is a power of two and does not exceed a sane limit, for example the system page size or a maximum of 64KB. This prevents the excessively large value required to trigger the integer overflow.
ImageMagick: Denial of Service vulnerability via multi-layer nested MVG to SVG conversion
CVE: CVE-2026-24484
Component: ImageMagick
CWE: CWE-1284
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T00:31:05.029000+00:00

A flaw was found in ImageMagick, a free and open-source software used for editing and manipulating digital images. A remote attacker could exploit this vulnerability by providing a specially crafted image file with multi-layer nested MVG (Magick Vector Graphics) conversions to SVG (Scalable Vector Graphics). This improper handling of conversions can lead to a Denial of Service (DoS), making the software unavailable to legitimate users.

Statement: This MODERATE impact denial of service vulnerability in ImageMagick affects Red Hat Enterprise Linux 6 ELS and 7 ELS, as well as Fedora and EPEL. The flaw occurs when converting multi-layer nested MVG files to SVG, where ImageMagick fails to properly validate the input, leading to resource exhaustion. Systems processing untrusted MVG files are susceptible to this issue.

Remediation:
Since this vulnerability involves processing untrusted image files, it is recommended to avoid converting multi-layer nested MVG files from untrusted sources to SVG format. Implement strict input validation and sanitization for any image files processed by ImageMagick. Additionally, consider running ImageMagick in a sandboxed environment to limit potential impact.
jackson-core: Denial of Service via excessive JSON nesting
CVE: CVE-2026-29062
Component: jackson-core
CWE: CWE-1284
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-06T07:14:25.059000+00:00

A flaw was found in jackson-core. A user could exploit this vulnerability by supplying a specially crafted JSON document with excessive nesting. This bypasses a security constraint designed to limit nesting depth, which can cause a system crash (StackOverflowError) when the document is processed. This ultimately leads to a Denial of Service (DoS) for the affected application.


Remediation:
cgroup/dmem: avoid pool UAF
CVE: CVE-2026-23195
Component: kernel
CWE: CWE-911
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A use-after-free vulnerability was found in the cgroup device memory (dmem) subsystem. When a memory region is unregistered, the associated pool is freed immediately even if callers still hold references to it, leading to use-after-free when subsequent uncharge operations access the freed pool.

Statement: The dmem cgroup subsystem is a relatively new feature primarily used for device memory accounting. This UAF requires specific timing between pool unregistration and pending uncharge operations, typically triggered by out-of-tree modules. The impact is a kernel crash or potential memory corruption.

Remediation:
FreeRDP: Denial of Service via out-of-bounds read from malicious server input
CVE: CVE-2026-25942
Component: freerdp
CWE: CWE-125
Severity: Moderate
CVSS v3: 4.2/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L
Release date: 2026-02-25T20:01:16.472000+00:00

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to version 3.23.0, `xf_rail_server_execute_result` indexes the global `error_code_names[]` array (7 elements, indices 0–6) with an unchecked `execResult->execResult` value received from the server, allowing an out-of-bounds read when the server sends an `execResult` value of 7 or greater. Version 3.23.0 fixes the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Caddy: Authentication bypass via mTLS client certificate validation failure
CVE: CVE-2026-27586
Component: github.com/caddyserver/caddy/v2/modules/caddytls
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Release date: 2026-02-24T16:08:20.569000+00:00

Caddy is an extensible server platform that uses TLS by default. Prior to version 2.11.1, two swallowed errors in `ClientAuthentication.provision()` cause mTLS client certificate authentication to silently fail open when a CA certificate file is missing, unreadable, or malformed. The server starts without error but accepts any client certificate signed by any system-trusted CA, completely bypassing the intended private CA trust boundary. Any deployment using `trusted_ca_cert_file` or `trusted_ca_certs_pem_files` for mTLS will silently degrade to accepting any system-trusted client certificate if the CA file becomes unavailable. This can happen due to a typo in the path, file rotation, corruption, or permission changes. The server gives no indication that mTLS is misconfigured. Version 2.11.1 fixes the vulnerability.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
OpenSIPS: Authentication bypass due to SQL injection in JWT processing
CVE: CVE-2026-25554
Component: opensips
CVSS v3: 8.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Release date: 2026-02-25T16:54:11.845000+00:00

A flaw was found in OpenSIPS. The auth_jwt module, when configured with db_mode and a SQL database backend, contains a SQL injection vulnerability in the jwt_db_authorize() function. This function extracts the tag claim from a JSON Web Token (JWT) without verifying its signature and directly incorporates the unescaped value into a SQL query. A remote attacker can exploit this by supplying a crafted JWT with a malicious tag claim, leading to manipulation of query results, bypass of JWT authentication, and impersonation of arbitrary identities.

Statement: This is an IMPORTANT flaw in OpenSIPS. The vulnerability exists when the `auth_jwt` module is enabled, configured with `db_mode`, and utilizes a SQL database backend for JWT authorization. An attacker can exploit this specific configuration to bypass authentication and impersonate identities by crafting a malicious JWT. Systems are only affected if OpenSIPS is deployed with this particular configuration.

Remediation:
FileInfo can escape from a Root in golang os module
CVE: CVE-2026-27139
Component: os
CWE: CWE-22
Severity: Low
CVSS v3: 2.6/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-06T21:28:14.451000+00:00

A path traversal flaw has been discovered in the golang `os` module. On Unix platforms, when listing the contents of a directory using File.ReadDir or File.Readdir the returned FileInfo could reference a file outside of the Root in which the File was opened. The impact of this escape is limited to reading metadata provided by lstat from arbitrary locations on the filesystem without permitting reading or writing files outside the root.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Heap buffer overflow in WebRTC
CVE: CVE-2026-4463
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A heap buffer overflow flaw was found in the WebRTC component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=491358681

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation: