huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Tekton Pipelines: Denial of Service via long resolver names
CVE: CVE-2026-33022
Component: github.com/tektoncd/pipeline
CWE: CWE-130
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T07:48:15.383000+00:00

A denial of service flaw was found in Tekton Pipelines. Any user who can create a TaskRun or PipelineRun to crash the controller cluster-wide by setting .spec.taskRef.resolver (or .spec.pipelineRef.resolver) to a string of 31+ characters. The crash occurs because GenerateDeterministicNameFromSpec produces a name exceeding the 63-character DNS-1123 label limit, and its truncation logic panics on a [-1] slice bound since the generated name contains no spaces. Once crashed, the controller enters a CrashLoopBackOff on restart (as it re-reconciles the offending resource), blocking all CI/CD reconciliation until the resource is manually deleted. Built-in resolvers (git, cluster, bundles, hub) are unaffected due to their short names, but any custom resolver name triggers the bug. The fix truncates the resolver-name prefix instead of the full string, preserving the hash suffix for determinism and uniqueness.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Suricata: Denial of Service via inefficient HTTP/1 header parsing
CVE: CVE-2026-22263
Component: suricata
Release date: 2026-01-27T18:27:45.351000+00:00

A flaw was found in Suricata, a network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), and Network Security Monitoring (NSM) engine. A remote attacker can exploit an inefficiency in HTTP/1 header parsing by sending multiple packets with specially crafted headers. This can lead to a significant slowdown in the system's performance, resulting in a Denial of Service (DoS).

Statement: This vulnerability has a MODERATE impact. Inefficiency in HTTP/1 header parsing over multiple packets in Suricata versions 8.0.0 through 8.0.2 can lead to a denial of service (slowdown). Red Hat customers using Suricata as a network IDS/IPS/NSM engine that processes untrusted HTTP/1 traffic may be affected.

Remediation:
browser API exposes reusable downstream credentials via '/api/4/serverslist'
CVE: CVE-2026-32633
Component: glances
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-18T17:53:11.263000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
idpf: fix memory leak in idpf_vc_core_deinit()
CVE: CVE-2026-23022
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: fix memory leak in idpf_vc_core_deinit()

Make sure to free hw->lan_regs. Reported by kmemleak during reset:

unreferenced object 0xff1b913d02a936c0 (size 96):
  comm "kworker/u258:14", pid 2174, jiffies 4294958305
  hex dump (first 32 bytes):
    00 00 00 c0 a8 ba 2d ff 00 00 00 00 00 00 00 00  ......-.........
    00 00 40 08 00 00 00 00 00 00 25 b3 a8 ba 2d ff  ..@.......%...-.
  backtrace (crc 36063c4f):
    __kmalloc_noprof+0x48f/0x890
    idpf_vc_core_init+0x6ce/0x9b0 [idpf]
    idpf_vc_event_task+0x1fb/0x350 [idpf]
    process_one_work+0x226/0x6d0
    worker_thread+0x19e/0x340
    kthread+0x10f/0x250
    ret_from_fork+0x251/0x2b0
    ret_from_fork_asm+0x1a/0x30


Remediation:
Authlib: Authentication bypass due to JWK Header Injection vulnerability
CVE: CVE-2026-27962
Component: authlib
CWE: CWE-347
Severity: Critical
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-16T17:34:38.946000+00:00

A flaw was found in Authlib, a Python library used for creating secure authentication and authorization systems. This vulnerability, known as JWK (JSON Web Key) Header Injection, affects how Authlib verifies digital signatures in JWS (JSON Web Signature) tokens. An attacker can exploit this by creating a specially crafted token that includes their own cryptographic key in the header. When the system attempts to verify this token without a predefined key, it mistakenly uses the attacker's key, allowing them to bypass authentication and gain unauthorized access.

Statement: This critical vulnerability in Authlib's JWS implementation allows unauthenticated attackers to forge JWTs by embedding their own cryptographic key in the token header. Impact is high to confidentiality and integrity as attackers can bypass authentication.

The impact for Red Hat Quay is rated as low because it imports authlib solely as a JWK parsing utility and performs all JWT signature verification through PyJWT, so the vulnerable jws.deserialize_compact() code path is never called.

Red Hat OpenShift AI is not affected, since authlib is only present as a transitive dependency in the dev dependency group and is not included in production image builds, so the vulnerable code is not present in the shipped product.

Red Hat Satellite is not affected, as authlib is only present as a dependency of fastmcp. In Satellite, fastmcp only invokes authlib using jwt.decode() which isn't able to reach the vulnerability condition even with key=none.

Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Linux kernel: Denial of Service in r8152 USB network adapter driver
CVE: CVE-2026-23188
Component: kernel
CWE: CWE-833
Severity: Moderate
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel, specifically within the r8152 USB network adapter driver. This vulnerability allows a local attacker to trigger a device reset during a system resume operation. The issue arises from a recursive mutex lock, where the driver attempts to acquire the same lock twice, leading to a deadlock. This can cause the system to become unresponsive, resulting in a Denial of Service (DoS).

Statement: This MODERATE impact flaw in the Linux kernel's r8152 USB network adapter driver allows a local attacker to trigger a Denial of Service. The vulnerability, caused by a recursive mutex lock during a system resume operation, can lead to system unresponsiveness. Red Hat Enterprise Linux 6, 7, 8, and 9 are not affected as the vulnerable code is not present. Red Hat Enterprise Linux 10 and Red Hat In-Vehicle OS are affected.

Remediation:
To mitigate this issue, prevent the `r8152` kernel module from loading. This can be achieved by creating a modprobe configuration file.

Create a file named `/etc/modprobe.d/blacklist-r8152.conf` with the following content:
```
blacklist r8152
install r8152 /bin/true
```
After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This mitigation may impact functionality if the `r8152` USB network adapter is required for system operation.
libexpat: Denial of Service due to NULL pointer dereference
CVE: CVE-2026-32776
Component: libexpat
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-16T06:54:20.318000+00:00

A flaw was found in libexpat. A remote attacker could exploit this vulnerability by providing specially crafted XML content with empty external parameter entities. This could lead to a NULL pointer dereference, causing the application to crash and resulting in a Denial of Service (DoS).


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Unauthenticated Arbitrary File Write
CVE: CVE-2026-23537
Component: feast
CWE: CWE-862
Severity: Critical
CVSS v3: 9.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-03-20T00:00:00+00:00

A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict file locations, these protections can be bypassed, enabling an attacker to overwrite vital application configurations or startup scripts. Because this flaw requires no credentials or special privileges, any attacker with network access to the server can potentially compromise the integrity of the system. This could lead to unauthorized system modifications, denial of service through disk exhaustion, or potential remote code execution.

Statement: This Critical vulnerability in the Feast Feature Server's `/save-document` endpoint allows an unauthenticated, remote attacker to write arbitrary JSON files to the filesystem, bypassing path restrictions. This could lead to unauthorized system modifications or remote code execution.

Remediation:
Arbitrary Host File Overwrite via Unconstrained qemu-img Format Handling in OpenStack Nova
CVE: CVE-2026-24708
Component: openstack-nova-compute
CWE: CWE-73
Severity: Important
CVSS v3: 7.2/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-02-17T15:00:00+00:00

A flaw in OpenStack Nova’s interaction with the qemu-img utility allows an authenticated user to overwrite arbitrary files on the compute host. This occurs because Nova invokes qemu-img without strictly constraining the disk image format, enabling a malicious user to craft a QCOW2 header on a raw disk and trigger destructive behavior during instance operations such as resize.

Statement: This vulnerability is rated Important for Red Hat OpenStack Platform. An authenticated attacker can exploit unconstrained disk format handling in OpenStack Nova when invoking qemu-img. By crafting a QCOW2 header on an ephemeral or root disk, an attacker can cause qemu-img to overwrite arbitrary files on the compute host with Nova's write access, leading to data destruction or denial of service.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
react-server-dom-parcel: reactreact-server-dom-turbopack: React Server Components: Denial of Service via specially crafted HTTP requests
CVE: CVE-2026-23864
Component: react-server-dom-webpack
CWE: CWE-1284
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-26T19:16:38.250000+00:00

A flaw was found in React Server Components. A remote attacker can exploit this vulnerability by sending specially crafted HTTP requests to Server Function endpoints. This can lead to a Denial of Service (DoS), causing server crashes, out-of-memory exceptions, or excessive CPU usage, thereby impacting the availability of applications.


Remediation:
cpp-httplib: Denial of Service due to excessive memory usage from compressed HTTP request bodies
CVE: CVE-2026-22776
Component: cpp-httplib
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-12T18:18:01.527000+00:00

A flaw was found in cpp-httplib, a C++ HTTP/HTTPS library. A remote attacker can exploit this vulnerability by sending a specially crafted compressed HTTP request. While the library checks the size of the compressed data, it does not properly limit the size of the data after decompression, leading to excessive memory consumption. This can result in a Denial of Service (DoS), making the affected system unavailable.

Statement: This vulnerability is rated Important for Red Hat because it can lead to a denial of service in applications utilizing the cpp-httplib library to process compressed HTTP request bodies. The flaw occurs due to the library's failure to limit the size of decompressed data, allowing a small compressed payload to consume excessive memory.

Remediation:
Firecracker jailer: Arbitrary file overwrite via symlink attack
CVE: CVE-2026-1386
Component: firecracker
CVSS v3: 6.7/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H
Release date: 2026-01-23T20:25:02.188000+00:00

A flaw was found in the Firecracker jailer component. A local user with write access to pre-created jailer directories could exploit a symbolic link (symlink) following issue. This vulnerability allows the attacker to overwrite arbitrary host files during the jailer's startup initialization process, provided the jailer is executed with root privileges. This could lead to unauthorized modification of system files.

Statement: This vulnerability is rated Moderate for Red Hat. A local host user with write access to pre-created jailer directories can exploit a symbolic link following issue in the Firecracker jailer component. This allows for arbitrary host file overwrite via a symlink attack during jailer startup, provided the jailer is executed with root privileges.

Remediation:
ImageMagick: Heap-based buffer overflow leading to out-of-bounds write
CVE: CVE-2026-30931
Component: ImageMagick
CWE: CWE-190
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-03-09T21:47:48.915000+00:00

A flaw was found in ImageMagick, a software used for editing and manipulating digital images. A local attacker can exploit a heap-based buffer overflow vulnerability within the UHDR encoder. This vulnerability arises from the truncation of a value, enabling an out-of-bounds write. Successful exploitation could lead to a denial of service, making the software unavailable, and potentially result in information disclosure.

Statement: MODERATE: This flaw in ImageMagick involves a heap-based buffer overflow within the UHDR encoder, which could lead to an out-of-bounds write due to value truncation. This vulnerability affects systems processing untrusted image files with ImageMagick.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Kernel: Resource leak in BPF via missing buffer conversion call
CVE: CVE-2026-22994
Component: kernel
CWE: CWE-772
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

A flaw was found in the Linux kernel's Berkeley Packet Filter (BPF) component. This vulnerability involves a reference count leak within the bpf_prog_test_run_xdp() function, specifically when an error handling path fails to call a necessary buffer conversion function. A local user could exploit this to cause a resource leak, preventing network devices from being properly released. This could ultimately lead to a Denial of Service (DoS) condition.


Remediation:
Command Injection in Makefile.build
CVE: CVE-2026-24905
Component: inspektor-gadget
CVSS v3: 8.0/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-01-29T21:29:24.260000+00:00

Inspektor Gadget is a set of tools and framework for data collection and system inspection on Kubernetes clusters and Linux hosts using eBPF. The `ig` binary provides a subcommand for image building, used to generate custom gadget OCI images. A part of this functionality is implemented in the file `inspektor-gadget/cmd/common/image/build.go`. The `Makefile.build` file is the Makefile template employed during the building process. This file includes user-controlled data in an unsafe fashion, specifically some parameters are embedded without an adequate escaping in the commands inside the Makefile. Prior to version 0.48.1, this implementation is vulnerable to command injection: an attacker able to control values in the `buildOptions` structure would be able to execute arbitrary commands during the building process. An attacker able to exploit this vulnerability would be able to execute arbitrary command on the Linux host where the `ig` command is launched, if images are built with the `--local` flag or on the build container invoked by `ig`, if the `--local` flag is not provided. The `buildOptions` structure is extracted from the YAML gadget manifest passed to the `ig image build` command. Therefore, the attacker would need a way to control either the full `build.yml` file passed to the `ig image build` command, or one of its options. Typically, this could happen in a CI/CD scenario that builds untrusted gadgets to verify correctness. Version 0.48.1 fixes the issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Seroval: Denial of Service due to excessive recursion during object serialization
CVE: CVE-2026-24006
Component: seroval
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-22T02:32:31.913000+00:00

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0
and below, serialization of objects with extreme depth can exceed the maximum call stack limit. In version 1.4.1, Seroval introduces a `depthLimit` parameter in serialization/deserialization methods. An error will be thrown if the depth limit is reached.

Statement: This vulnerability is rated Important for Red Hat products as it can lead to a Denial of Service in applications utilizing the Seroval library. Specifically, deeply nested objects processed by Seroval versions 1.4.0 and below can exhaust the call stack, causing application instability. Red Hat products like Forgejo in Fedora and EPEL are affected if they use vulnerable versions of Seroval.

Remediation:
Kernel: Race condition in espintcp can lead to denial of service
CVE: CVE-2026-23239
Component: kernel
CWE: CWE-366
Severity: Moderate
CVSS v3: 5.9/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-03-10T00:00:00+00:00

A flaw was found in the Linux kernel's espintcp component. A local attacker with low privileges could exploit a race condition in the espintcp_close() function. This could allow the espintcp_tx_work() worker to access freed memory, potentially leading to a system crash and resulting in a Denial of Service (DoS).


Remediation:
CVE: CVE-2026-0763
Component: GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-01-09T16:35:09.488000+00:00

GPT Academic run_in_subprocess_wrapper_func Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GPT Academic. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the run_in_subprocess_wrapper_func function. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-27958.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
filelock Time-of-Check-Time-of-Use (TOCTOU) in SoftFileLock
CVE: CVE-2026-22701
Component: filelock
CWE: CWE-367
Severity: Moderate
CVSS v3: 5.4/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-01-10T05:59:28.872000+00:00

filelock is a platform-independent file lock for Python. Prior to version 3.20.3, a TOCTOU race condition vulnerability exists in the SoftFileLock implementation of the filelock package. An attacker with local filesystem access and permission to create symlinks can exploit a race condition between the permission validation and file creation to cause lock operations to fail or behave unexpectedly. The vulnerability occurs in the _acquire() method between raise_on_not_writable_file() (permission check) and os.open() (file creation). During this race window, an attacker can create a symlink at the lock file path, potentially causing the lock to operate on an unintended target file or leading to denial of service. This issue has been patched in version 3.20.3.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
scsi: core: Wake up the error handler when final completions race against each other
CVE: CVE-2026-23110
Component: kernel
CWE: CWE-821
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

Race condition vulnerabilities were found in the Linux kernel's SCSI error handler wake-up logic. Memory ordering issues in scsi_dec_host_busy() and ordering problems in scsi_eh_inc_host_failed() can cause the SCSI error handler to never wake up when command completions race against each other. This leaves I/O stuck indefinitely as the error recovery state cannot advance.

Statement: These race conditions affect SCSI host error recovery under concurrent command completion scenarios. When triggered, SCSI I/O becomes permanently stuck waiting for error handler intervention that never comes. The issue requires specific timing of command completions on multi-CPU systems and manifests as hung I/O operations that never complete.

Remediation:
libsoup: HTTP header injection via specially crafted URLs when an HTTP proxy is configured
CVE: CVE-2026-1467
Component: libsoup
CWE: CWE-93
Severity: Moderate
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N
Release date: 2026-01-27T00:00:00+00:00

A flaw was found in libsoup, an HTTP client library. This vulnerability, known as CRLF (Carriage Return Line Feed) Injection, occurs when an HTTP proxy is configured and the library improperly handles URL-decoded input used to create the Host header. A remote attacker can exploit this by providing a specially crafted URL containing CRLF sequences, allowing them to inject additional HTTP headers or complete HTTP request bodies. This can lead to unintended or unauthorized HTTP requests being forwarded by the proxy, potentially impacting downstream services.

Statement: This vulnerability is rated Moderate for Red Hat products. It affects applications using the libsoup library when configured to use an HTTP proxy and processing attacker-controlled URLs. Successful exploitation may lead to unintended HTTP requests being forwarded by the proxy, potentially impacting downstream services, but does not directly compromise the client system.

Remediation:
To mitigate this issue, avoid processing untrusted URLs in applications that use the libsoup library with an HTTP proxy configured. Restricting network access to the HTTP proxy can also limit potential exposure.