huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
CVE: CVE-2026-23253
Component: kernel
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
FreeRDP heap-buffer-overflow
CVE: CVE-2026-22854
Component: freerdp
CWE: CWE-122
Severity: Moderate
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-14T17:47:49.588000+00:00

A heap based buffer overflow has been discovered in FreeRDP. This heap-buffer-overflow occurs in drive read when a server-controlled read length is used to read file data into an IRP output stream buffer without a hard upper bound, allowing an oversized read to overwrite heap memory.

Statement: Red Hat products in their default configuration employ Address Space Layout Randomization (ASLR) which drastically increases the complexity of the successful exploitation of this flaw.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
URLs in meta content attribute actions are not escaped in html/template
CVE: CVE-2026-27142
Component: html/template
CWE: CWE-79
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-03-06T21:28:14.674000+00:00

An input escaping flaw has been discovered in the golang html/template module. Actions which insert URLs into the content attribute of HTML meta tags are not escaped. This can allow XSS if the meta tag also has an http-equiv attribute with the value "refresh". A new GODEBUG setting has been added, htmlmetacontenturlescape, which can be used to disable escaping URLs in actions in the meta content attribute which follow "url=" by setting htmlmetacontenturlescape=0.


Remediation:
Red Hat Hardened Images RPM Release
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2026-0772
Component: Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-01-09T16:39:18.274000+00:00

Langflow Disk Cache Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Langflow. Authentication is required to exploit this vulnerability.

The specific flaw exists within the disk cache service. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27919.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
leds: led-class: Only Add LED to leds_list when it is fully ready
CVE: CVE-2026-23101
Component: kernel
CWE: CWE-908
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A race condition vulnerability was found in the Linux kernel's LED class subsystem. When registering LEDs, the device is added to leds_list before led_init_core() initializes the set_brightness_work workqueue. If a trigger registration occurs during this window, led_set_brightness() attempts to queue an uninitialized work structure, triggering a warning in __flush_work() and potentially causing undefined behavior.

Statement: This race was observed on Lenovo ThinkPad T14s systems where the EC driver registers two LEDs in quick succession with default triggers from snd_ctl_led module. The async module loading of snd_ctl_led can hit the exact window where the second LED is listed but not fully initialized. Impact is a kernel warning and potential workqueue corruption.

Remediation:
PM: hibernate: Fix crash when freeing invalid crypto compressor
CVE: CVE-2026-23044
Component: kernel
CWE: CWE-390
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's hibernation subsystem. When crypto_alloc_acomp() fails and returns an ERR_PTR value, the cleanup code in save_compressed_image() and load_compressed_image() unconditionally calls crypto_free_acomp() without checking for the error. This causes crypto_acomp_tfm() to dereference the invalid pointer, crashing the kernel during hibernation operations.

Statement: This vulnerability can be triggered when attempting to hibernate a system where the required compression algorithm (such as LZO) is not available or not compiled into the kernel. The crash occurs during the error handling path of hibernation save or resume operations. Exploitation is limited to causing a denial of service and requires the ability to initiate hibernation.

Remediation:
Minimatch: Denial of Service via catastrophic backtracking in glob expressions
CVE: CVE-2026-27904
Component: minimatch
CWE: CWE-1333
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-02-26T01:07:42.693000+00:00

A flaw was found in minimatch. A remote attacker could exploit this vulnerability by providing a specially crafted glob expression with nested unbounded quantifiers. This could lead to catastrophic backtracking in the V8 JavaScript engine, causing the application to become unresponsive and resulting in a Denial of Service (DoS).

Statement: Exploitation of this flaw requires that a user or service processes untrusted input.

Remediation:
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
Stack overflow parsing XML with deeply nested DTD content models
CVE: CVE-2026-4224
Component: cpython
CWE: CWE-805
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-16T17:52:26.639000+00:00

A stack overflow flaw has been discovered in the python pyexpat module. When an Expat parser with a registered ElementDeclHandler parses an inline document type definition containing a deeply nested content model a C stack overflow occurs. This will result in a program crash.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Use after free in WebMCP
CVE: CVE-2026-3918
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-10T00:00:00+00:00

An use after free flaw was found in the WebMCP component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=483853103

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
idpf: Fix RSS LUT NULL pointer crash on early ethtool operations
CVE: CVE-2026-22985
Component: kernel
CWE: CWE-476
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

idpf: Fix RSS LUT NULL pointer crash on early ethtool operations

The RSS LUT is not initialized until the interface comes up, causing
the following NULL pointer crash when ethtool operations like rxhash on/off
are performed before the interface is brought up for the first time.

Move RSS LUT initialization from ndo_open to vport creation to ensure LUT
is always available. This enables RSS configuration via ethtool before
bringing the interface up. Simplify LUT management by maintaining all
changes in the driver's soft copy and programming zeros to the indirection
table when rxhash is disabled. Defer HW programming until the interface
comes up if it is down during rxhash and LUT configuration changes.

Steps to reproduce:
** Load idpf driver; interfaces will be created
	modprobe idpf
** Before bringing the interfaces up, turn rxhash off
	ethtool -K eth2 rxhash off

[89408.371875] BUG: kernel NULL pointer dereference, address: 0000000000000000
[89408.371908] #PF: supervisor read access in kernel mode
[89408.371924] #PF: error_code(0x0000) - not-present page
[89408.371940] PGD 0 P4D 0
[89408.371953] Oops: Oops: 0000 [#1] SMP NOPTI
<snip>
[89408.372052] RIP: 0010:memcpy_orig+0x16/0x130
[89408.372310] Call Trace:
[89408.372317]  <TASK>
[89408.372326]  ? idpf_set_features+0xfc/0x180 [idpf]
[89408.372363]  __netdev_update_features+0x295/0xde0
[89408.372384]  ethnl_set_features+0x15e/0x460
[89408.372406]  genl_family_rcv_msg_doit+0x11f/0x180
[89408.372429]  genl_rcv_msg+0x1ad/0x2b0
[89408.372446]  ? __pfx_ethnl_set_features+0x10/0x10
[89408.372465]  ? __pfx_genl_rcv_msg+0x10/0x10
[89408.372482]  netlink_rcv_skb+0x58/0x100
[89408.372502]  genl_rcv+0x2c/0x50
[89408.372516]  netlink_unicast+0x289/0x3e0
[89408.372533]  netlink_sendmsg+0x215/0x440
[89408.372551]  __sys_sendto+0x234/0x240
[89408.372571]  __x64_sys_sendto+0x28/0x30
[89408.372585]  x64_sys_call+0x1909/0x1da0
[89408.372604]  do_syscall_64+0x7a/0xfa0
[89408.373140]  ? clear_bhb_loop+0x60/0xb0
[89408.373647]  entry_SYSCALL_64_after_hwframe+0x76/0x7e
[89408.378887]  </TASK>
<snip>

Statement: A NULL-pointer dereference in the Intel idpf driver can be triggered when early ethtool operations (e.g., toggling rxhash) are performed before the interface is brought up, because the RSS LUT was not initialized yet. This leads to a kernel crash (DoS) via the netlink/feature-change path.

Remediation:
OpenFGA Improper Policy Enforcement
CVE: CVE-2026-24851
Component: github.com/openfga/openfga
CWE: CWE-1220
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Release date: 2026-02-06T17:51:27.274000+00:00

OpenFGA is a high-performance and flexible authorization/permission engine built for developers and inspired by Google Zanzibar. OpenFGA v1.8.5 to v1.11.2 ( openfga-0.2.22<= Helm chart <= openfga-0.2.51, v.1.8.5 <= docker <= v.1.11.2) are vulnerable to improper policy enforcement when certain Check calls are executed. The vulnerability requires a model that has a a relation directly assignable by a type bound public access and assignable by type bound non-public access, a tuple assigned for the relation that is a type bound public access, a tuple assigned for the same object with the same relation that is not type bound public access, and a tuple assigned for a different object that has an object ID lexicographically larger with the same user and relation which is not type bound public access. This vulnerability is fixed in v1.11.3.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2026-2036
Component: GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability
Release date: 2026-02-12T21:49:16.054000+00:00

GFI Archiver MArc.Store Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GFI Archiver. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed.

The specific flaw exists within the configuration of the MArc.Store.Remoting.exe process. The issue results from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-27936.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()
CVE: CVE-2026-23228
Component: kernel
Severity: None
Release date: 2026-02-18T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

smb: server: fix leak of active_num_conn in ksmbd_tcp_new_connection()

On kthread_run() failure in ksmbd_tcp_new_connection(), the transport is
freed via free_transport(), which does not decrement active_num_conn,
leaking this counter.

Replace free_transport() with ksmbd_tcp_disconnect().


Remediation:
Use after free in ANGLE
CVE: CVE-2026-0908
Component: chromium-browser
Release date: 2026-01-13T00:00:00+00:00

Use after free in ANGLE in Google Chrome prior to 144.0.7559.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Low)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
symfony/process: Symfony argument escaping under MSYS2/Git Bash on Windows can lead to destructive file operations
CVE: CVE-2026-24739
Component: symfony/symfony
CVSS v3: 6.2/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
Release date: 2026-01-28T20:25:21.500000+00:00

Symfony is a PHP framework for web and console applications and a set of reusable PHP components. Prior to versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5, the Symfony Process component did not correctly treat some characters (notably `=`) as “special” when escaping arguments on Windows. When PHP is executed from an MSYS2-based environment (e.g. Git Bash) and Symfony Process spawns native Windows executables, MSYS2’s argument/path conversion can mis-handle unquoted arguments containing these characters. This can cause the spawned process to receive corrupted/truncated arguments compared to what Symfony intended. If an application (or tooling such as Composer scripts) uses Symfony Process to invoke file-management commands (e.g. `rmdir`, `del`, etc.) with a path argument containing `=`, the MSYS2 conversion layer may alter the argument at runtime. In affected setups this can result in operations being performed on an unintended path, up to and including deletion of the contents of a broader directory or drive. The issue is particularly relevant when untrusted input can influence process arguments (directly or indirectly, e.g. via repository paths, extracted archive paths, temporary directories, or user-controlled configuration). Versions 5.4.51, 6.4.33, 7.3.11, 7.4.5, and 8.0.5 contains a patch for the issue. Some workarounds are available. Avoid running PHP/one's own tooling from MSYS2-based shells on Windows; prefer cmd.exe or PowerShell for workflows that spawn native executables. Avoid passing paths containing `=` (and similar MSYS2-sensitive characters) to Symfony Process when operating under Git Bash/MSYS2. Where applicable, configure MSYS2 to disable or restrict argument conversion (e.g. via `MSYS2_ARG_CONV_EXCL`), understanding this may affect other tooling behavior.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Information disclosure in efivarfs via incorrect error propagation
CVE: CVE-2026-23156
Component: kernel
CWE: CWE-390
Severity: Moderate
CVSS v3: 7.5/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the efivarfs component of the Linux kernel. This vulnerability, an information disclosure issue, arises from incorrect error handling in the efivar_entry_get function. An unprivileged local attacker can exploit this by reading from efivarfs, potentially causing uninitialized kernel memory to be copied to userspace. This could allow the attacker to obtain sensitive kernel memory contents, which may aid in bypassing security mitigations.

Statement: A local information disclosure issue exists in efivarfs due to incorrect error propagation in efivar_entry_get. The wrapper efivar_entry_get called __efivar_entry_get to retrieve EFI variable data but always returned success 0 even when the underlying function failed. This causes callers to treat the output buffers attributes size and data as valid even though the read may not have completed. In the efivarfs file read path efivarfs_file_read this can result in copying an uninitialized or partially initialized kernel heap buffer to userspace. An unprivileged local attacker who can read from efivarfs can potentially obtain kernel memory contents. Such leaks can expose sensitive information and may be useful to bypass mitigations such as KASLR in combination with other vulnerabilities.

Remediation:
For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

The system must be rebooted for this update to take effect.
libjxl: Out-of-bounds write in grayscale color transformation when using LCMS2
CVE: CVE-2026-1837
Component: libjxl
CWE: CWE-787
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-11T15:19:55.442000+00:00

An out of bounds write has been discovered in libjxl. A specially-crafted file can cause libjxl's decoder to write pixel data to uninitialized unallocated memory. Soon after that data from another uninitialized unallocated region is copied to pixel data. This can be done by requesting color transformation of grayscale images to another grayscale color space. Buffers allocated for 1-float-per-pixel are used as if they are allocated for 3-float-per-pixel. That happens only if LCMS2 is used as CMS engine. There is another CMS engine available (selected by build flags).


Remediation:
fast-xml-parser has RangeError DoS Numeric Entities Bug
CVE: CVE-2026-25128
Component: fast-xml-parser
CWE: CWE-248
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-30T15:14:58.244000+00:00

A denial of service flaw has been discovered in the fast-xml-parser npm library. In fast-xml-parser, a RangeError vulnerability exists in the numeric entity processing of fast-xml-parser when parsing XML with out-of-range entity code points (e.g., `&#9999999;` or `&#xFFFFFF;`). This causes the parser to throw an uncaught exception, crashing any application that processes untrusted XML input.

Statement: The availability impact of this flaw is limited to the application which bundles the fast-xml-parser library. Red Hat host systems are not at risk of availability impact.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Micronaut Framework: Micronaut Framework: Denial of Service via crafted form parameters
CVE: CVE-2026-33013
Component: micronaut-core
CWE: CWE-1285
Severity: Moderate
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T04:47:42.768000+00:00

A flaw was found in Micronaut Framework, specifically within the micronaut-core component. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by sending crafted indexed form parameters. The flaw occurs because the framework does not correctly handle descending array index order during form-urlencoded body binding, leading to a non-terminating loop, CPU exhaustion, and OutOfMemoryError.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback
CVE: CVE-2026-23013
Component: kernel
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback

octep_vf_request_irqs() requests MSI-X queue IRQs with dev_id set to
ioq_vector. If request_irq() fails part-way, the rollback loop calls
free_irq() with dev_id set to 'oct', which does not match the original
dev_id and may leave the irqaction registered.

This can keep IRQ handlers alive while ioq_vector is later freed during
unwind/teardown, leading to a use-after-free or crash when an interrupt
fires.

Fix the error path to free IRQs with the same ioq_vector dev_id used
during request_irq().

Statement: This bug allows a guest-to-host attack scenario in SR-IOV setups: a malicious or compromised VF can leave stale IRQ handlers registered, leading to use-after-free and potential host kernel crash when an interrupt fires.

Remediation:
glib-networking: Denial of Service and information disclosure via crafted TLS client-CA list
CVE: CVE-2026-2574
Component: glib-networking
CWE: CWE-125
Severity: Low
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
Release date: 2026-02-16T00:00:00+00:00

A flaw was found in glib-networking. A malicious Transport Layer Security (TLS) server can exploit an out-of-bounds read and invalid free vulnerability when a client using the OpenSSL backend connects. By advertising a specially crafted client-CA list, the server can trigger an issue where memory is accessed outside of its allocated buffer and subsequently freed incorrectly. This can lead to a denial-of-service and potentially disclose limited heap memory.

Statement: This is a LOW impact vulnerability affecting the OpenSSL backend of the glib-networking library used by GNOME applications. When a client configured to use the OpenSSL backend connects to a malicious TLS server, improper handling of certificate authority data can result in an out-of-bounds heap read and an invalid free condition. Successful exploitation may cause application crashes (denial-of-service) and potentially limited heap memory disclosure.

Red Hat products are not affected because the vulnerable OpenSSL backend is not built or shipped in supported configurations; therefore, the overall impact to Red Hat customers is considered Low.

Remediation: