huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Kata Containers: Denial of Service and filesystem errors due to malformed container image processing
CVE: CVE-2026-24054
Component: kata-containers
CWE: CWE-1287
Severity: Moderate
CVSS v3: 7.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:H
Release date: 2026-01-29T17:16:56.418000+00:00

Kata Containers is an open source project focusing on a standard implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 3.26.0, when a container image is malformed or contains no layers, containerd falls back to bind-mounting an empty snapshotter directory for the container rootfs. When the Kata runtime attempts to mount the container rootfs, the bind mount causes the rootfs to be detected as a block device, leading to the underlying device being hotplugged to the guest. This can cause filesystem-level errors on the host due to double inode allocation, and may lead to the host's block device being mounted as read-only. Version 3.26.0 contains a patch for the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Caddy: Privilege escalation via identity injection due to unstripped client headers
CVE: CVE-2026-30851
Component: github.com/caddyserver/caddy/v2/modules/caddyhttp/reverseproxy
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-07T16:28:37.097000+00:00

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
dpkg-deb: Denial of Service via improper validation of zstd-compressed archives
CVE: CVE-2026-2219
Component: dpkg
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-07T08:10:53.207000+00:00

A flaw was found in dpkg-deb, a component of the Debian package management system. This vulnerability allows a local user to trigger a Denial of Service (DoS) by providing a specially crafted zstd-compressed .deb archive. The flaw occurs because dpkg-deb does not properly validate the end of the data stream during decompression, leading to an infinite loop that consumes CPU resources. This can make the system unresponsive.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Integer overflow in V8
CVE: CVE-2026-2649
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-18T00:00:00+00:00

Integer overflow in V8 in Google Chrome prior to 145.0.7632.109 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
YugabyteDB Anywhere: Information disclosure of LDAP bind passwords via web UI
CVE: CVE-2026-1966
Component: YugabyteDB
CWE: CWE-312
Severity: Low
CVSS v3: 6.7/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Release date: 2026-02-05T11:38:28.291000+00:00

A flaw was found in YugabyteDB Anywhere. This vulnerability allows an authenticated user with access to the configuration view to obtain Lightweight Directory Access Protocol (LDAP) bind passwords. These passwords are displayed in cleartext within the web user interface (UI) when configured via gflags. This information disclosure could potentially enable unauthorized access to external directory services.

Statement: LOW impact: Authenticated users with access to the configuration view of YugabyteDB Anywhere can obtain LDAP bind passwords displayed in cleartext within the web UI. This information disclosure could lead to unauthorized access to external directory services.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
NULL pointer dereference when parsing a malformed CDXML file
CVE: CVE-2026-3408
Component: openbabel
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Release date: 2026-03-02T03:32:10.760000+00:00

A vulnerability was identified in Open Babel up to 3.1.1. This impacts the function OBAtom::GetExplicitValence of the file isrc/atom.cpp of the component CDXML File Handler. Such manipulation leads to null pointer dereference. The attack can be launched remotely. The exploit is publicly available and might be used. The name of the patch is e23a224b8fd9d7c2a7cde9ef4ec6afb4c05aa08a. It is best practice to apply a patch to resolve this issue.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
block: zero non-PI portion of auto integrity buffer
CVE: CVE-2026-23007
Component: kernel
CWE: CWE-908
Severity: Low
CVSS v3: 4.7/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-25T00:00:00+00:00

An information disclosure vulnerability was found in the Linux kernel's block layer integrity handling. When auto-generating integrity buffers for writes with protection information (PI) enabled, the non-PI portion of the metadata buffer is left uninitialized if the metadata size exceeds the PI tuple size. This uninitialized kernel memory can be read back by userspace or anyone with physical access to the storage device.

Statement: This vulnerability allows kernel memory contents to leak to storage media and potentially be read back by userspace. It affects block devices with integrity/PI metadata where the metadata size is larger than the PI tuple. The information disclosure requires specific storage hardware configurations with extended metadata support and the ability to read back the written data.

Remediation:
mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure
CVE: CVE-2026-23142
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A resource leak flaw was found in the Linux kernel's DAMON (Data Access MONitor) sysfs interface. When setting up a DAMOS-scheme directory fails after the access_pattern/ subdirectory has been created, the subdirectories are not properly cleaned up. This leaves the DAMON sysfs interface in a broken state until reboot and causes a memory leak for the unremoved directory structures.

Statement: Exploiting this flaw requires access to the DAMON sysfs interface, which typically requires root privileges. The impact is limited to degraded DAMON functionality and minor memory leakage, requiring a reboot to restore normal operation.

Remediation:
Vaultwarden: Privilege Escalation via Unauthorized Bulk Permission Update
CVE: CVE-2026-27802
Component: vaultwarden
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-04T21:34:34.992000+00:00

A flaw was found in Vaultwarden. A manager, an authorized user, can exploit this vulnerability by performing a bulk permission update to collections they are not authorized to access. This can lead to privilege escalation, allowing the manager to gain unauthorized access and control over these collections.

Statement: IMPORTANT: This privilege escalation vulnerability in Vaultwarden allows a Manager to update permissions for unauthorized collections. This flaw affects Vaultwarden versions prior to 1.35.4, enabling a malicious or compromised Manager account to gain elevated privileges beyond their intended scope within the application.

Remediation:
Squirrel: Denial of Service via uncontrolled recursion in compiler functions
CVE: CVE-2026-3388
Component: squirrel
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-01T09:32:11.219000+00:00

A flaw was found in Squirrel. A local user can perform a manipulation within the SQCompiler::Factor or SQCompiler::UnaryOP functions, leading to uncontrolled recursion. This vulnerability can result in a Denial of Service (DoS), making the affected system or application unavailable.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
CSS-based exfiltration of the content from partially encrypted emails when allowing remote content
CVE: CVE-2026-0818
Component: thunderbird
Severity: None
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-28T07:39:17.467000+00:00

When a user explicitly requested Thunderbird to decrypt an inline OpenPGP message that was embedded in a text section of an email that was formatted and styled with HTML and CSS, then the decrypted contents were rendered in a context in which the CSS styles from the outer messages were active. If the user had additionally allowed loading of the remote content referenced by the outer email message, and the email was crafted by the sender using a combination of CSS rules and fonts and animations, then it was possible to extract the secret contents of the email. This vulnerability affects Thunderbird < 147.0.1 and Thunderbird < 140.7.1.

Statement: ed Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
libsoup: Denial of Service via Use-After-Free in HTTP/2 server
CVE: CVE-2026-4271
Component: libsoup
CWE: CWE-416
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-16T00:00:00+00:00

A flaw was found in libsoup, a library for handling HTTP requests. This vulnerability, known as a Use-After-Free, occurs in the HTTP/2 server implementation. A remote attacker can exploit this by sending specially crafted HTTP/2 requests that cause authentication failures. This can lead to the application attempting to access memory that has already been freed, potentially causing application instability or crashes, resulting in a Denial of Service (DoS).

Statement: This MODERATE impact use-after-free flaw in libsoup's HTTP/2 server implementation affects applications that use libsoup to handle HTTP/2 server callbacks. An attacker can trigger this by sending HTTP/2 requests that cause authentication validation failures, potentially leading to application instability or crashes. Red Hat products are affected if they leverage libsoup as an HTTP/2 server and disconnect client connections during header processing.

Remediation:
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP: Denial of Service via endless blocking loop in Stream_EnsureCapacity
CVE: CVE-2026-27951
Component: freerdp
CWE: CWE-190
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-25T21:07:30.828000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol. The `Stream_EnsureCapacity` function can create an endless blocking loop, leading to a Denial of Service (DoS). This vulnerability can be exploited on 32-bit systems where the available physical memory is greater than or equal to the `SIZE_MAX` variable, potentially affecting both client and server implementations using FreeRDP.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP has an out-of-bounds read in ADPCM decoders due to missing predictor/step_index bounds checks
CVE: CVE-2026-31885
Component: freerdp
CWE: CWE-125
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-03-13T17:38:23.756000+00:00

An out of bounds read flaw has been discovered in FreeRDP. This out-of-bounds read exists in the MS-ADPCM and IMA-ADPCM decoders due to unchecked predictor and step_index values from input data. An attacker may be able to leverage this weakness to leak global data.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
xml-security: Information disclosure and integrity compromise due to insufficient authentication tag length validation
CVE: CVE-2026-32600
Component: xml-security
CVSS v3: 8.3/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Release date: 2026-03-13T19:58:41.692000+00:00

A flaw was found in xml-security, a library for XML signatures and encryption. This vulnerability arises from a lack of validation for the authentication tag length in XML nodes encrypted with AES-GCM (Advanced Encryption Standard Galois/Counter Mode). A remote attacker can exploit this by brute-forcing the authentication tag, which may lead to the recovery of the GHASH key. This allows the attacker to decrypt encrypted XML nodes, resulting in information disclosure, and to forge arbitrary ciphertexts, compromising data integrity.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ipv4: ip_gre: make ipgre_header() robust
CVE: CVE-2026-23011
Component: kernel
CWE: CWE-124
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
Release date: 2026-01-25T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

ipv4: ip_gre: make ipgre_header() robust

Analog to commit db5b4e39c4e6 ("ip6_gre: make ip6gre_header() robust")

Over the years, syzbot found many ways to crash the kernel
in ipgre_header() [1].

This involves team or bonding drivers ability to dynamically
change their dev->needed_headroom and/or dev->hard_header_len

In this particular crash mld_newpack() allocated an skb
with a too small reserve/headroom, and by the time mld_sendpack()
was called, syzbot managed to attach an ipgre device.

[1]
skbuff: skb_under_panic: text:ffffffff89ea3cb7 len:2030915468 put:2030915372 head:ffff888058b43000 data:ffff887fdfa6e194 tail:0x120 end:0x6c0 dev:team0
 kernel BUG at net/core/skbuff.c:213 !
Oops: invalid opcode: 0000 [#1] SMP KASAN PTI
CPU: 1 UID: 0 PID: 1322 Comm: kworker/1:9 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: mld mld_ifc_work
 RIP: 0010:skb_panic+0x157/0x160 net/core/skbuff.c:213
Call Trace:
 <TASK>
  skb_under_panic net/core/skbuff.c:223 [inline]
  skb_push+0xc3/0xe0 net/core/skbuff.c:2641
  ipgre_header+0x67/0x290 net/ipv4/ip_gre.c:897
  dev_hard_header include/linux/netdevice.h:3436 [inline]
  neigh_connected_output+0x286/0x460 net/core/neighbour.c:1618
  NF_HOOK_COND include/linux/netfilter.h:307 [inline]
  ip6_output+0x340/0x550 net/ipv6/ip6_output.c:247
  NF_HOOK+0x9e/0x380 include/linux/netfilter.h:318
  mld_sendpack+0x8d4/0xe60 net/ipv6/mcast.c:1855
  mld_send_cr net/ipv6/mcast.c:2154 [inline]
  mld_ifc_work+0x83e/0xd60 net/ipv6/mcast.c:2693
  process_one_work kernel/workqueue.c:3257 [inline]
  process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340
  worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421
  kthread+0x711/0x8a0 kernel/kthread.c:463
  ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158
  ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Statement: A missing headroom validation in ipgre_header() could trigger an skb underflow when GRE encapsulation is applied to an skb with insufficient reserved headroom, potentially causing a kernel crash. An attacker able to manipulate network device stacking / headroom dynamics (typically requiring netns + CAP_NET_ADMIN capabilities) can provoke the condition by forcing GRE header insertion on a too-small skb.

Remediation:
crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning
CVE: CVE-2026-0398
Component: PowerDNS Recursor
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-09T14:20:46.592000+00:00

Crafted zones can lead to increased resource usage and crafted CNAME chains can lead to cache poisoning in Recursor.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
lxml_html_clean: Cross-Site Scripting (XSS) via CSS filter bypass
CVE: CVE-2026-28348
Component: lxml_html_clean
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-03-05T19:49:26.385000+00:00

lxml_html_clean is a project for HTML cleaning functionalities copied from `lxml.html.clean`. Prior to version 0.4.4, the _has_sneaky_javascript() method strips backslashes before checking for dangerous CSS keywords. This causes CSS Unicode escape sequences to bypass the @import and expression() filters, allowing external CSS loading or XSS in older browsers. This issue has been patched in version 0.4.4.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
ImageMagick: Denial of service via crafted MSL script
CVE: CVE-2026-25983
Component: ImageMagick
CWE: CWE-825
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T01:41:45.480000+00:00

A flaw was found in ImageMagick. A remote attacker could exploit a heap-use-after-free (UAF) vulnerability by providing a specially crafted MSL script. This vulnerability occurs when the operation element handler replaces and frees an image while the parser continues to read from it. Successful exploitation could lead to a denial of service.

Statement: This MODERATE impact vulnerability in ImageMagick allows a remote attacker to cause a denial of service or potentially execute arbitrary code through a heap-use-after-free flaw when processing a specially crafted MSL script. Red Hat Enterprise Linux 6 ELS and 7 ELS are affected if ImageMagick is installed and used to process untrusted image files.

Remediation:
To mitigate this issue, avoid processing untrusted or unverified image files, particularly those in MSL format, with ImageMagick. Implement strict input validation and sanitization for any user-supplied image data before it is processed by ImageMagick to reduce the attack surface.
net: fix segmentation of forwarding fraglist GRO
CVE: CVE-2026-23154
Component: kernel
CWE: CWE-237
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's network GSO (Generic Segmentation Offload) handling. When forwarding GRO packets with frag_lists through XLAT (IPv4/IPv6 translation), the skb_segment_list function incorrectly processes packets where only the head skb header is translated, leading to protocol inconsistencies in the fragment list.

Statement: This is primarily a performance and correctness issue rather than a security vulnerability. The bug causes reduced network throughput in specific NAT64/XLAT scenarios (IPv4 access via IPv6-only upstream), but does not enable code execution or privilege escalation. The C:H/I:H ratings in the template score are not warranted.

Remediation:
CVE: CVE-2026-2034
Component: Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability
Release date: 2026-02-13T14:14:03.637000+00:00

Sante DICOM Viewer Pro DCM File Parsing Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Sante DICOM Viewer Pro. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

The specific flaw exists within the parsing of DCM files. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a buffer. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-28129.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
Linux kernel: Denial of Service due to invalid dereference in networking scheduler during netns teardown
CVE: CVE-2026-22987
Component: kernel
CWE: CWE-252
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_api: avoid dereferencing ERR_PTR in tcf_idrinfo_destroy

syzbot reported a crash in tc_act_in_hw() during netns teardown where
tcf_idrinfo_destroy() passed an ERR_PTR(-EBUSY) value as a tc_action
pointer, leading to an invalid dereference.

Guard against ERR_PTR entries when iterating the action IDR so teardown
does not call tc_act_in_hw() on an error pointer.


Remediation:
@tootallnate/once: Denial of Service due to incorrect control flow scoping with AbortSignal
CVE: CVE-2026-3449
Component: @tootallnate/once
CWE: CWE-1322
Severity: Moderate
CVSS v3: 3.9/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-03-03T05:00:01.085000+00:00

A flaw was found in `@tootallnate/once`. When the `AbortSignal` option is used, a Promise can remain in a permanently pending state after the signal is aborted. This incorrect control flow scoping can lead to stalled requests, blocked workers, or degraded application availability.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.