huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
default exception handler leaks e.what() to clients via EXCEPTION_WHAT response header
CVE: CVE-2026-28434
Component: cpp-httplib
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-04T19:34:30.486000+00:00

cpp-httplib is a C++11 single-file header-only cross platform HTTP/HTTPS library. Prior to 0.35.0, when a request handler throws a C++ exception and the application has not registered a custom exception handler via set_exception_handler(), the library catches the exception and writes its message directly into the HTTP response as a header named EXCEPTION_WHAT. This header is sent to whoever made the request, with no authentication check and no special configuration required to trigger it. The behavior is on by default. A developer who does not know to opt in to set_exception_handler() will ship a server that leaks internal exception messages to any client. This vulnerability is fixed in 0.35.0.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
libsoup: Denial of Service via use-after-free in SoupServer during TLS handshake
CVE: CVE-2026-2436
Component: libsoup
CWE: CWE-825
Severity: Moderate
CVSS v3: 6.4/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Release date: 2026-02-11T00:00:00+00:00

No description is available for this CVE.


Remediation:
@backstage/cli-common Symlink Chain Bypass
CVE: CVE-2026-24047
Component: @backstage/backend-plugin-api
CWE: CWE-59
Severity: Moderate
CVSS v3: 6.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Release date: 2026-01-21T22:45:06.956000+00:00

Backstage is an open framework for building developer portals, and @backstage/cli-common provides config loading functionality used by the backend and command line interface of Backstage. Prior to version 0.1.17, the `resolveSafeChildPath` utility function in `@backstage/backend-plugin-api`, which is used to prevent path traversal attacks, failed to properly validate symlink chains and dangling symlinks. An attacker could bypass the path validation via symlink chains (creating `link1 → link2 → /outside` where intermediate symlinks eventually resolve outside the allowed directory) and dangling symlinks (creating symlinks pointing to non-existent paths outside the base directory, which would later be created during file operations). This function is used by Scaffolder actions and other backend components to ensure file operations stay within designated directories. This vulnerability is fixed in `@backstage/backend-plugin-api` version 0.1.17. Users should upgrade to this version or later. Some workarounds are available. Run Backstage in a containerized environment with limited filesystem access and/or restrict template creation to trusted users.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Heap buffer overflow in ANGLE
CVE: CVE-2026-4448
Component: chromium-browser
CVSS v3: 9.6/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

A heap buffer overflow flaw was found in the ANGLE component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=486972661

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
netfilter: nf_tables: always walk all pending catchall elements
CVE: CVE-2026-23278
Component: kernel
CWE: CWE-459
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-20T00:00:00+00:00

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nf_tables component. This vulnerability occurs during transaction processing when the system incorrectly handles multiple pending catchall elements, particularly when the associated map is being removed. This can lead to a kernel warning and system instability, potentially causing a Denial of Service (DoS) for the affected system.


Remediation:
Linux kernel: Memory leak in Bluetooth MGMT can lead to denial of service
CVE: CVE-2026-23151
Component: kernel
CWE: CWE-772
Severity: Moderate
CVSS v3: 6.2/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A flaw was found in the Linux kernel's Bluetooth Management (MGMT) component. This vulnerability, a memory leak, allows a local user with elevated privileges to cause the kernel to consume an increasing amount of memory. The issue stems from mgmt_pending_cmd structures not being properly released after certain Bluetooth operations. Over time, this can lead to system instability, resource exhaustion, and ultimately a denial of service, making the system unavailable.

Statement: A memory leak in the Bluetooth MGMT command completion path occurs because mgmt_pending_cmd objects are removed from the pending list but are not freed in both the success and error paths of set_ssp_complete. This results in leaked pending command structures and their associated parameter buffers for each completed SSP command. The same pattern also affects set_advertising_complete. Over time, repeated management operations can cause unbounded kernel memory growth and lead to resource exhaustion or degraded system stability. For the CVSS the PR:L choice is appropriate because triggering these completions typically requires access to Bluetooth management interfaces, which is commonly restricted to privileged users or processes with elevated capabilities. The primary impact is availability through memory pressure.

Remediation:
ImageMagick: Denial of Service via malicious YUV image processing
CVE: CVE-2026-25986
Component: ImageMagick
CWE: CWE-805
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T01:44:34.711000+00:00

A flaw was found in ImageMagick. A heap buffer overflow vulnerability exists when processing specially crafted YUV 4:2:2 (NoInterlace) images. A remote attacker could exploit this by providing a malicious image, leading to a denial of service (DoS) due to a write beyond the allocated buffer.

Statement: This MODERATE impact vulnerability in ImageMagick affects Red Hat Enterprise Linux 6 ELS and 7 ELS. A heap buffer overflow occurs when processing specially crafted YUV 4:2:2 images, which could lead to denial of service or potentially arbitrary code execution. Exploitation requires an attacker to provide a malicious image file to a system using ImageMagick.

Remediation:
To mitigate this issue, avoid processing untrusted YUV 4:2:2 image files with ImageMagick. If ImageMagick is used in automated workflows or server-side applications, consider implementing sandboxing mechanisms to limit the potential impact of processing malicious input. Ensure that ImageMagick instances are not exposed to untrusted input sources without proper validation and isolation.
ImageMagick: Memory leak leading to denial of service via image processing
CVE: CVE-2026-25969
Component: ImageMagick
CWE: CWE-772
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-24T01:33:00.362000+00:00

A flaw was found in ImageMagick, a software used for editing and manipulating digital images. This vulnerability, a memory leak, occurs when the software processes certain image files. Specifically, during image writing operations, if an error occurs, allocated memory is not properly released. A remote attacker could exploit this by providing a specially crafted image, leading to resource exhaustion and a denial of service (DoS), making the system or application unavailable to legitimate users.

Statement: The ImageMagick package in Red Hat Enterprise Linux 6 ELS and 7 ELS is affected by a MODERATE impact memory leak vulnerability. This flaw occurs when processing ASHLAR image files due to improper memory release during exception handling. Exploitation could lead to increased memory consumption.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
perf: Ensure swevent hrtimer is properly destroyed
CVE: CVE-2026-23014
Component: kernel
CWE: CWE-825
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-28T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's perf subsystem. When freeing a software event (swevent), the hrtimer used for sampling may still be active because perf_swevent_cancel_hrtimer() uses hrtimer_try_to_cancel() which can fail if the timer is currently executing. This leaves a dangling reference that can cause a use-after-free when the timer fires after the event structure is freed.

Statement: This race condition affects perf software events that use high-resolution timers for sampling. Exploitation requires the ability to create and destroy perf events rapidly, which requires CAP_PERFMON or CAP_SYS_ADMIN capabilities (or perf_event_paranoid sysctl allowing unprivileged access). The impact is a kernel crash or potential memory corruption.

Remediation:
Junrar: Remote code execution via path traversal when extracting crafted RAR archives
CVE: CVE-2026-28208
Component: com.github.junrar/junrar
CWE: CWE-22
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Release date: 2026-02-26T22:20:03.765000+00:00

Junrar is an open source java RAR archive library. Prior to version 7.5.8, a backslash path traversal vulnerability in `LocalFolderExtractor` allows an attacker to write arbitrary files with attacker-controlled content anywhere on the filesystem when a crafted RAR archive is extracted on Linux/Unix. This can often lead to remote code execution (e.g., overwriting shell profiles, source code, cron jobs, etc). Version 7.5.8 has a fix for the issue.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
net: mscc: ocelot: Fix crash when adding interface under a lag
CVE: CVE-2026-22982
Component: kernel
Severity: None
Release date: 2026-01-23T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: mscc: ocelot: Fix crash when adding interface under a lag

Commit 15faa1f67ab4 ("lan966x: Fix crash when adding interface under a lag")
fixed a similar issue in the lan966x driver caused by a NULL pointer dereference.
The ocelot_set_aggr_pgids() function in the ocelot driver has similar logic
and is susceptible to the same crash.

This issue specifically affects the ocelot_vsc7514.c frontend, which leaves
unused ports as NULL pointers. The felix_vsc9959.c frontend is unaffected as
it uses the DSA framework which registers all ports.

Fix this by checking if the port pointer is valid before accessing it.


Remediation:
timekeeping: Adjust the leap state for the correct auxiliary timekeeper
CVE: CVE-2026-23106
Component: kernel
CWE: CWE-820
Severity: Low
CVSS v3: 3.4/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-04T00:00:00+00:00

A locking violation was found in the Linux kernel's timekeeping subsystem. The __do_adjtimex() function incorrectly references tk_core instead of the passed auxiliary timekeeper when adjusting leap second state. This causes the core timekeeper's sequence lock to be written without holding its associated spinlock, violating the seqlock protocol and triggering lock debugging warnings.

Statement: This bug manifests as a kernel warning when clock_adjtime() is called on auxiliary timekeepers. While the immediate symptom is a lock debugging diagnostic warning, the incorrect update of the core timekeeper instead of the auxiliary one could cause time synchronization issues. The impact is primarily a warning message and potential time accuracy problems rather than a crash.

Remediation:
Istio: Authorization policy bypass via Envoy RBAC header matching with multiple header values
CVE: CVE-2026-31838
Component: istio
CWE: CWE-551
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Release date: 2026-03-10T21:58:53.354000+00:00

A flaw was found in Istio. This vulnerability in Envoy's Role-Based Access Control (RBAC) header matching could allow an attacker to bypass authorization policies. By crafting requests with multiple header values, an attacker could cause Envoy to misinterpret the header, leading to unauthorized access to protected services.


Remediation:
Blind Server-Side Request Forgery (SSRF) via HTTP Redirect Handling in Keycloak
CVE: CVE-2026-4366
Component: keycloak-services
CWE: CWE-918
Severity: Moderate
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Release date: 2026-03-18T00:00:00+00:00

A flaw was identified in Keycloak, an identity and access management solution, where it improperly follows HTTP redirects when processing certain client configuration requests. This behavior allows an attacker to trick the server into making unintended requests to internal or restricted resources. As a result, sensitive internal services such as cloud metadata endpoints could be accessed. This issue may lead to information disclosure and enable attackers to map internal network infrastructure.

Statement: MODERATE impact: Keycloak is vulnerable to a blind Server-Side Request Forgery (SSRF) due to improper handling of HTTP redirects during client configuration. An attacker can exploit this remotely without authentication or user interaction by crafting a `sector_identifier_uri` that redirects to internal resources, potentially leading to information disclosure and internal network reconnaissance.

Remediation:
To mitigate this vulnerability, restrict the outbound network access of the Keycloak instance. Configure firewall rules to prevent the Keycloak server from initiating connections to internal network segments, especially to well-known cloud metadata service IP addresses such as `169.254.169.254`. For example, on Red Hat Enterprise Linux, you can use `firewalld` to add a rich rule:
`sudo firewall-cmd --permanent --zone=public --add-rich-rule='rule family="ipv4" destination address="169.254.169.254" reject'`
`sudo firewall-cmd --reload`
This may impact other services if they legitimately rely on accessing these internal IPs. Additionally, ensure that any configured `sector_identifier_uri` values are thoroughly validated to only point to trusted, external URLs that do not perform redirects to internal resources.
Inappropriate implementation in PictureInPicture
CVE: CVE-2026-2318
Component: chromium-browser
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-10T00:00:00+00:00

Inappropriate implementation in PictureInPicture in Google Chrome prior to 145.0.7632.45 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability
CVE: CVE-2026-0775
Component: npmcli
CWE: CWE-732
Severity: Important
CVSS v3: 7.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-23T03:29:14.622000+00:00

npm cli Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of npm cli. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

The specific flaw exists within the handling of modules. The application loads modules from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of a target user. Was ZDI-CAN-25430.


Remediation:
btrfs: fix NULL pointer dereference in do_abort_log_replay()
CVE: CVE-2026-23043
Component: kernel
CWE: CWE-476
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A NULL pointer dereference vulnerability was found in the Linux kernel's Btrfs filesystem log replay code. When btrfs_alloc_path() fails in replay_one_buffer() due to memory allocation failure, wc->subvol_path is left NULL. Subsequently, btrfs_abort_log_replay() calls do_abort_log_replay() which unconditionally dereferences wc->subvol_path to print debug information, causing a kernel crash.

Statement: This vulnerability was identified by Coverity static analysis and occurs during Btrfs log replay when the system is under memory pressure. The crash happens in the error handling path when a path allocation fails during recovery operations. The impact is limited to denial of service during filesystem mount after an unclean shutdown.

Remediation:
Neo4j: Authentication context inheritance via excessive caching in SSO UserInfo endpoint
CVE: CVE-2026-1471
Component: neo4j
CWE: CWE-488
Severity: Low
CVSS v3: 4.3/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
Release date: 2026-03-11T16:30:24.053000+00:00

A flaw was found in Neo4j. Authenticated users can inherit the authentication context of the first user who authenticated after a system restart. This occurs due to excessive caching of authentication context in certain non-default configurations of the Single Sign-On (SSO) UserInfo endpoint. This could lead to unauthorized access to resources or actions intended for the initial user.

Statement: This LOW impact vulnerability affects Neo4j Enterprise edition versions prior to 2026.01.4. Authenticated users may inherit another user's authentication context due to excessive caching in SSO. Exploitation requires high complexity—non-default SSO configuration and timing relative to restart. Impact is limited since the attacker cannot control whose context they inherit. Red Hat products are affected if using vulnerable Neo4j versions with SSO UserInfo endpoint enabled.

Remediation:
minimatch: Denial of Service due to unbounded recursive backtracking via crafted glob patterns
CVE: CVE-2026-27903
Component: minimatch
CWE: CWE-1333
Severity: Moderate
CVSS v3: 5.8/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-26T01:06:32.856000+00:00

A flaw was found in minimatch, a utility for converting glob expressions into JavaScript regular expressions. A remote attacker can exploit this vulnerability by providing a specially crafted glob pattern containing multiple non-adjacent `**` (GLOBSTAR) segments. This can lead to unbounded recursive backtracking in the `matchOne()` function, causing a Denial of Service (DoS) by stalling the Node.js event loop for an extended period.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
net: gro: fix outer network offset
CVE: CVE-2026-23254
Component: kernel
Severity: Low
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-18T00:00:00+00:00

No description is available for this CVE.


Remediation:
Integer overflow in ANGLE
CVE: CVE-2026-4464
Component: chromium-browser
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-18T00:00:00+00:00

An integer overflow flaw was found in the ANGLE component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=487208468

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.

Remediation:
Vim: Information disclosure via heap-based buffer overflow in Emacs-style tags file parsing
CVE: CVE-2026-28418
Component: vim
CWE: CWE-125
Severity: Moderate
CVSS v3: 5.2/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
Release date: 2026-02-27T21:58:37.277000+00:00

A flaw was found in Vim. When processing a specially crafted Emacs-style tags file, a heap-based buffer overflow out-of-bounds read vulnerability allows an attacker to trick Vim into reading up to 7 bytes beyond its allocated memory boundary. This could lead to information disclosure or potentially affect the integrity of the application.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
FreeRDP: Arbitrary code execution via heap buffer overflow in GDI surface pipeline
CVE: CVE-2026-26955
Component: freerdp
CWE: CWE-805
Severity: Important
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-25T20:47:14.660000+00:00

A flaw was found in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). A malicious RDP server can exploit a heap buffer overflow vulnerability by sending a specially crafted graphics command to a FreeRDP client. This allows the server to write data outside of its intended memory region, potentially leading to arbitrary code execution on the client system. The vulnerability occurs because the client does not properly validate the dimensions of incoming graphics commands.

Statement: A malicous RDP server may lead a heap buffer overflow in FreeRDP when the client is using the GDI surface pipeline. This happens when the server send a maliciously crafted RDPGFX ClearCodec command. When interpreting the command FreeRDP fails to validate the whether rectangle described by it falls within the destination surface dimension allowing the attacker to overwrite the surface data buffer without any boundaries check. Depending on the memory layout of the freerdp client's process it's possible to corrupt adjacent points leading to a remote code execution or force the freerdp client to crash.

Remediation:
To mitigate this issue, avoid connecting to untrusted or unverified RDP servers. Users should only establish RDP connections with known and trusted servers. If connecting to untrusted servers is unavoidable, consider using a sandbox environment or a dedicated, isolated system for such connections to limit potential impact.
FreeRDP heap-buffer-overflow
CVE: CVE-2026-22853
Component: freerdp
CWE: CWE-787
Severity: Important
CVSS v3: 8.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-01-14T17:46:50.159000+00:00

A heap based buffer overflow flaw has been discovered in FreeRDP. In affected versions RDPEAR’s NDR array reader does not perform bounds checking on the on‑wire element count and can write past the heap buffer allocated from hints, causing a heap buffer overflow in ndr_read_uint8Array.

Statement: Red Hat products in their default configuration employ Address Space Layout Randomization (ASLR) which drastically increases the complexity of the successful exploitation of this flaw.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.