huzaifas-sidhpurwala/RedHat-security-VeX huggingface dataset:
Memory Leak Leading to Local Denial of Service in xmllint Interactive Shell
CVE: CVE-2026-1757
Component: libxml2
CWE: CWE-401
Severity: Moderate
CVSS v3: 6.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-02T00:00:00+00:00

A flaw was identified in the interactive shell of the xmllint utility, part of the libxml2 project, where memory allocated for user input is not properly released under certain conditions. When a user submits input consisting only of whitespace, the program skips command execution but fails to free the allocated buffer. Repeating this action causes memory to continuously accumulate. Over time, this can exhaust system memory and terminate the xmllint process, creating a denial-of-service condition on the local system.

Statement: This MODERATE impact flaw in the `xmllint` interactive shell allows a local attacker to cause a denial of service. By repeatedly providing whitespace-only input, an attacker can trigger a memory leak, leading to resource exhaustion and process termination. Exploitation requires local access to the system and interaction with the `xmllint` interactive shell.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
systemd: Privilege escalation via improper access control in RegisterMachine D-Bus method
CVE: CVE-2026-4105
Component: systemd
CWE: CWE-284
Severity: Moderate
CVSS v3: 6.7/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-03-13T00:00:00+00:00

A flaw was found in systemd. The systemd-machined service contains an Improper Access Control vulnerability due to insufficient validation of the class parameter in the RegisterMachine D-Bus (Desktop Bus) method. A local unprivileged user can exploit this by attempting to register a machine with a specific class value, which may leave behind a usable, attacker-controlled machine object. This allows the attacker to invoke methods on the privileged object, leading to the execution of arbitrary commands with root privileges on the host system.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate. The issue allows a local privilege escalation to root through the systemd-machined service when specific environmental conditions are met. Successful exploitation requires an unprivileged user to be logged into an active graphical desktop session on a system where systemd-machined is present. Additionally, the affected component is not typically installed by default on many systems and terminal-only or remote sessions (such as SSH) are not affected.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
net: wwan: t7xx: fix potential skb->frags overflow in RX path
CVE: CVE-2026-23172
Component: kernel
Severity: None
Release date: 2026-02-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

net: wwan: t7xx: fix potential skb->frags overflow in RX path

When receiving data in the DPMAIF RX path,
the t7xx_dpmaif_set_frag_to_skb() function adds
page fragments to an skb without checking if the number of
fragments has exceeded MAX_SKB_FRAGS. This could lead to a buffer overflow
in skb_shinfo(skb)->frags[] array, corrupting adjacent memory and
potentially causing kernel crashes or other undefined behavior.

This issue was identified through static code analysis by comparing with a
similar vulnerability fixed in the mt76 driver commit b102f0c522cf ("mt76:
fix array overflow on receiving too many fragments for a packet").

The vulnerability could be triggered if the modem firmware sends packets
with excessive fragments. While under normal protocol conditions (MTU 3080
bytes, BAT buffer 3584 bytes),
a single packet should not require additional
fragments, the kernel should not blindly trust firmware behavior.
Malicious, buggy, or compromised firmware could potentially craft packets
with more fragments than the kernel expects.

Fix this by adding a bounds check before calling skb_add_rx_frag() to
ensure nr_frags does not exceed MAX_SKB_FRAGS.

The check must be performed before unmapping to avoid a page leak
and double DMA unmap during device teardown.


Remediation:
Undici: Denial of Service via invalid WebSocket permessage-deflate extension parameter
CVE: CVE-2026-2229
Component: undici
CWE: CWE-248
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-03-12T20:27:05.600000+00:00

A flaw was found in the undici WebSocket client. A remote malicious server can exploit this vulnerability by sending a WebSocket frame with an invalid `server_max_window_bits` parameter within the permessage-deflate extension. This improper validation causes the client's Node.js process to terminate, leading to a denial-of-service (DoS) condition for the client.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Next.js: null origin can bypass dev HMR websocket CSRF checks
CVE: CVE-2026-27977
Component: next.js
CWE: CWE-346
Severity: Moderate
CVSS v3: 4.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-03-17T23:56:24.631000+00:00

A CSRF check bypass flaw has been discovered in Next.js. In the `next dev`, cross-site protection for internal websocket endpoints could treat `Origin: null` as a bypass case even if `allowedDevOrigins` is configured, allowing privacy-sensitive/opaque contexts (for example sandboxed documents) to connect unexpectedly. If a dev server is reachable from attacker-controlled content, an attacker may be able to connect to the HMR websocket channel and interact with dev websocket traffic. This affects development mode only. Apps without a configured `allowedDevOrigins` still allow connections from any origin.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
can: etas_es58x: allow partial RX URB allocation to succeed
CVE: CVE-2026-23037
Component: kernel
Severity: None
Release date: 2026-01-31T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

can: etas_es58x: allow partial RX URB allocation to succeed

When es58x_alloc_rx_urbs() fails to allocate the requested number of
URBs but succeeds in allocating some, it returns an error code.
This causes es58x_open() to return early, skipping the cleanup label
'free_urbs', which leads to the anchored URBs being leaked.

As pointed out by maintainer Vincent Mailhol, the driver is designed
to handle partial URB allocation gracefully. Therefore, partial
allocation should not be treated as a fatal error.

Modify es58x_alloc_rx_urbs() to return 0 if at least one URB has been
allocated, restoring the intended behavior and preventing the leak
in es58x_open().


Remediation:
p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters
CVE: CVE-2026-2100
Component: p11-kit
CWE: CWE-824
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-02-06T08:08:00+00:00

No description is available for this CVE.

Statement: This MODERATE impact flaw in p11-kit allows a remote attacker to cause an application level denial of service or unpredictable system states. Exploitation occurs when the C_DeriveKey function is called on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This affects Red Hat Enterprise Linux 9.8 and 10.2, Fedora 42 and 43, and Red Hat In-Vehicle OS 2.0. Other Red Hat products, including OpenShift Container Platform and various RHEL versions, are not affected as the vulnerable code is not present.

Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
thunderbird: Information disclosure, mitigation bypass in the Settings UI component
CVE: CVE-2026-2803
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:31.491000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Information disclosure, mitigation bypass in the Settings UI component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
protobuf: Protobuf: Denial of Service due to recursion depth bypass
CVE: CVE-2026-0994
Component: python
CWE: CWE-674
Severity: Important
CVSS v3: 7.5/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-01-23T14:55:16.876000+00:00

A flaw was found in protobuf. A remote attacker can exploit this denial-of-service (DoS) vulnerability by supplying deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to the exhaustion of Python’s recursion stack and causing a `RecursionError`, which results in a denial of service.

Statement: This vulnerability is rated Important for Red Hat products. The flaw in `protobuf` allows a remote attacker to trigger a denial-of-service by providing specially crafted, deeply nested `google.protobuf.Any` messages to the `google.protobuf.json_format.ParseDict()` function. This bypasses the intended recursion depth limit, leading to resource exhaustion and application crashes.

Remediation:
For details on how to apply this update, refer to Ansible Automation Platform documentation.
For details on how to apply this update, refer to Ansible Automation Platform documentation.
For more information visit https://access.redhat.com/errata/RHSA-2026:3461
For more information visit https://access.redhat.com/errata/RHSA-2026:3462
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Keras: Information disclosure via arbitrary file read in model loading mechanism
CVE: CVE-2026-1669
Component: keras
CWE: CWE-73
Severity: Important
CVSS v3: 6.4/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Release date: 2026-02-11T22:10:10.031000+00:00

A flaw was found in Keras. A remote attacker can exploit an arbitrary file read vulnerability in the model loading mechanism (HDF5 integration) by providing a specially crafted .keras model file that utilizes HDF5 external dataset references. This allows the attacker to read local files and disclose sensitive information.

Statement: This IMPORTANT flaw in Keras allows for arbitrary file read operations. Red Hat OpenShift AI is impacted, as the vulnerability resides in the model loading mechanism when processing crafted `.keras` model files that leverage HDF5 external dataset references. This could lead to sensitive information disclosure on affected systems.

Remediation:
Nodejs network segmentation bypass
CVE: CVE-2026-21636
Component: nodejs
CWE: CWE-281
Severity: Moderate
CVSS v3: 5.7/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Release date: 2026-01-20T20:41:55.700000+00:00

A flaw in Node.js's permission model allows Unix Domain Socket (UDS) connections to bypass network restrictions when `--permission` is enabled. Even without `--allow-net`, attacker-controlled inputs (such as URLs or socketPath options) can connect to arbitrary local sockets via net, tls, or undici/fetch. This breaks the intended security boundary of the permission model and enables access to privileged local services, potentially leading to privilege escalation, data exposure, or local code execution.

* The issue affects users of the Node.js permission model on version v25.

In the moment of this vulnerability, network permissions (`--allow-net`) are still in the experimental phase.


Remediation:
GIMP: Remote Code Execution via out-of-bounds write in XWD file parsing
CVE: CVE-2026-2045
Component: gimp
CWE: CWE-787
Severity: Important
CVSS v3: 7.3/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-20T22:23:32.645000+00:00

A flaw was found in GIMP. The specific flaw exists within the parsing of XWD files. The issue results from the lack of proper validation of user-supplied data, which can result in a write past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Vim: Arbitrary code execution via OS command injection in the netrw plugin
CVE: CVE-2026-28417
Component: vim
CWE: CWE-78
Severity: Moderate
CVSS v3: 4.3/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Release date: 2026-02-27T21:54:35.196000+00:00

A flaw was found in Vim, an open-source command-line text editor. Specifically, an operating system (OS) command injection vulnerability exists in the `netrw` standard plugin. A remote attacker could exploit this by tricking a user into opening a specially crafted URL, such as one using the `scp://` protocol handler. Successful exploitation allows the attacker to execute arbitrary shell commands with the same privileges as the Vim process, leading to potential system compromise.


Remediation:
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
CVE: CVE-2026-0756
Component: github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability
Release date: 2026-01-09T16:21:43.565000+00:00

github-kanban-mcp-server execAsync Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of github-kanban-mcp-server. Authentication is not required to exploit this vulnerability.

The specific flaw exists within the handling of the create_issue parameter. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the service account. Was ZDI-CAN-27784.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation:
sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT
CVE: CVE-2026-23125
Component: kernel
CWE: CWE-824
Severity: Moderate
CVSS v3: 5.6/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-14T00:00:00+00:00

A NULL pointer dereference flaw was found in the Linux kernel's SCTP implementation. When SCTP-AUTH key initialization fails during INIT_ACK processing, the association's shared key (asoc->shkey) remains NULL while authentication capability flags are already set. If a DATA chunk is subsequently queued and transmitted with the COOKIE_ECHO, sctp_packet_bundle_auth() dereferences the NULL shkey pointer, causing a kernel crash.

Statement: Exploitation requires an SCTP association using authentication where the shared key initialization fails due to resource constraints or other errors. While this can be triggered via network traffic during connection establishment, it requires specific failure conditions to occur during INIT_ACK processing.

Remediation:
To mitigate this issue, prevent the sctp module from being loaded. See https://access.redhat.com/solutions/41278 for instructions on how to blacklist kernel modules.
virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb (incomplete fix for CVE-2024-7730)
CVE: CVE-2026-3195
Component: qemu-kvm
CWE: CWE-122
Severity: Important
CVSS v3: 7.3/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Release date: 2026-02-20T00:00:00+00:00

A flaw was found in QEMU. When reading input audio in the virtio-snd device input callback, the `virtio_snd_pcm_in_cb` function did not check whether the iov could fit the data buffer, potentially leading to a heap out-of-bounds write. This issue exists due to an incomplete fix for CVE-2024-7730.

Statement: The `qemu-kvm` packages as shipped with Red Hat Enterprise Linux are not affected by this CVE. The virtio-snd device is disabled at build-time in RHEL, effectively removing the attack surface.

Remediation:
Linux kernel: Denial of Service in authencesn due to too-short AAD
CVE: CVE-2026-23060
Component: kernel
CWE: CWE-1284
Severity: Moderate
CVSS v3: 6.4/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Release date: 2026-02-04T00:00:00+00:00

A flaw was found in the Linux kernel's authencesn authenticated encryption with associated data implementation. A remote attacker can exploit this vulnerability by providing a specially crafted Associated Additional Data with a length shorter than the expected minimum. This can lead to a NULL pointer dereference, causing a kernel panic and resulting in a Denial of Service.

Statement: A denial of service can occur in the authencesn AEAD implementation when the associated data length is shorter than the minimum ESP ESN AAD size. With assoclen less than 8 the decrypt path can advance beyond the end of the destination scatterlist and later hit a NULL pointer dereference in scatterwalk_map_and_copy which can panic the kernel. For the CVSS the PR is N in the paranoid rating because an attacker does not need local privileges if they can reach a kernel user of authencesn with attacker controlled AAD. This is plausibly network reachable in deployments that use IPsec ESP with ESN or other kernel paths that feed ESP like AAD into authencesn. Impact is denial of service via kernel crash. There is no indication of information disclosure or privilege escalation from this fix.

Remediation:
To mitigate this issue, prevent module authenc from being loaded. Please see https://access.redhat.com/solutions/41278 for how to blacklist a kernel module to prevent it from loading automatically.
static handler component cache can be manipulated to deny the access to static files
CVE: CVE-2026-1002
Component: io.vertx/vertx-core
CWE: CWE-444
Severity: Moderate
CVSS v3: 5.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Release date: 2026-01-15T20:50:25.642000+00:00

A flaw was found in Vert.x. The Web static handler component cache can be manipulated to deny the access to static files served by the handler using specifically crafted request URIs, preventing legitimate users from accessing static files with an HTTP 404 response.

Statement: This vulnerability allows a remote attacker to block access to specific static files, such as images, CSS or HTML files. However, the underlying Vert.x server, the API endpoints and other non-cached resources are not affected. Due to this reason, this issue has been rated with a moderate severity.

Remediation:
Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to: https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.0/html/jboss_eap_xp_5.0_upgrade_and_migration_guide/index
Before applying the update, make sure all previously released errata relevant to your system have been applied. Also, back up your existing installation, including all applications, configuration files, databases and database settings. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258
Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258
To mitigate this vulnerability, consider disabling the static handler cache by configuring the StaticHandler instance with setCachingEnabled(false), for example:

~~~
StaticHandler staticHandler = StaticHandler.create().setCachingEnabled(false);
~~~
thunderbird: Mitigation bypass in the DOM: Security component
CVE: CVE-2026-2784
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-02-24T13:33:17.554000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Mitigation bypass in the DOM: Security component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
Step CA: Unauthenticated certificate issuance via SCEP Update Request
CVE: CVE-2026-30836
Component: github.com/smallstep/certificates
CVSS v3: 10/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Release date: 2026-03-19T20:37:05.757000+00:00

A flaw was found in Step CA, an online certificate authority. A remote attacker can exploit this vulnerability by sending an unauthenticated SCEP (Simple Certificate Enrollment Protocol) Update Request. This allows the attacker to issue unauthorized certificates, potentially leading to a compromise of the certificate management system and enabling further attacks such as impersonation or man-in-the-middle attacks.

Statement: No Red Hat products are impacted. The affected component (Step CA) is not used or provided by any products.

Remediation:
thunderbird: Incorrect boundary conditions in the Graphics component
CVE: CVE-2026-0886
Component: firefox
Severity: Moderate
CVSS v3: 6.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Release date: 2026-01-13T13:30:57.400000+00:00

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue:
Incorrect boundary conditions in the Graphics component

Statement: Red Hat Product Security rates the severity of this flaw as determined by the Mozilla Foundation Security Advisory.

Remediation:
yt-dlp: Arbitrary command injection via maliciously crafted URL when --netrc-cmd is used
CVE: CVE-2026-26331
Component: yt-dlp
CVSS v3: 8.7/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Release date: 2026-02-24T02:23:40.858000+00:00

A flaw was found in yt-dlp, a command-line audio/video downloader. When the `--netrc-cmd` command-line option is enabled, a remote attacker can exploit a maliciously crafted URL to achieve arbitrary command injection. This allows the attacker to execute unauthorized commands on the user's system, potentially leading to a complete compromise. This vulnerability primarily affects users who utilize the `--netrc-cmd` feature.

Statement: This is an IMPORTANT arbitrary command injection flaw in yt-dlp. The vulnerability occurs when the `--netrc-cmd` command-line option or `netrc_cmd` Python API parameter is actively used. Systems where this specific feature is not enabled or utilized are not affected by this issue.

Remediation:
Memray-generated HTML reports vulnerable to Stored XSS via unescaped command-line metadata
CVE: CVE-2026-32722
Component: bloomberg.github.io/memray
CVSS v3: 3.5/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Release date: 2026-03-18T21:25:21.495000+00:00

No description is available for this CVE.

Statement: Red Hat Product Security has determined that this vulnerability does not affect any currently supported Red Hat product. This assessment may evolve based on further analysis and discovery. For more information about this vulnerability and the products it affects, please see the linked references.

Remediation: