huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-5244: binutils: GNU Binutils ld elflink.c elf_gc_sweep memory corruption
Component: binutils
Severity: Moderate
CWE: CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer)
CVSS v3: 4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-05-27T13:00:14.904000+00:00

A vulnerability was found in GNU Binutils 2.40 to version 2.44 and affects the elf_gc_sweep function of the bfd/elflink.c file of the component ld. The manipulation leads to memory corruption and a program crash. An attacker must have local access to exploit this vulnerability.

Statement: The vulnerability relies upon the linker's -w command line option, which disables warnings and forces the linker to continue working even though it knows that it cannot produce valid output.  With this option enabled a code path is exposed which leads to a dereferencing of a NULL pointer and the segmentation fault. The -w command line option was introduced with the 2.40 release.

Affected upstream versions: 2.0, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7, 2.8, 2.9, 2.10, 2.11, 2.12, 2.13, 2.14, 2.15, 2.16, 2.17, 2.18, 2.19
Upstream repository: https://sourceware.org/git/binutils-gdb.git
Upstream fix commit: d1458933830456e54223d9fc61f0d9b3a19256f5
CVE-2025-52565: runc: container escape with malicious config due to /dev/console mount and related races
Component: runc
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Public date: 2025-11-05T00:00:00+00:00

A flaw was found in runc. CVE-2025-52565 is very similar in concept and application toCVE-2025-31133, except that it exploits a flaw in /dev/console
bind-mounts. When creating the /dev/console bind-mount (to /dev/pts/$n), if an attacker replaces /dev/pts/$n with a symlink then runc will bind-mount the symlink target over /dev/console.

Statement: Red Hat considers this as an Important flaw since the impact is limited to local attack with minimal privileges in order to jeopardize the environment.

Affected upstream versions: >= 1.0.0-rc3, < 1.2.8, >= 1.3.0-rc.1, < 1.3.3, >= 1.4.0-rc.1, < 1.4.0-rc.3
Fixed upstream versions: v1.5.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: 01de9d65dc72f67b256ef03f9bfb795a2bf143b4
CVE-2025-5278: coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification
Component: coreutils
Severity: Moderate
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L)
Public date: 2025-05-27T00:00:00+00:00

A flaw was found in GNU Coreutils. The sort utility's begfield() function is vulnerable to a heap buffer under-read. The program may access memory outside the allocated buffer if a user runs a crafted command using the traditional key format. A malicious input could lead to a crash or leak sensitive data.

Statement: The severity of this issue is considered Moderate rather than Critical because successful exploitation requires the use of the traditional key specification syntax with an exceptionally large character position value, which is uncommon in typical usage. Although the vulnerability can lead to a heap buffer overflow resulting in a read one byte before the allocated buffer, it does not enable code execution, privilege escalation, or direct compromise of data confidentiality or integrity. The impact is therefore primarily limited to potential service disruption due to application crashes.

Furthermore, default RHEL configurations such as SELinux enforcement, ASLR, and memory protections reduce the likelihood of exploitation and limit the scope of any resulting impact. These safeguards, along with typical system usage patterns that do not commonly invoke the vulnerable code path, restrict exploitability in default and hardened environments. Consequently, the vulnerability’s overall security impact is mitigated compared to flaws that allow immediate code execution or broader compromise across system components.

Affected upstream versions: 7.2 < 9.8
Fixed upstream versions: 0:8.32-41.el9_8, 0:9.5-8.el10_2, 1782498923, 1782501180, 1782501195, 1782501196, 1782501200, 1782501220, 1782510941, 1782756541, 1782890503, 1783539156, 1784794289, 1784794778, 1784794818, 1784795076, 1784795112, 1784821670, 9.8
Upstream repository: https://cgit.git.savannah.gnu.org/cgit/coreutils.git
Upstream fix commit: 8c9602e3a145e9596dc1a63c6ed67865814b6633
CVE-2025-52881: runc: opencontainers/selinux: container escape and denial of service due to arbitrary write gadgets and procfs write redirects
Component: runc
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Public date: 2025-11-05T09:00:00+00:00

A flaw was found in runc. This attack is a more sophisticated variant of CVE-2019-16884, which was a flaw that allowed an attacker to trick runc into writing the LSM process labels for a container process into a dummy tmpfs file and thus not apply the correct LSM labels to the container process. The mitigation applied for CVE-2019-16884 was fairly limited and effectively only caused runc to verify that when we write LSM labels that those labels are actual procfs files.

Statement: Red Hat considers this as an Important flaw since the impact is limited to local attack with minimal privileges in order to jeopardize the environment.

Affected upstream versions: <= 1.2.7, < 1.2.8, <= 1.3.2, < 1.3.3, <= 1.4.0-rc.2, < 1.4.0-rc.3
Fixed upstream versions: v1.5.0
Upstream repository: https://github.com/opencontainers/runc
Upstream fix commit: ff94f9991bd32076c871ef0ad8bc1b763458e480
CVE-2025-5302: llama_index: Denial of Service (DOS) in JSONReader in run-llama/llama_index
Component: llama_index
Severity: Important
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2025-08-25T15:03:18.097000+00:00

A flaw was found in the JSONReader component of the llama_index Python package, where the _depth_first_yield function has no limit on the recursive number of times it is called. This vulnerability causes Python to reach its maximum recursive depth when parsing deeply nested JSON files. The program crashes, resulting in a Denial of Service. This process consumes significant CPU and memory resources while attempting to handle the nesting. This issue was fixed in version 0.12.38.

Statement: This vulnerability is marked as Important rather than Moderate because it allows the attacker to potentially coordinate the attack through a network required over the whole user base of llama-index package. This DoS attack is easy to reproduce and only requires sending the malicious deeply nested JSON files which could be transmitted to lots of users of this package and trigger an uncontrolled recursion.

Affected upstream versions: unspecified < 0.12.38
Fixed upstream versions: 0.12.38
Upstream repository: https://github.com/run-llama/llama_index
Upstream fix commit: c032843a02ce38fd8f284b2aa5a37fd1c17ae635
CVE-2025-53547: helm.sh/helm/v3: Helm Chart Code Execution
Component: helm.sh/helm/v3
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 8.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:H)
Public date: 2025-07-08T21:39:59.075000+00:00

A command injection vulnerability has been identified in Helm, a package manager for Kubernetes. An attacker can craft a malicious Chart.yaml file with specially linked dependencies in a Chart.lock file. If the Chart.lock file is a symbolic link to an executable file, such as a shell script, and a user attempts to update the dependencies, the crafted content is written to the symlinked file and executed. This can lead to local code execution on the system. This issue has been patched in Helm version 3.18.4, and users should update to this version to mitigate the risk.

Statement: Although GitOps ships Helm, this product is not vulnerable to this vulnerability as ArgoCD doesn't use helm dependency update. Additionally ArgoCD scans the whole repository searching for symbolic links that eventually points to a out of bounds destination, this later feature ensures ArgoCD is not vulnerable for this issue. Given this information ArgoCD won't be updated to pull a new version of Helm in other versions than the currently latest upstream one.

Affected upstream versions: < 3.18.4
Fixed upstream versions: v4.0.0
Upstream repository: https://github.com/helm/helm
Upstream fix commit: 4b8e61093d8f579f1165cdc6bd4b43fa5455f571
CVE-2025-53643: aiohttp: AIOHTTP HTTP Request/Response Smuggling
Component: aiohttp
Severity: Low
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)
Public date: 2025-07-14T20:17:18.247000+00:00

A request smuggling flaw was found in the aiohttp python library. If a pure Python version of aiohttp is installed, without the usual C extensions, for example, or if AIOHTTP_NO_EXTENSIONS is enabled, an attacker can execute a request smuggling attack to bypass certain firewalls or proxy protections.


Affected upstream versions: < 3.12.14
Fixed upstream versions: v3.12.14
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: e8d774f635dc6d1cd3174d0e38891da5de0e2b6a
CVE-2025-53864: com.nimbusds/nimbus-jose-jwt: Uncontrolled recursion in Connect2id Nimbus JOSE + JWT
Component: com.nimbusds/nimbus-jose-jwt
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L)
Public date: 2025-07-11T00:00:00+00:00

A denial of service flaw has been discovered in Connect2id Nimbus JOSE + JWT. This issue can allow a remote attacker to cause a denial of service via a deeply nested JSON object supplied in a JWT claim set.


Affected upstream versions: <= gson-parent-2.11.0
Fixed upstream versions: 10.0.2
Upstream repository: https://github.com/google/gson
Upstream fix commit: 1039427ff0100293dd3cf967a53a55282c0fef6b
CVE-2025-53905: vim: Vim path traversial
Component: vim
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L)
Public date: 2025-07-15T20:48:34.764000+00:00

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive.


Affected upstream versions: < 9.1.1552
Fixed upstream versions: v9.1.1552
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 87757c6b0a4b2c1f71c72ea8e1438b8fb116b239
CVE-2025-53906: vim: Vim path traversal
Component: vim
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 4.1 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:L)
Public date: 2025-07-15T20:52:40.137000+00:00

A path traversal flaw was found in Vim. Successful exploitation can lead to overwriting sensitive files or placing executable code in privileged locations, depending on the permissions of the process editing the archive.


Affected upstream versions: < 9.1.1551
Fixed upstream versions: v9.1.1551
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 586294a04179d855c3d1d4ee5ea83931963680b8
CVE-2025-54349: iperf3: iperf Heap Buffer Overflow
Component: iperf3
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L)
Public date: 2025-08-03T00:00:00+00:00

A flaw was found in iperf3. An off-by-one error in the `iperf_auth.c` file leads to a heap-based buffer overflow, potentially allowing a network attacker to trigger an application-level denial of service. This overflow occurs during the processing of authentication data. The vulnerability can only be exploited with direct network access.


Affected upstream versions: <= 3.19
Fixed upstream versions: 3.19.1
Upstream repository: https://github.com/esnet/iperf
Upstream fix commit: 4e5313bab0b9b3fe03513ab54f722c8a3e4b7bdf
CVE-2025-54386: traefik: Traefik's Client Plugin is Vulnerable to Path Traversal, Arbitrary File Overwrites and Remote Code Execution
Component: traefik
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 6.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-08-01T23:32:21.747000+00:00

A flaw was found in Traefik's plugin installation mechanism. This vulnerability allows remote code execution, privilege escalation, persistence, or application-level denial of service via a crafted ZIP archive exploiting a path traversal vector.


Affected upstream versions: <= 2.11.27, < 2.11.28, <= 3.0.0, < 3.4.5, >= 3.5.0-rc1, < 3.5.0-rc2
Fixed upstream versions: v2.11.28
Upstream repository: https://github.com/traefik/traefik
Upstream fix commit: 5ef853a0c53068f69a6c229a5815a0dc6e0a8800
CVE-2025-54389: aide: improper output neutralization enables bypassing
Component: aide
Severity: Important
CWE: CWE-117 (Improper Output Neutralization for Logs)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N)
Public date: 2025-08-14T00:00:00+00:00

A flaw was found in AIDE. This flaw allows an attacker to craft a malicious filename by including terminal escape sequences to hide the addition or removal of the file from the report and tamper with the log output. A local user may exploit this to bypass AIDE's detection of malicious files. Additionally, the output of extended attribute key names and symbolic links targets is also not properly neutralized.


Affected upstream versions: < 0.19.2
Fixed upstream versions: v0.19.2
Upstream repository: https://github.com/aide/aide
Upstream fix commit: 64c8f32b0349c33fb8382784af468338078851f9
CVE-2025-54419: @node-saml/node-saml: Node-SAML Signature Verification Vulnerability
Component: @node-saml/node-saml
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 7.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-07-28T19:47:46.584000+00:00

A signature verification flaw was found in the npm @node-saml/node-saml library. This flaw allows an attacker who has access to a validly signed document from the identity provider (IdP) to alter the content of the document, modify the details within the document, and have the modifications be accepted.

Statement: This is a Important impact authn-bypass, not a Moderate bug, because it breaks the core trust boundary of SAML: the service provider (SP) makes authorization decisions based on an assertion it believes is protected by the IdP’s XML signature. In @node-saml/node-saml ≤5.0.1, the library verifies the signature over one part of the response but then parses/uses fields from the original, unsigned document, a classic signature-wrapping/mismatch flaw. An attacker who possesses any validly signed SAML response (e.g., their own login, a captured response, or one from a lower-privileged account) can alter critical elements—such as the Subject/NameID (e.g., drop a character to map to a different user), group/role attributes, AuthnContext, or Conditions—without invalidating the signature, and the SP will accept the modified values. That enables account takeover, privilege escalation, MFA/step-up bypass (via AuthnContext changes), and policy circumvention across every SP relying on this library. The only prerequisite is access to a single signed response; no IdP compromise is required.

Affected upstream versions: = 5.0.1
Fixed upstream versions: v5.1.0
Upstream repository: https://github.com/node-saml/node-saml
Upstream fix commit: 31ead9411ebc3e2385086fa9149b6c17732bca10
CVE-2025-54574: squid-cache: Squid Buffer Overflow
Component: squid-cache
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 8.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L)
Public date: 2025-08-01T18:02:19.117000+00:00

A heap-based buffer overflow flaw was found in the Squid caching proxy. When processing the Uniform Resource Name (URNs), specific conditions can lead to remote code execution.

Statement: This vulnerability is Important because the heap-based buffer overflow occurs during URN processing in Squid’s core request-handling path, which is exposed to untrusted, remote input. Unlike flaws that merely cause a service crash, this defect allows an attacker to manipulate heap memory structures, potentially achieving arbitrary code execution within the Squid process context. Since Squid often runs with elevated privileges and serves as a gateway between internal and external networks, successful exploitation could provide a remote attacker with direct control over the proxy server, enabling them to pivot into internal systems, intercept sensitive traffic, or alter cached content.

Affected upstream versions: < 6.4
Fixed upstream versions: SQUID_6_4
Upstream repository: https://github.com/squid-cache/squid
Upstream fix commit: a27bf4b84da23594150c7a86a23435df0b35b988
CVE-2025-54874: openjpeg: OpenJPEG OOB heap memory write
Component: openjpeg
Severity: Important
CWE: CWE-457 (Use of Uninitialized Variable)
CVSS v3: 8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L)
Public date: 2025-08-05T14:33:17.323000+00:00

An out-of-bounds heap memory write (OOB) flaw was found in OpenJPEG. A call to opj_jp2_read_header may lead to an OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.

Statement: This vulnerability is Important rather than Moderate because it allows a malformed or truncated data stream to trigger a heap-based out-of-bounds (OOB) write, which directly corrupts memory. Unlike read-based issues or null dereference crashes that typically lead to denial of service, an OOB write has the potential to alter program control flow, leading to arbitrary code execution under certain conditions. The affected pointer p_image is dereferenced without verifying the success of the header parsing routine, and if it's left uninitialized due to a parsing failure, writing to it results in undefined behavior.

Affected upstream versions: >=  2.5.1, <= 2.5.3
Fixed upstream versions: v2.5.4
Upstream repository: https://github.com/uclouvain/openjpeg
Upstream fix commit: f809b80c67717c152a5ad30bf06774f00da4fd2d
CVE-2025-55190: github.com/argoproj/argo-cd: Project API Token Exposes Repository Credentials
Component: github.com/argoproj/argo-cd
Severity: Important
CWE: CWE-522 (Insufficiently Protected Credentials)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-04T00:00:00+00:00

An information leak was discovered in how Argo CD handles API tokens. The project details API endpoint could provide unintentional access to sensitive repository credentials.

Statement: This vulnerability has Important impact as exploitation requires some privileges granted by the system. An attacker would either need the ability to create an API token (via having valid login credentials) or to have stolen an API token from a legitimate user. It does not grant full control over the system, attackers can only tamper with the project(s) associated with an API token.

Affected upstream versions: >= 2.13.0, < 2.13.9, >= 2.14.0, < 2.14.16, >= 3.0.0, < 3.0.14, >= 3.1.0-rc1, < 3.1.2
Fixed upstream versions: v3.2.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: e8f86101f5378662ae6151ce5c3a76e9141900e8
CVE-2025-55191: github.com/argoproj/argo-cd/v2: github.com/argoproj/argo-cd/v3: Argo CD race condition leading to crash
Component: github.com/argoproj/argo-cd/v2
Severity: Moderate
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-09-30T22:52:19.838000+00:00

A race condition has been discovered in the Argo CD GitOps tool. This race condition is located in the repository credentials handler that can cause the Argo CD server to panic and crash when concurrent operations are performed on the same repository URL. A valid API token with repositories resource permissions (create, update, or delete actions) is required to trigger the race condition.

Statement: The availability risk of this vulnerability is limited to the Argo CD server itself. The host system running Argo CD is not at risk.

Affected upstream versions: >= 2.1.0, < 2.14.20, = 3.2.0-rc1, >= 3.1.0-rc1, < 3.1.8, >= 3.0.0-rc1, < 3.0.19
Fixed upstream versions: v3.3.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 701bc50d01c752cad96185f848088d287a97c7b7
CVE-2025-55198: helm.sh/helm/v3: Helm YAML Parsing Panic Vulnerability
Component: helm.sh/helm/v3
Severity: Moderate
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2025-08-13T23:23:56.780000+00:00

A flaw was found in helm.sh/helm/v3. Improper validation of type errors during parsing of Chart.yaml and index.yaml files can trigger a panic. A remote attacker, requiring user interaction, can trigger this panic via a malformed chart file. This can lead to an application level denial of service.


Affected upstream versions: < 3.18.5
Fixed upstream versions: v3.18.5
Upstream repository: https://github.com/helm/helm
Upstream fix commit: ec5f59e2db56533d042a124f5bae54dd87b558e6
CVE-2025-55199: helm.sh/helm/v3: Helm Chart JSON Schema Denial of Service
Component: helm.sh/helm/v3
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2025-08-13T23:23:43.304000+00:00

A flaw was found in helm.sh/helm/v3. A maliciously crafted JSON Schema file can trigger excessive memory consumption during Helm Chart validation, leading to an out-of-memory (OOM) termination. A remote attacker, requiring user interaction to provide the crafted file, can trigger this condition. This issue results in an application level denial of service affecting the Helm process.


Affected upstream versions: < 3.18.5
Fixed upstream versions: v3.18.5
Upstream repository: https://github.com/helm/helm
Upstream fix commit: b78692c18f0fb38fe5ba4571a674de067a4c53a5
CVE-2025-55668: org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve
Component: org.apache.tomcat/tomcat-catalina
Severity: Moderate
CWE: CWE-384 (Session Fixation)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2025-08-13T13:21:35.743000+00:00

A session fixation vulnerability has been identified in Apache Tomcat, affecting its rewrite functionality. If the rewrite valve is enabled for a web application, an attacker can craft a specific URL. If a victim clicks on this malicious URL, their subsequent interaction with the resource will occur within the context of the attacker's session. This could allow an attacker to hijack the victim's session and perform actions on their behalf.


Affected upstream versions: 11.0.0-M1 <= 11.0.7, 10.1.0-M1 <= 10.1.41, 9.0.0.M1 <= 9.0.105
Fixed upstream versions: 10.1.42
Upstream repository: https://github.com/apache/tomcat
Upstream fix commit: 8621e4c6ba2c916a41eb34cb0f781171ead33fb6