huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-48801: linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability
Component: linkify-it
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-14T20:03:56.430000+00:00

A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package's primary public API, has an algorithmic complexity of O(N²) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.

Statement: This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N²) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.

Affected upstream versions: < 5.0.1
Fixed upstream versions: 5.0.1
Upstream repository: https://github.com/markdown-it/linkify-it
Upstream fix commit: 6be6d15e0641bf1daeaa977d500cabc743166159
CVE-2026-48818: starlette: Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Component: starlette
Severity: Important
CWE: CWE-918 (Server-Side Request Forgery (SSRF))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-06-17T17:50:12.399000+00:00

A flaw was found in Starlette, a lightweight ASGI framework. On Windows systems, the StaticFiles component is vulnerable to Server-Side Request Forgery (SSRF). A remote attacker can exploit this by providing a specially crafted Universal Naming Convention (UNC) path, which causes the system to initiate an outbound Server Message Block (SMB) connection. This action can expose the service account's NTLMv2 credentials, potentially leading to information disclosure or further attacks.

Statement: This Important flaw in Starlette's StaticFiles component, which allows for NTLMv2 credential theft via specially crafted UNC paths, does not affect Red Hat products. The vulnerability is specific to Windows operating systems, and the vulnerable code is not present in Red Hat's supported configurations.

Affected upstream versions: < 1.1.0
Fixed upstream versions: 1.1.0
Upstream repository: https://github.com/Kludex/starlette
Upstream fix commit: fd53168a7767b6b55ba5af787fd88f49e33cabc5
CVE-2026-48930: nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
Component: nodejs
Severity: Moderate
CWE: CWE-170 (Improper Null Termination)
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-06-26T01:14:37.006000+00:00

A flaw was found in Node.js. This vulnerability in the TLS (Transport Layer Security) hostname handling allows embedded null characters in hostnames. This can lead to silent authority rebinding, potentially enabling an attacker to redirect network traffic to an unintended server and disclose sensitive information.


Affected upstream versions: 22.22.3 <= 22.22.3, 24.16.0 <= 24.16.0, 26.3.0 <= 26.3.0
Upstream repository: https://github.com/nodejs/node
Upstream fix commit: 7dafafa2424710ded8b77eb7c878e884c1aef64e
CVE-2026-48962: perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob
Component: perl-IO-Compress
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T03:12:38.974000+00:00

A flaw was found in perl-IO-Compress, a component used for data compression and decompression. A remote attacker could exploit this vulnerability by crafting a malicious input, specifically an output glob, that bypasses the intended security measures. This could lead to the execution of unauthorized code on the system, potentially allowing the attacker to take full control of the affected process.

Statement: This is an Important severity flaw in `perl-IO-Compress` that allows arbitrary code execution. A remote attacker can exploit a vulnerability in the `File::GlobMapper` component by providing a specially crafted output glob. This can lead to the execution of arbitrary Perl code with the privileges of the affected process, potentially compromising the system.

Affected upstream versions: <= v2.219
Fixed upstream versions: 2.220
Upstream repository: https://github.com/pmqs/IO-Compress
Upstream fix commit: f2db247bf90d4cc7ee2710be384946081f3b4610
CVE-2026-49476: python-soupsieve: Soupsieve: Denial of Service via crafted CSS selector string
Component: python-soupsieve
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-14T20:53:12.497000+00:00

A flaw was found in soupsieve, a CSS selector library used with Beautiful Soup 4. This vulnerability allows a remote attacker to cause a denial of service (DoS) by supplying a specially crafted CSS selector string. The parser allocates unbounded memory when compiling large, comma-separated selector lists, leading to excessive memory consumption and system instability.

Statement: An uncontrolled resource consumption vulnerability was found in the soupsieve Python package, a CSS selector library used by BeautifulSoup4. A remote attacker could provide a crafted CSS selector string that causes excessive memory or CPU consumption, leading to a denial of service condition.

It requires the application to accept untrusted CSS selectors supplied in one of the following sinks:
* soupsieve.compile()
* BeautifulSoup.select()
* BeautifulSoup.select_one()

This is an uncommon scenario.

Affected upstream versions: < 2.8.4
Fixed upstream versions: 2.8.4
Upstream repository: https://github.com/facelessuser/soupsieve
Upstream fix commit: 28108ab805818c832d9568142a99844fd95a0d39
CVE-2026-49477: soupsieve: Soupsieve: Denial of Service via crafted CSS selector strings
Component: soupsieve
Severity: Important
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-14T20:51:29.369000+00:00

A flaw was found in soupsieve, a CSS selector library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by supplying specially crafted, untrusted CSS selector strings. The flaw occurs due to a regular expression vulnerable to catastrophic backtracking when processing an attribute selector with an unterminated quoted value, leading to CPU exhaustion.

Statement: Important: A regular expression denial of service (ReDoS) flaw in the soupsieve library can lead to CPU exhaustion. A remote attacker can exploit this by supplying a small, specially crafted CSS selector string to applications that process untrusted CSS, potentially blocking worker threads and causing a complete service denial in affected Red Hat products.

Affected upstream versions: < 2.8.4
Fixed upstream versions: 2.8.4
Upstream repository: https://github.com/facelessuser/soupsieve
Upstream fix commit: eb4397618709186c109400448c6043b728217dc3
CVE-2026-49978: dompurify: DOMPurify: Cross-site scripting vulnerability allows code execution
Component: dompurify
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2026-07-14T20:02:46.263000+00:00

A flaw was found in DOMPurify, a tool designed to sanitize HTML, MathML, and SVG to prevent cross-site scripting (XSS) attacks. When performing in-place sanitization, DOMPurify could fail to properly process content within shadow DOM elements attached to a <template>.content. This oversight allows an attacker to embed malicious code, such as JavaScript, which could then execute when the sanitized template is used by an application, potentially leading to unauthorized actions or information disclosure.

Statement: This vulnerability in DOMPurify is rated as Important as it allows for cross-site scripting (XSS) attacks. When DOMPurify performs in-place sanitization, it may fail to properly process shadow DOM content within `<template>.content`, enabling an attacker to embed and execute malicious JavaScript. This could lead to unauthorized actions or information disclosure in Red Hat products that utilize DOMPurify for sanitizing untrusted HTML, MathML, or SVG.

Affected upstream versions: < 3.4.6
Fixed upstream versions: 3.4.7
Upstream repository: https://github.com/cure53/DOMPurify
Upstream fix commit: ca30f070c360df162a3e3848e80e6fd3c9e74bff
CVE-2026-50193: jackson-databind: Jackson-databind: Denial of Service via deeply nested JSON processing
Component: jackson-databind
Severity: Important
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-23T21:00:20.444000+00:00

A flaw was found in jackson-databind, a general-purpose data-binding library for Jackson Data Processor. A remote attacker can exploit this vulnerability by sending deeply nested JSON (JavaScript Object Notation) data to a service that reads and processes it. This can lead to a Denial of Service (DoS) by consuming significant system resources, making the service unavailable to legitimate users.

Statement: This is an Important denial-of-service flaw in jackson-databind, affecting services that process deeply nested JSON data. Exploitation occurs when a service reads JSON as `JsonNode` and subsequently writes it back using `JsonNode.toString()`, leading to excessive resource consumption and potential service unavailability.

Affected upstream versions: >= 2.10.0, < 2.14.0
Fixed upstream versions: jackson-databind-2.14.0
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: a1fa4ae4ecf5cee16da465985f135f3e81816f8c
CVE-2026-50256: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libXfont2 name length mismatch
Component: xorg-x11-server
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-02T00:00:00+00:00

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. A mismatch between the X server and the libXfont2 library's maximum font name length can cause a stack buffer overflow during font alias resolution. The server allocates a 256 byte stack buffer but libXfont2's alias target name length is 1024 bytes. A font alias name between 257 and 1023 bytes causes the X server to copy that name into the undersized stack buffer without further checks. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Statement: Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, the X server allocates a 256-byte stack buffer for font alias resolution but libXfont2 permits alias target names up to 1024 bytes. A local X client requesting a font alias between 257 and 1023 bytes triggers a stack buffer overflow. Any local user who can connect to the X server display can attempt exploitation. This may crash the display server or, where the X server runs with elevated privileges, could contribute to local privilege escalation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.11.0-8.el8_4.16, 0:1.12.0-14.el9_2.15, 0:1.12.0-15.el8_8.18, 0:1.12.0-6.el8_6.18, 0:1.13.1-8.el9_4.10, 0:1.14.1-11.el9_6, 0:1.15.0-10.el8_10, 0:1.15.0-7.el9_8.2, 0:1.20.10-5.el8_4, 0:1.20.11-19.el8_8, 0:1.20.11-21.el9_2, 0:1.20.11-28.el8_10.2, 0:1.20.11-29.el9_4, 0:1.20.11-34.el9_6, 0:1.20.11-34.el9_8.2, 0:1.20.11-8.el8_6, 0:1.20.4-35.el7_9, 0:1.8.0-36.el7_9.5, 0:21.1.3-10.el9_2.1, 0:21.1.3-13.el8_8.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: bb5158f962dc935e58ef8b4b5fcb31be201a6e07
CVE-2026-50257: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in miSyncDestroyFence()
Component: xorg-x11-server
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-02T00:00:00+00:00

A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence(). A client that sets up multiple fence triggers can trigger a use-after-free function pointer call. An attacker would connect to the X server to set up a fence and await that fence, then a second X connection destroys the fence, causing the use-after-free. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Statement: Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, a local X client can trigger a use-after-free function pointer call in miSyncDestroyFence() by setting up a fence trigger on one connection and destroying the fence from a second connection. Any local user who can connect to the X server display can attempt exploitation. This may crash the display server or, where the X server runs with elevated privileges, could contribute to local privilege escalation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.11.0-8.el8_4.16, 0:1.12.0-14.el9_2.15, 0:1.12.0-15.el8_8.18, 0:1.12.0-6.el8_6.18, 0:1.13.1-8.el9_4.10, 0:1.14.1-11.el9_6, 0:1.15.0-10.el8_10, 0:1.15.0-7.el9_8.2, 0:1.20.10-5.el8_4, 0:1.20.11-19.el8_8, 0:1.20.11-21.el9_2, 0:1.20.11-28.el8_10.2, 0:1.20.11-29.el9_4, 0:1.20.11-34.el9_6, 0:1.20.11-34.el9_8.2, 0:1.20.11-8.el8_6, 0:1.20.4-35.el7_9, 0:1.8.0-36.el7_9.5, 0:21.1.3-10.el9_2.1, 0:21.1.3-13.el8_8.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: f5abfb61994471023d8c6470428c8e30c411cc0b
CVE-2026-50259: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: stack buffer overflow in XKB SetMap request via mapWidths indexing
Component: xorg-x11-server
Severity: Important
CWE: CWE-121 (Stack-based Buffer Overflow)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-02T00:00:00+00:00

A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland. _XkbSetMapChecks() declares a fixed-size stack buffer mapWidths[256] indexed by key type index. The helper function CheckKeyTypes() writes to this buffer at a client-controlled offset, allowing a stack buffer overflow. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Statement: Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, _XkbSetMapChecks() uses a fixed 256-element stack buffer mapWidths[] indexed by a client-controlled key type index. CheckKeyTypes() writes beyond the buffer boundary, causing a stack buffer overflow. Any local user who can connect to the X server display can attempt exploitation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.11.0-8.el8_4.16, 0:1.12.0-14.el9_2.15, 0:1.12.0-15.el8_8.18, 0:1.12.0-6.el8_6.18, 0:1.13.1-8.el9_4.10, 0:1.14.1-11.el9_6, 0:1.15.0-10.el8_10, 0:1.15.0-7.el9_8.2, 0:1.20.10-5.el8_4, 0:1.20.11-19.el8_8, 0:1.20.11-21.el9_2, 0:1.20.11-28.el8_10.2, 0:1.20.11-29.el9_4, 0:1.20.11-34.el9_6, 0:1.20.11-34.el9_8.2, 0:1.20.11-8.el8_6, 0:1.20.4-35.el7_9, 0:1.8.0-36.el7_9.5, 0:21.1.3-10.el9_2.1, 0:21.1.3-13.el8_8.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 867b59b33bee669cb412f1314e47c52eacf6e00b
CVE-2026-50261: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free in SyncChangeCounter()
Component: xorg-x11-server
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-02T00:00:00+00:00

A use-after-free flaw was found in the X.Org X server and Xwayland in SyncChangeCounter(). A client that sets up multiple SyncCounters can trigger a use-after-free when destroying those counters via a second client connection while changing those counters. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Statement: Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, a local X client can trigger a use-after-free in SyncChangeCounter() by creating SyncCounters on one connection while changing and destroying them from a second connection. Any local user who can connect to the X server display can attempt exploitation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.11.0-8.el8_4.16, 0:1.12.0-14.el9_2.15, 0:1.12.0-15.el8_8.18, 0:1.12.0-6.el8_6.18, 0:1.13.1-8.el9_4.10, 0:1.14.1-11.el9_6, 0:1.15.0-10.el8_10, 0:1.15.0-7.el9_8.2, 0:1.20.10-5.el8_4, 0:1.20.11-19.el8_8, 0:1.20.11-21.el9_2, 0:1.20.11-28.el8_10.2, 0:1.20.11-29.el9_4, 0:1.20.11-34.el9_6, 0:1.20.11-34.el9_8.2, 0:1.20.11-8.el8_6, 0:1.20.4-35.el7_9, 0:1.8.0-36.el7_9.5, 0:21.1.3-10.el9_2.1, 0:21.1.3-13.el8_8.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: bdd7bf57af208b1ddf57d4683d67104443b44812
CVE-2026-50262: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds read/write in GLX ChangeDrawableAttributes
Component: xorg-x11-server
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-06-02T00:00:00+00:00

An out-of-bounds read flaw was found in the X.Org X server and Xwayland in __glXDisp_ChangeDrawableAttributes(). A wrong size validation check can read a client-controlled number of bytes, exceeding the request buffer, leading to information disclosure. A write path also exists but requires byte-swapped clients which is disabled by default.

Statement: Red Hat rates this issue as Moderate impact. In xorg-x11-server and xorg-x11-server-Xwayland, __glXDisp_ChangeDrawableAttributes() validates request size incorrectly, allowing a local X client to read bytes beyond the GLX request buffer—information disclosure. An out-of-bounds write path also exists but requires byte-swapped clients, which is disabled by default on Red Hat builds. Any local user who can connect to the X server display can trigger the read path. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.11.0-8.el8_4.16, 0:1.12.0-14.el9_2.15, 0:1.12.0-15.el8_8.18, 0:1.12.0-6.el8_6.18, 0:1.13.1-8.el9_4.10, 0:1.14.1-11.el9_6, 0:1.15.0-10.el8_10, 0:1.15.0-7.el9_8.2, 0:1.20.10-5.el8_4, 0:1.20.11-19.el8_8, 0:1.20.11-21.el9_2, 0:1.20.11-28.el8_10.2, 0:1.20.11-29.el9_4, 0:1.20.11-34.el9_6, 0:1.20.11-34.el9_8.2, 0:1.20.11-8.el8_6, 0:1.20.4-35.el7_9, 0:1.8.0-36.el7_9.5, 0:21.1.3-10.el9_2.1, 0:21.1.3-13.el8_8.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 6d459e4daf715bea8abdafa8fb130be2f8a1d145
CVE-2026-50263: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: use-after-free information disclosure in CreateSaverWindow()
Component: xorg-x11-server
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-06-02T00:00:00+00:00

A use-after-free flaw was found in the X.Org X server and Xwayland in CreateSaverWindow(). A client can trigger a use-after-free read after changing window attributes and forcing the screen saver, leading to information disclosure.

Statement: Red Hat rates this issue as Moderate impact. In xorg-x11-server and xorg-x11-server-Xwayland, a local X client can trigger a use-after-free read in CreateSaverWindow() by changing window attributes and forcing the screen saver, leaking server memory to the client. Any local user who can connect to the X server display can attempt exploitation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.11.0-8.el8_4.16, 0:1.12.0-14.el9_2.15, 0:1.12.0-15.el8_8.18, 0:1.12.0-6.el8_6.18, 0:1.13.1-8.el9_4.10, 0:1.14.1-11.el9_6, 0:1.15.0-10.el8_10, 0:1.15.0-7.el9_8.2, 0:1.20.10-5.el8_4, 0:1.20.11-19.el8_8, 0:1.20.11-21.el9_2, 0:1.20.11-28.el8_10.2, 0:1.20.11-29.el9_4, 0:1.20.11-34.el9_6, 0:1.20.11-34.el9_8.2, 0:1.20.11-8.el8_6, 0:1.20.4-35.el7_9, 0:1.8.0-36.el7_9.5, 0:21.1.3-10.el9_2.1, 0:21.1.3-13.el8_8.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: ecc634f1b2f7aa473d3a267eada98c4918bf9e05
CVE-2026-50264: xorg-x11-server: xorg-x11-server-Xwayland: xorg-x11-server: out-of-bounds heap write in DRI2 DRIGetBuffers/DRIGetBuffersWithFormat
Component: xorg-x11-server
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-02T00:00:00+00:00

An out-of-bounds write flaw was found in the X.Org X server and Xwayland in DRIGetBuffers/DRIGetBuffersWithFormat. A client that requests multiple DRI2BufferBackLeft attachments and one DRI2BufferFrontLeft can trigger an out-of-bounds heap write. This may be used to crash the server, or for privilege escalation if the X server runs as root.

Statement: Red Hat rates this issue as Important impact. In xorg-x11-server and xorg-x11-server-Xwayland, a local X client that requests multiple DRI2BufferBackLeft attachments together with DRI2BufferFrontLeft can trigger an out-of-bounds heap write in DRIGetBuffers/DRIGetBuffersWithFormat. Any local user with X display access can trigger this. It may crash the server or, where the X server runs with elevated privileges, could contribute to local privilege escalation. Upstream fixed this in xorg-server 21.1.23 and xwayland 24.1.12.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.11.0-8.el8_4.16, 0:1.12.0-14.el9_2.15, 0:1.12.0-15.el8_8.18, 0:1.12.0-6.el8_6.18, 0:1.13.1-8.el9_4.10, 0:1.14.1-11.el9_6, 0:1.15.0-10.el8_10, 0:1.15.0-7.el9_8.2, 0:1.20.10-5.el8_4, 0:1.20.11-19.el8_8, 0:1.20.11-21.el9_2, 0:1.20.11-28.el8_10.2, 0:1.20.11-29.el9_4, 0:1.20.11-34.el9_6, 0:1.20.11-34.el9_8.2, 0:1.20.11-8.el8_6, 0:1.20.4-35.el7_9, 0:1.8.0-36.el7_9.5, 0:21.1.3-10.el9_2.1, 0:21.1.3-13.el8_8.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 339c279514326134b0878fc23ce6e9520440ce7f
CVE-2026-50292: libinput: local privilege escalation via crafted uinput devices
Component: libinput
Severity: Moderate
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 6.7 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-05T00:00:00+00:00

A flaw was found in libinput. A local attacker with access to /dev/uinput can inject arbitrary udev properties through the libinput-device-group helper. This injection can lead to root code execution, for example, by exploiting REMOVE_CMD properties that are executed when a device is removed. This vulnerability allows an attacker to gain elevated privileges on the system.

Statement: This CVE is rated Moderate since /dev/uinput permissions are restricted to root by default on Red Hat Enterprise Linux.

Affected upstream versions: 1.31.0 < 1.31.3
Fixed upstream versions: 1.30.4, 1.31.3
Upstream repository: https://gitlab.freedesktop.org/libinput/libinput
Upstream fix commit: 76f0d8a7f57e2868882864b4611281f12f704b55