huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-59343: tar-fs: tar-fs symlink validation bypass
Component: tar-fs
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2025-09-24T17:43:34.728000+00:00

A symlink validation bypass flaw has been discovered in the npm tar-fs library. Affected versions are vulnerable to a symlink validation bypass if the destination directory is predictable with a specific tarball.


Affected upstream versions: >= 3.0.0, < 3.1.1, >= 2.0.0, < 2.1.3, < 1.16.5
Fixed upstream versions: v3.1.1
Upstream repository: https://github.com/mafintosh/tar-fs
Upstream fix commit: 0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
CVE-2025-59420: authlib: Authlib RFC violation
Component: authlib
Severity: Important
CWE: CWE-440 (Expected Behavior Violation)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2025-09-22T17:28:53.869000+00:00

Authlib’s JWS verification accepts tokens that declare unknown critical header parameters (crit), violating RFC 7515 “must‑understand” semantics. An attacker can craft a signed token with a critical header (for example, bork or cnf) that strict verifiers reject but Authlib accepts. In mixed‑language fleets, this enables split‑brain verification and can lead to policy bypass, replay, or privilege escalation.


Affected upstream versions: < 1.6.4
Fixed upstream versions: v1.6.4
Upstream repository: https://github.com/authlib/authlib
Upstream fix commit: 6b1813e4392eb7c168c276099ff7783b176479df
CVE-2025-59432: ongres-scram: Timing Attack Vulnerability in SCRAM Authentication
Component: ongres-scram
Severity: Moderate
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N)
Public date: 2025-09-22T19:22:37.117000+00:00

A timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals was used to compare secret values such as client proofs and server signatures. Since Arrays.equals performs a short-circuit comparison, the execution time varies depending on how many leading bytes match. This behavior could allow an attacker to perform a timing side-channel attack and potentially infer sensitive authentication material. All users relying on SCRAM authentication are impacted.


Affected upstream versions: < 3.2
Fixed upstream versions: 3.2
Upstream repository: https://github.com/ongres/scram
Upstream fix commit: f04975680d4a67bc84cc6c61bbffd5186223e2e2
CVE-2025-59531: argocd: argocd-server: gitops: Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload
Component: argocd
Severity: Important
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-01T20:49:35.428000+00:00

A denial of service vulnerability was identified in the Argo CD continuous delivery tool, which is distributed as part of Red Hat GitOps product. An unauthenticated attacker can exploit this flaw by sending a specially crafted request to the Application Programming Interface (API) webhook endpoint. This action causes the API server to crash, preventing it from restarting properly. By repeatedly targeting the server, an attacker can cause a complete service outage, making the Argo CD interface unavailable to all users. This vulnerability is only exposed in configurations where a specific webhook secret has not been set.

Statement: This vulnerability was rated as Important by the Red Hat Product Security team, this happens because an unauthenticated attacker is able to cause a denial of service from the whole GitOps cluster. This vulnerability affects only clusters without a configured 'webhook.bitbucket.secret' configuration key, thus clusters that have this option configured are not exposed to this flaw.

This vulnerability lies in a unsafe cast when trying to retrieve the `repository.links.clone`JSON field from BitBucket-Server push request. When the unsafe cast is triggered, the goroutine created by the worker to process the request will fail within an assertion panic and, as it lacks a recovery routine, the whole argocd-server binary will be terminated. If an attacker manages to force all the argocd-server replica nodes to reach this assertion failure, a Denial of Service of the whole cluster will happen.

Affected upstream versions: >= 1.2.0, <= 1.8.7, >= 2.0.0-rc1, < 2.14.20, >= 3.2.0-rc1, < 3.2.0-rc2, >= 3.1.0-rc1, < 3.1.8, >= 3.0.0-rc1, < 3.0.19
Fixed upstream versions: v3.1.8
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 5c466a4e39802e059e75c0008ae7b7b8e842538f
CVE-2025-59537: github.com/argoproj/argo-cd: Argo CD unauthenticated Denial of Service
Component: github.com/argoproj/argo-cd
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-01T21:01:36.519000+00:00

A denial of service flaw has been discovered in Argo-CD. With the default configuration, no `webhook.gogs.secret` set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field `commits[].repo` is not set or is null.

Statement: The availability risk of this vulnerability is limited to the Argo-CD application. General host availability is not at risk.

Affected upstream versions: >= 1.2.0, <= 1.8.7, >= 2.0.0-rc1, < 2.14.20, >= 3.2.0-rc1, < 3.2.0-rc2, >= 3.1.0-rc1, < 3.1.8, >= 3.0.0-rc1, < 3.0.19
Fixed upstream versions: v3.1.8
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 761fc27068d2d4cd24e1f784eb2a9033b5ee7f43
CVE-2025-59538: github.com/argoproj/argo-cd: Argo CD unauthenticated Remote Denial of Service
Component: github.com/argoproj/argo-cd
Severity: Moderate
CWE: CWE-617 (Reachable Assertion)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-01T21:09:08.870000+00:00

A denial of service flaw has been discovered in Argo-CD. In the default configuration, `webhook.azuredevops.username` and `webhook.azuredevops.password` are not set, Argo CD’s `/api/webhook` endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic.

Statement: The availability risk of this vulnerability is limited to the Argo-CD application. General host availability is not at risk.

Affected upstream versions: >= 2.9.0-rc1, < 2.14.20, >= 3.2.0-rc1, < 3.2.0-rc2, >= 3.1.0-rc1, < 3.1.8, >= 3.0.0-rc1, < 3.0.19
Fixed upstream versions: v3.1.8
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: 1a023f1ca7fe4ec942b4b6696804988d5a632baf
CVE-2025-59830: rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
Component: rubygem-rack
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-09-25T14:37:06.967000+00:00

An unsafe default behavior in Rack::QueryParser allows bypass of the params_limit parameter count restriction when query string parameters are delimited by semicolons (;) rather than ampersands (&). The parser counts only & when enforcing the limit, while still splitting on both & and ;. As a result, an attacker can supply a crafted HTTP query using ; delimiters to exceed the intended parameter count, potentially causing performance degradation or exhaustion of resources (denial of service).

Statement: The overall severity of this flaw is Moderate, because most Rack applications are not directly impacted. The vulnerability primarily affects applications or middleware that invoke Rack::QueryParser directly using its default configuration, which accepts both & and ; as parameter delimiters. This behavior can lead to excessive CPU or memory consumption, resulting only a limited denial-of-service condition.

For typical applications using Rack::Request, the default request-handling flow applies safe parsing logic and does not exhibit the vulnerable behavior.

In summary, while the theoretical severity is High, the practical impact is generally Moderate to Low for standard configurations.

```
Affectedness:

It should be noted that starting from Rack v3.x, the framework no longer splits query parameters on semicolons. This change was introduced in commit ef1fc0c44e6a4b77c8fcf9b4f3bfa09f04ae8482, effectively mitigating this issue in newer releases.

Rack 1.x is also not affected by this vulnerability. The vulnerable parsing logic was introduced in Rack 2.x; earlier versions use a simpler query parsing mechanism that does not expose the same resource exhaustion risk.
```

~~~
Additionally, Ruby 2.x and 3.x versions shipped with Red Hat Enterprise Linux are not affected, as they do not bundle the rack RubyGem by default. Rack is a third-party gem that must be installed separately.
~~~

Affected upstream versions: < 2.2.18
Fixed upstream versions: v2.2.18
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 54e4ffdd5affebcb0c015cc6ae74635c0831ed71
CVE-2025-59952: io.minio/minio: minio-java Client XML Tag is Vulnerable to Value Substitution
Component: io.minio/minio
Severity: Important
CWE: CWE-611 (Improper Restriction of XML External Entity Reference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-09-29T23:32:33.994000+00:00

In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. Attackers could craft malicious XML inputs to extract sensitive data from the system's properties or environment variables, potentially compromising security in applications relying on minio-java for object storage operations.


Affected upstream versions: < 8.6.0
Fixed upstream versions: 8.6.0
Upstream repository: https://github.com/minio/minio-java
Upstream fix commit: f7a98d06b25e5464bdd4811b044e25ff9101d37f
CVE-2025-6032: podman: podman missing TLS verification
Component: podman
Severity: Important
CWE: CWE-295 (Improper Certificate Validation)
CVSS v3: 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2025-06-24T00:00:00+00:00

A flaw was found in Podman. The podman machine init command fails to verify the TLS certificate when downloading the VM images from an OCI registry. This issue results in a Man In The Middle attack.

Statement: To exploit this flaw, a user needs to download an image from an untrusted OCI registry, specifically, an OCI registry with an invalid TLS certificate. This allows a remote attacker with access to the network path between the registry and the client to perform a Man In the Middle attack.

Affected upstream versions: 4.8.0 < 5.5.2
Fixed upstream versions: 4.19.9.6.202507152218-0, 4.20.9.6.202509251656-0, 416.94.202507222002-0, 417.94.202507132309-0, 418.94.202507221927-0, 4:4.9.4-14.rhaos4.16.el8, 4:4.9.4-18.el9_4.2, 5.5.2, 5:5.2.2-8.rhaos4.17.el8, 5:5.2.2-9.rhaos4.18.el9, 5:5.4.0-12.el9_6, 5:5.4.0-6.rhaos4.19.el9, 6:5.4.0-12.el10_0, 8100020250625105344.afee755d
Upstream repository: https://github.com/containers/podman
Upstream fix commit: 726b506acc8a00d99f1a3a1357ecf619a1f798c3
CVE-2025-6069: cpython: Python HTMLParser quadratic complexity
Component: cpython
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-06-17T13:39:46.058000+00:00

A denial-of-service (DoS) vulnerability has been discovered in Python's html.parser.HTMLParser class. When processing specially malformed HTML input, the parsing runtime can become quadratic with respect to the input size. This significantly increased processing time can lead to excessive resource consumption, ultimately causing a denial-of-service condition in applications that rely on this parser.


Affected upstream versions: 3.11.0 < 3.11.14, 3.12.0 < 3.12.12, 3.13.0 < 3.13.6, 3.14.0a1 < 3.14.0b3
Fixed upstream versions: v3.13.6
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 4455cbabf991e202185a25a631af206f60bbc949
CVE-2025-6075: python: Quadratic complexity in os.path.expandvars() with user-controlled template
Component: python
Severity: Low
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-31T16:41:34.983000+00:00

A vulnerability in Python’s os.path.expandvars() function that can cause performance degradation. When processing specially crafted, user-controlled input with nested environment variable patterns, the function exhibits quadratic time complexity, potentially leading to excessive CPU usage and denial of service (DoS) conditions. No code execution or data exposure occurs, so the impact is limited to performance slowdown.

Statement: This vulnerability is rated Low rather than Moderate because it only causes a performance inefficiency without affecting code execution, data integrity, or confidentiality. The flaw lies in the algorithmic complexity of os.path.expandvars(), which can become quadratic when processing crafted input containing repetitive or nested environment variable references. Exploitation requires the attacker to control the input string passed to this function, which is uncommon in secure applications. Moreover, the impact is limited to increased CPU utilization and potential slowdown, not system compromise or data manipulation. Since the issue does not introduce memory corruption, privilege escalation, or information disclosure risks, its overall impact scope and exploitability are minimal, justifying a Low severity rating.

Affected upstream versions: 3.11.0 < 3.11.15, 3.12.0 < 3.12.13, 3.13.0 < 3.13.10, 3.14.0 < 3.14.1, 3.15.0a1 < 3.15.0a2
Fixed upstream versions: 3.9
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 2e6150adccaaf5bd95d4c19dfd04a36e0b325d8c
CVE-2025-61144: libtiff: libtiff: Denial of Service via buffer overflow
Component: libtiff
Severity: Moderate
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-02-23T00:00:00+00:00

A denial of service flaw has been found in libtiff. This stack-based buffer overflow occurs in tiffcrop (part of libtiff) within the function readSeparateStripsIntoBuffer. When processing a malformed TIFF directory (e.g., improper tags/order, missing StripByteCounts), the function overflows a stack-allocated array (srcbuffs) by accessing one element beyond its boundary in combineSeparateSamplesBytes. This leads to an AddressSanitizer-detected buffer over-read and crash.

Statement: Red Hat employs StackGuard protections which limit the impact of this vulnerability to a denial of service. An out of bounds read in libtiff on a Red Hat system may cause a process termination, but does not pose further risk.

Affected upstream versions: n/a
Fixed upstream versions: v4.7.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: 09f53a86cf26dfd961925227e59e180db617f26d
CVE-2025-61594: uri: URI module: Credential exposure via URI + operator
Component: uri
Severity: Moderate
CWE: CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N)
Public date: 2025-12-30T21:03:08.990000+00:00

A flaw was found in the URI module. A remote attacker could exploit this vulnerability by using the `+` operator to combine Uniform Resource Identifiers (URIs). This bypasses a previous fix and can lead to the leakage of sensitive information, such as user credentials (passwords), from the original URI, resulting in credential exposure.

Statement: This vulnerability is rated Moderate as it allows for credential exposure when the URI module's `+` operator is used to combine URIs. This flaw bypasses a previous fix, potentially leading to sensitive information leakage from the original URI in affected applications across Red Hat Enterprise Linux, OpenShift Container Platform, and other products utilizing the vulnerable URI module.

Affected upstream versions: < 0.12.5, >= 0.13.0, < 0.13.3, >= 1.0.0, < 1.0.4
Fixed upstream versions: v0.13.3
Upstream repository: https://github.com/ruby/uri
Upstream fix commit: 20157e3e29b125ff41f1d9662e2e3b1d066f5902
CVE-2025-61723: encoding/pem: Quadratic complexity when parsing some invalid inputs in encoding/pem
Component: encoding/pem
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-29T22:10:13.220000+00:00

A potential denial of service flaw has been discovered in the golang encoding/pem module. Due to the design of the PEM parsing function, the processing time for some
inputs scales non-linearly with respect to the size of the input. This affects programs which parse untrusted PEM inputs and may result in an unresponsive program should an attacker exploit it.


Affected upstream versions: 1.25.0 < 1.25.2
Fixed upstream versions: 1.24.8, 1.25.2
Upstream repository: https://github.com/golang/go
Upstream fix commit: 5ce8cd16f3859ec5ac4106ad8ec15d6236f4501b
CVE-2025-61770: rack: Rack's unbounded multipart preamble buffering enables DoS (memory exhaustion)
Component: rack
Severity: Important
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T14:30:04.552000+00:00

A flaw was found in Rack where the Rack::Multipart::Parser buffers the multipart preamble memory without size limits. A remote attacker can send a crafted multipart/form-data request with a very large preamble before its first boundary, causing excessive memory consumption and denial of service crash due to out-of-memory issue.

Statement: This is IMPORTANT because the vulnerability can be exploited over a network and can cause denial of service on such applications that run the vulnerable Rack code. By sending multipart requests with large preambles, an attacker can exhaust memory resources or crash worker processes, leading to service downtime.

Affected upstream versions: < 2.2.19, >= 3.1, < 3.1.17, >= 3.2, < 3.2.2
Fixed upstream versions: v3.2.2
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 589127f4ac8b5cf11cf88fb0cd116ffed4d2181e
CVE-2025-61771: rack: Rack's multipart parser buffers large non‑file fields entirely in memory, enabling DoS (memory exhaustion)
Component: rack
Severity: Important
CWE: CWE-1284 (Improper Validation of Specified Quantity in Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-07T14:42:53.366000+00:00

A flaw was found in Rack where Rack::Multipart::Parser stores non-file form fields entirely in memory without size limits. An attacker can send a multipart/form-data request with an extremely large text field, causing the server to allocate large amounts of memory which leads to a denial of service crash due to out-of-memory issue.

Statement: The impact is IMPORTANT because this happens over a network and causes a denial of service. Large non-file fields are buffered in memory instead of being streamed or capped, leading to memory exhaustion and worker crashes.

Affected upstream versions: < 2.2.19, >= 3.1, < 3.1.17, >= 3.2, < 3.2.2
Fixed upstream versions: v3.2.2
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 589127f4ac8b5cf11cf88fb0cd116ffed4d2181e
CVE-2025-61772: rack: Rack memory exhaustion denial of service
Component: rack
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-10-07T15:02:09.895000+00:00

A denial of service flaw has been found in the rubygems rack package. `Rack::Multipart::Parser` can accumulate unbounded data when a multipart part’s header block never terminates with the required blank line (`CRLFCRLF`). The parser keeps appending incoming bytes to memory without a size cap, allowing a remote attacker to exhaust memory and cause a denial of service (DoS).

Statement: The availability risk to Red Hat systems is limited to the application which has integrated rack. The host operating system availability is not at risk.

Affected upstream versions: < 2.2.19, >= 3.1, < 3.1.17, >= 3.2, < 3.2.2
Fixed upstream versions: v3.2.2
Upstream repository: https://github.com/rack/rack
Upstream fix commit: 589127f4ac8b5cf11cf88fb0cd116ffed4d2181e
CVE-2025-61795: tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service
Component: tomcat
Severity: Moderate
CWE: CWE-404 (Improper Resource Shutdown or Release)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-10-27T17:30:28.334000+00:00

A denial of service flaw has been discovered in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but left for the garbage collection process to delete. Depending on JVM settings, application memory usage and application load, it was possible that space for the temporary copies of uploaded parts would be filled faster than GC cleared it, leading to a DoS.


Affected upstream versions: 11.0.0-M1 <= 11.0.11, 10.1.0-M1 <= 10.1.46, 9.0.0.M1 <= 9.0.109, 8.5.0 <= 8.5.100
Fixed upstream versions: 11.0.12
Upstream repository: https://github.com/apache/tomcat
Upstream fix commit: 1cdf5f730ede75a0759492f179ac21ca4ff68e06
CVE-2025-61915: CUPS: Local denial-of-service via cupsd.conf update and related issues
Component: CUPS
Severity: Moderate
CWE: CWE-1173 (Improper Use of Validation Framework)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Public date: 2025-11-28T00:00:00+00:00

A flaw was found in cups. A user in group defined by SystemGroup directive in /etc/cups/cups-files.conf can use the cups web ui to change the config 
and insert a malicious line. Then the cupsd process which runs as root will parse the new config and  cause an out-of-bound write.

Statement: The highest threat of this flaw is to system availability. A local attacker with high privileges, specifically a user belonging to the `SystemGroup` as defined in `/etc/cups/cups-files.conf`, could exploit the CUPS web interface to introduce a malicious configuration line into `cupsd.conf`, leading to a denial of service.

Affected upstream versions: < 2.4.15
Fixed upstream versions: v2.4.15
Upstream repository: https://github.com/OpenPrinting/cups
Upstream fix commit: db8d560262c22a21ee1e55dfd62fa98d9359bcb0