huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-46818: Redis: Redis: Authenticated users can execute LUA scripts as a different user
Component: Redis
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)
Public date: 2025-10-03T18:38:57.170000+00:00

A code injection vulnerability in Redis Lua scripting where an authenticated user can craft a Lua script to manipulate objects and potentially execute code in another user’s context.

Statement: This rated Moderate as the vulnerability requires authenticated access with scripting rights, high-complexity steps to trigger a specific Lua code path, and typically another user action for cross-context execution. The impact is confined to the Redis process and data, with no availability effect, and can be mitigated via standard ACLs restricting EVAL/FUNCTION or by updating to the fixed release. Unlike “Important” flaws, it is not remotely exploitable without interaction or across trust boundaries.

This flaw exists only in the Redis server implementation; 

Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.

Affected upstream versions: < 8.2.2
Fixed upstream versions: 8.2.2
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 45eac0262028c771b6f5307372814b75f49f7a9e
CVE-2025-46819: Redis: Redis is vulnerable to DoS via specially crafted LUA scripts
Component: Redis
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H)
Public date: 2025-10-03T19:12:10.999000+00:00

A vulnerability was found in Redis where an authenticated user to run a crafted Lua script that can read out‑of‑bounds memory or crash the server, leading to information disclosure and denial of service.

Statement: This is rated Moderate because exploitation requires an authenticated Redis account with permission to execute Lua (EVAL/FUNCTION), and the impact is limited to out‑of‑bounds reads and process crash (DoS) rather than code execution or privilege escalation. The attack surface is limited to environments where the attacker already possesses valid credentials and can invoke Lua (EVAL/FUNCTION), raising exploitation complexity and narrowing exposure compared to unauthenticated or privilege‑escalating flaws.

This flaw exists only in the Redis server implementation; 

Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.

Affected upstream versions: < 8.2.2
Fixed upstream versions: 8.2.2
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 3a1624da2449ac3dbfc4bdaed43adf77a0b7bfba
CVE-2025-47268: iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping
Component: iputils
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2025-05-05T00:00:00+00:00

A flaw was found in iputils ping, where a signed integer overflow occurs in timestamp multiplication. This issue could lead to incorrect timestamp calculations or denial of service when processing crafted ICMP Echo Reply packets.


Affected upstream versions: <= 20240905
Fixed upstream versions: 20250602
Upstream repository: https://github.com/iputils/iputils
Upstream fix commit: 070cfacd7348386173231fb16fad4983d4e6ae40
CVE-2025-47273: setuptools: Path Traversal Vulnerability in setuptools PackageIndex
Component: setuptools
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L)
Public date: 2025-05-17T15:46:11.399000+00:00

A path traversal vulnerability in the Python setuptools library allows attackers with limited system access to write files outside the intended temporary directory by manipulating package download URLs. This flaw bypasses basic filename sanitization and can lead to unauthorized overwrites of important system files, creating opportunities for further compromise. While it doesn't expose data or require user interaction, it poses a high integrity risk and is especially concerning in environments that rely on automated package handling or internal tooling built on setuptools.

Statement: Red Hat Product Security has rated this vulnerability "Moderate" based on the impact of the damage caused by a successful exploitation and the pre-requisites.

* Exploitation requires that the attacker have limited code execution access to a Python environment where they can trigger the vulnerable PackageIndex.download() function—this might be via a script, plugin, or automated job. Full admin rights aren't needed but a user with no access at all will be unable to exploit this vulnerability.
* The vulnerability impacts the integrity of the system within the same security boundary—it does not enable access or compromise across trust boundaries (e.g., from one container to another or from user space to kernel).
* Successful exploitation only allows the attacker to "create" new files. The vulnerability does not provide access to existing files and by an extension to any confidential information. 
* Arbitrary file writes can overwrite critical config files, executables, or scripts. This can lead to persistent code execution, system misconfiguration, or unauthorized behavior, especially in automated environments. While overwriting critical files could theoretically lead to service disruption, the vulnerability in isolation does not inherently cause denial of service. The exploit doesn't target availability directly, and in many cases, systems may continue running.

Affected upstream versions: < 78.1.1
Fixed upstream versions: v75.3.4
Upstream repository: https://github.com/pypa/setuptools
Upstream fix commit: 250a6d17978f9f6ac3ac887091f2d32886fbbb0b
CVE-2025-47277: vllm: vLLM Allows Remote Code Execution via PyNcclPipe Communication Service
Component: vllm
Severity: Moderate
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.5 (CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-20T17:32:27.034000+00:00

A flaw was found in vLLM. This vulnerability allows unauthorized access to key-value caches via network exposure of the `TCPStore` interface when using the `PyNcclPipe` KV cache transfer integration with the V0 engine.

Statement: By default, Red Hat products are configured to restrict vLLM nodes to an isolated network. However, this vulnerability could become relevant if customers change the specific configurations, and therefore, Red Hat products are affected.

This vulnerability is classified as Moderate rather than Critical because its exploitability and impact are constrained by specific deployment contexts and assumptions about network trust boundaries. While the use of pickle.loads on untrusted input typically leads to remote code execution (RCE), the vulnerable PyNcclPipe interface is not intended to be exposed to the internet or untrusted networks, it is designed for use within a secured, internal cluster environment as explicitly documented by vLLM. Successful exploitation requires an attacker to have direct network access to a misconfigured or poorly segmented system where the KV cache transfer service is bound to a public interface. Additionally, the vulnerable code path exists only in a niche configuration (V0 engine with PyNcclPipe), further reducing its exposure. Therefore, while the flaw does introduce RCE risk in misconfigured setups, the combination of non-default exposure, clear documentation, and limited applicability justifies a reduced impact.

Affected upstream versions: >= 0.6.5, < 0.8.5
Fixed upstream versions: v0.8.5
Upstream repository: https://github.com/vllm-project/vllm
Upstream fix commit: 0d6e187e88874c39cda7409cf673f9e6546893e7
CVE-2025-47287: tornado: Tornado Multipart Form-Data Denial of Service
Component: tornado
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-05-15T21:17:55.188000+00:00

A flaw was found in Tornado. This vulnerability can lead to a a denial of service by generating an extremely high volume of log entries.

Statement: This vulnerability marked as Important because it leverages the synchronous nature of the logging subsystem to induce a DoS condition. Specifically, malformed multipart/form-data payloads cause repeated, blocking log writes, which stall the event loop that underpins Tornado’s asynchronous architecture. Furthermore, because the vulnerable multipart parser is enabled by default, applications that are otherwise well-secured and do not even use file uploads can still be targeted unless they explicitly block these requests at a proxy.

Affected upstream versions: < 6.5.0
Fixed upstream versions: v6.5.0
Upstream repository: https://github.com/tornadoweb/tornado
Upstream fix commit: b39b892bf78fe8fea01dd45199aa88307e7162f3
CVE-2025-47933: argocd: Improper URL Sanitization in Argo CD Repository Page Allows Cross-Site Scripting (XSS)
Component: argocd
Severity: Important
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:H/A:L)
Public date: 2025-05-28T14:30:00+00:00

A flaw was found in Argo CD, where improper filtering of repository URLs in the UI allows JavaScript injection. A crafted javascript: link can lead to cross-site scripting when viewed by another user. This can result in unauthorized API actions via the victim's session.


Affected upstream versions: >= 1.2.0-rc1, <= 1.8.7, >= 2.0.0-rc3, < 2.13.8, >= 2.14.0-rc1, < 2.14.13, >= 3.0.0-rc1, < 3.0.4
Fixed upstream versions: v3.1.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: a5b4041a79c54bc7b3d090805d070bcdb9a9e4d1
CVE-2025-47950: coredns: CoreDNS Vulnerable to DoQ Memory Exhaustion via Stream Amplification
Component: coredns
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-06-06T17:32:30.218000+00:00

A memory exhaustion vulnerability was found in CoreDNS when operating with QUIC traffic streams. The CoreDNS server in affected versions would spawn a new goroutine for each incoming QUIC stream without limit. This flaw allows a malicious user to create an unbounded number of QUIC streams and consume all available resources, leading to an application level denial of service.

Statement: On a Red Hat system, a denial of service to the CoreDNS service will not take down the host system, so the availability impact is assessed as Low for Red Hat systems.

Affected upstream versions: < 1.12.2
Fixed upstream versions: v1.12.2
Upstream repository: https://github.com/coredns/coredns
Upstream fix commit: efaed02c6a480ec147b1f799aab7cf815b17dfe1
CVE-2025-4802: glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
Component: glibc
Severity: Moderate
CWE: CWE-426 (Untrusted Search Path)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-05-16T00:00:00+00:00

A flaw was found in the glibc library. A statically linked setuid binary that calls dlopen(), including internal dlopen() calls after setlocale() or calls to NSS functions such as getaddrinfo(), may incorrectly search LD_LIBRARY_PATH to determine which library to load, allowing a local attacker to load malicious shared libraries, escalate privileges and execute arbitrary code.

Statement: This issue can only be exploitable by a local attacker via a static setuid program that calls the dlopen function, causing the library to search LD_LIBRARY_PATH to locate the shared object name to load. No such programs have been found in Red Hat Enterprise Linux at the time of publishing this advisory. However, custom setuid programs, although strongly discouraged as a security practice, may exist and can not be discarded. Due to these reasons, this flaw has been rated with a moderate severity.

Affected upstream versions: 2.27 < 2.39
Fixed upstream versions: 2.39
Upstream repository: https://sourceware.org/cgit/glibc
Upstream fix commit: 1e18586c5820e329f741d5c710275e165581380e
CVE-2025-48367: redis: Redis Unauthenticated Denial of Service
Component: redis
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-07T15:25:47.690000+00:00

A flaw was found in Redis. Unauthenticated connections can trigger repeated IP protocol errors, leading to client starvation and an application-level denial of service. This flaw allows an attacker to induce this condition without authentication. This issue results in a denial of service condition for connected clients. The root cause is related to the improper handling of network traffic.

Statement: The severity of this vulnerability is rated Moderate as it does not impact system availability. The effects are confined to the application layer without compromising the underlying system stability.

Affected upstream versions: >= 8.0.0, < 8.0.3, >= 7.4-rc1, < 7.4.5, >= 7.0.0, < 7.2.10, < 6.2.19
Fixed upstream versions: 8.0.3
Upstream repository: https://github.com/redis/redis
Upstream fix commit: bde62951accfc4bb0a516276fd0b4b307e140ce2
CVE-2025-48379: python-pillow: pillow: Pillow DDS Heap Buffer Overflow
Component: python-pillow
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Public date: 2025-07-01T18:33:30.687000+00:00

A critical vulnerability was identified in the Pillow image processing library. This flaw could allow a local attacker to execute arbitrary code or cause the application to crash, resulting in a denial of service. An attacker can exploit this vulnerability by tricking an application into processing a specially crafted image file. The issue occurs because the library writes more data than an allocated memory buffer can hold, leading to memory corruption.

Statement: This vulnerability was rated as Important by the Red Hat Product Security Engineer. An attacker may leverage that by crafting a malicious DDS image bigger than 64k (when encoded). This happens because of the lack of size checking when writing the image data into an internal buffer. When successfully exploited, this vulnerability may lead to a local arbitrary code execution within the user privileges similar to the ones for the user running the application or a denial of service for the application consuming the Pillow library.

Affected upstream versions: >= 11.2.0, < 11.3.0
Fixed upstream versions: 11.3.0
Upstream repository: https://github.com/python-pillow/Pillow
Upstream fix commit: ef98b3510e3e4f14b547762764813d7e5ca3c5a4
CVE-2025-48384: git: Git arbitrary code execution
Component: git
Severity: Important
CWE: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
CVSS v3: 8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Public date: 2025-07-08T18:23:48.710000+00:00

A line-end handling flaw was found in Git. When writing a config entry, values with a trailing carriage return (CR) are not quoted, resulting in the CR being lost when the config is read later. When initializing a submodule, if the submodule path contains a trailing CR, the altered path is read, resulting in the submodule being checked out to an incorrect location.

Statement: This vulnerability marked as Important and not Moderate flaw because it undermines Git’s path and config integrity by allowing carriage return (\r) injection to manipulate submodule checkout behavior. Git previously failed to quote config values containing trailing CR, causing the value to be misinterpreted when read back. In the context of submodules, this leads to incorrect path resolution, allowing an attacker to redirect the checkout path via a symlink to a sensitive directory like .git/modules/<submodule>/hooks. If an executable post-checkout hook exists there, it could be inadvertently executed, resulting in arbitrary code execution during submodule operations. This is particularly dangerous in automated CI/CD pipelines or multi-repo projects where submodules are initialized or updated without manual inspection.

Affected upstream versions: < 2.43.7, >= 2.44.0-rc0, < 2.44.4, >= 2.45.0-rc0, < 2.45.4, >= 2.46.0-rc0, < 2.46.4, >= 2.47.0-rc0, < 2.47.3, >= 2.48.0-rc0, < 2.48.2, >= 2.49.0-rc0, < 2.49.1, >= 2.50.0-rc0, < 2.50.1
Fixed upstream versions: v2.43.7
Upstream repository: https://github.com/git/git
Upstream fix commit: 05e9cd64ee23bbadcea6bcffd6660ed02b8eab89
CVE-2025-48387: tar-fs: tar-fs has issue where extract can write outside the specified dir with a specific tarball
Component: tar-fs
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-06-02T19:20:18.220000+00:00

A flaw was found in tar-fs. This vulnerability allows files to be written outside the intended extraction directory via specially crafted tar archives. The issue arises from insufficient path validation during tarball extraction, potentially enabling path traversal attacks that can overwrite arbitrary files on the system.

Statement: This vulnerability in tar-fs is Important not a moderate flaw, primarily due to its ability to bypass directory confinement during tarball extraction. The core issue—path traversal via crafted archive entries—allows attackers to write files outside the intended extraction directory, potentially overwriting system files, configuration files, or injecting malicious scripts into sensitive locations. Unlike moderate flaws that may require specific conditions or user interaction to exploit, this vulnerability can be triggered automatically in server-side environments that extract user-supplied tar files (e.g., CI/CD systems, deployment tools, or file upload handlers). Its exploitation could lead to remote code execution, privilege escalation, or denial of service, depending on the context.

Affected upstream versions: < 1.16.5, >= 2.0.0, < 2.1.3, >= 3.0.0, < 3.0.9
Fixed upstream versions: v3.0.9
Upstream repository: https://github.com/mafintosh/tar-fs
Upstream fix commit: 647447b572bc135c41035e82ca7b894f02b17f0f
CVE-2025-48734: commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
Component: commons-beanutils
Severity: Important
CWE: CWE-284 (Improper Access Control)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-05-28T13:32:08.300000+00:00

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like getProperty() or getNestedProperty().

Statement: This vulnerability is rated as important severity because a flaw exists in Apache Commons BeanUtils, where PropertyUtilsBean and BeanUtilsBean allow uncontrolled access to the declaredClass property of Java enum objects. Applications that pass untrusted property paths directly to getProperty() or getNestedProperty() methods are at risk, as attackers can exploit this behavior to retrieve the ClassLoader instance and execute arbitrary code in the context of the affected application. This issue leads to compromise of confidentiality, integrity, and availability.

Affected upstream versions: 1.0 < 1.11.0, 2.0.0-M1 < 2.0.0-M2
Fixed upstream versions: rel/commons-beanutils-1.11.0
Upstream repository: https://github.com/apache/commons-beanutils
Upstream fix commit: 28ad955a1613ed5885870cc7da52093c1ce739dc
CVE-2025-4877: libssh: Write beyond bounds in binary to base64 conversion functions
Component: libssh
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-06-24T00:00:00+00:00

There's a vulnerability in the libssh package where when a libssh consumer passes in an unexpectedly large input buffer to ssh_get_fingerprint_hash() function. In such cases the bin_to_base64() function can experience an integer overflow leading to a memory under allocation, when that happens it's possible that the program perform out of bounds write leading to a heap corruption.
This issue affects only 32-bits builds of libssh.

Statement: Red Hat Product Security classified this vulnerability as having a Moderate severity. This happens because of the complexity of the attack, the possible misusage of the libssh API and the fact the attacker may not have full control over the positions and contents written into the heap.

No supported Red Hat products are affected by this issue since only 32-bit builds are vulnerable.

Affected upstream versions: <= libssh-0.11.1
Fixed upstream versions: 0.11.2, 0:0.10.4-18.el9
Upstream repository: https://git.libssh.org/projects/libssh.git
Upstream fix commit: 6fd9cc8ce3958092a1aae11f1f2e911b2747732d
CVE-2025-4878: libssh: Use of uninitialized variable in privatekey_from_file()
Component: libssh
Severity: Low
CWE: CWE-416 (Use After Free)
CVSS v3: 3.6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2025-06-24T00:00:00+00:00

A vulnerability was found in libssh, where an uninitialized variable exists under certain conditions in the privatekey_from_file() function. This flaw can be triggered if the file specified by the filename doesn't exist and may lead to possible signing failures or heap corruption.

Statement: Red Hat Product Security has rated this vulnerability as having Low severity as the affected privatekey_from_file() function is deprecated and should not be used.

Affected upstream versions: <= libssh-0.11.1
Fixed upstream versions: 0.11.2, 0:0.10.4-18.el9
Upstream repository: https://git.libssh.org/projects/libssh.git
Upstream fix commit: 697650caa97eaf7623924c75f9fcfec6dd423cd1
CVE-2025-48866: mod_security: ModSecurity Denial of Service Vulnerability
Component: mod_security
Severity: Moderate
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-02T15:46:19.909000+00:00

A denial of service flaw was found in ModSecurity. This vulnerability is present in the `sanitiseArg`/`sanitizeArg` function can be overloaded with a large number of arguments which will lead to excessive memory usage when processing json values. This may lead to a denial of service in the affected web server should memory limits be exceeded.

Statement: User configuration must have at least one rule that does a `sanitiseMatchedBytes` action to be affected. Default configurations are not affected.

Affected upstream versions: < 2.9.10
Fixed upstream versions: v2.9.10
Upstream repository: https://github.com/owasp-modsecurity/ModSecurity
Upstream fix commit: 3a54ccea62d3f7151bb08cb78d60c5e90b53ca2e