huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-56392: coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values
Component: coreutils
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Public date: 2026-07-24T07:44:54.885000+00:00

A flaw was found in GNU coreutils, specifically in the `unexpand` utility. This vulnerability, a heap-based buffer overflow, occurs due to an integer overflow when `unexpand` processes unusually large tab stop values provided by a local attacker. This can lead to an undersized memory buffer, allowing subsequent operations to write beyond its boundaries. Successful exploitation can cause the `unexpand` utility to crash, potentially resulting in a denial of service or enabling further memory manipulation.

Statement: A Moderate impact heap-based buffer overflow flaw was found in the `unexpand` utility of GNU coreutils. This vulnerability arises from an integer overflow when processing unusually large tab stop values, leading to an undersized buffer. A local attacker could exploit this by providing crafted input, causing the utility to crash and potentially leading to a denial of service or arbitrary memory manipulation.

Upstream repository: https://git.savannah.gnu.org/cgit/coreutils.git
Upstream fix commit: b60a159fdc5bfcf9988d3a4cb6f53abe8ad5d35d
CVE-2026-5713: python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.
Component: python
Severity: Moderate
CWE: CWE-822 (Untrusted Pointer Dereference)
CVSS v3: 6 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:N)
Public date: 2026-04-14T15:11:51.122000+00:00

A flaw was found in Python. A malicious Python process could exploit the "profiling.sampling" module and "asyncio introspection capabilities" to read and write memory addresses within a privileged process. This vulnerability occurs when the privileged process connects to the malicious process via its remote debugging feature, potentially leading to information disclosure and arbitrary code execution. Successful exploitation requires repeated connections, which may cause instability in the connecting process.


Affected upstream versions: 3.14.0 < 3.14.5, 3.15.0a1 < 3.15.0b1
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67
CVE-2026-57231: podman: Podman: Information disclosure via malicious container image environment variables
Component: podman
Severity: Important
CWE: CWE-914 (Improper Control of Dynamically-Identified Variables)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-06-26T16:29:02.092000+00:00

A flaw was found in Podman, a tool for managing OCI containers and pods. A malicious container image can be crafted with an environment variable that has a key but no value, or an asterisk (*), to trick Podman. This vulnerability causes Podman to pass host environment variables into the container. Consequently, a malicious image could exfiltrate all Podman environment variables set in the session from which the container is launched, leading to information disclosure.


Affected upstream versions: >= 1.8.1, < 5.8.4
Upstream repository: https://github.com/podman-container-tools/podman
Upstream fix commit: 6c431b73dbf8e4b20b778644d7a80caebdb75050
CVE-2026-57452: vim: Vim: Out-of-bounds Read with libsodium-encrypted Files
Component: vim
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-06-25T15:27:50.147000+00:00

A flaw was found in Vim, an open source command-line text editor. When opening a specially crafted encrypted file using the VimCrypt~04! or VimCrypt~05! methods, an attacker could trigger an unsigned length calculation error. This issue leads to an out-of-bounds read, causing Vim to crash and resulting in a denial of service.

Statement: This Moderate impact vulnerability in Vim arises from an out-of-bounds read when processing a specially crafted libsodium-encrypted file. If a user opens a malicious file encrypted with VimCrypt~04! or VimCrypt~05! and the file body is shorter than a single libsodium secretstream header, Vim may crash. This issue requires user interaction to open a malformed file and the +sodium feature to be enabled, limiting its exploitability in typical Red Hat environments.

Affected upstream versions: < 9.2.0671
Fixed upstream versions: v9.2.0671
Upstream repository: https://github.com/vim/vim
Upstream fix commit: c8777cec25dcfae89c42e9aff51af61f71c5745f
CVE-2026-57455: vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()
Component: vim
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-06-25T15:22:37.949000+00:00

A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.

Statement: This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.

Affected upstream versions: < 9.2.0698
Fixed upstream versions: v9.2.0698
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 497f931f85339d175d7f69588dd249e8ccfed41b
CVE-2026-57456: vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion
Component: vim
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-06-25T15:16:16.015000+00:00

There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.

Statement: This flaw is rated as Important. A vulnerability in Vim's Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.

Affected upstream versions: < 9.2.0699
Fixed upstream versions: v9.2.0699
Upstream repository: https://github.com/vim/vim
Upstream fix commit: cce141c42740f122dd8486ae04e21c2a81016ba8
CVE-2026-58055: nghttp2: nghttp2: HTTP Request/Response Smuggling and Response-Queue Poisoning via ambiguous HTTP/1.1 Upgrade requests
Component: nghttp2
Severity: Moderate
CWE: CWE-444 (Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'))
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
Public date: 2026-06-28T01:32:57.163000+00:00

A flaw in nghttp2's nghttpx proxy allows a remote attacker to perform HTTP request smuggling and cross-client response-queue poisoning. This occurs because the proxy ambiguously forwards HTTP/1.1 Upgrade requests that contain a Content-Length header to reusable keep-alive backend connections.

Statement: A flaw in nghttp2's nghttpx proxy allows remote HTTP request smuggling and cross-client response poisoning by forwarding malformed HTTP/1.1 Upgrade requests containing a Content-Length body. This is rated Moderate because successful exploitation requires high attack complexity on the backend server.

Affected upstream versions: <= v1.69.0
Fixed upstream versions: v1.70.0
Upstream repository: https://github.com/nghttp2/nghttp2
Upstream fix commit: ab28105c4a0197da24f8bfc414bc116055249e1e
CVE-2026-58379: gimp: gimp: Heap buffer overflow in read_channel_data()
Component: gimp
Severity: Important
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-04-11T00:00:00+00:00

A flaw was found in GIMP's Paint Shop Pro (PSP) file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service (DoS) by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the software incorrectly calculates buffer sizes when processing low bit-depth images, leading to an overwrite of adjacent memory.

Statement: This is an Important severity flaw in GIMP's Paint Shop Pro (PSP) file format parser. A heap buffer overflow can occur when processing a specially crafted PSP file, potentially leading to arbitrary code execution or denial of service. Exploitation requires user interaction, as a malicious file must be opened by the GIMP application.

Affected upstream versions: <= GIMP_19990910
Fixed upstream versions: 2:3.0.4-4.el9_8.5
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: b630f167
CVE-2026-58380: gimp: gimp: Stack buffer overflow in pnmscanner_gettoken()
Component: gimp
Severity: Moderate
CWE: CWE-193 (Off-by-one Error)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-04-11T00:00:00+00:00

A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscanner_gettoken() function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

Statement: This Moderate flaw in GIMP's PNM file parser could lead to memory corruption and potentially arbitrary code execution or denial of service. The vulnerability requires a user to open a specially crafted PNM image file with GIMP. As a desktop application, the impact is limited to the user's session and requires user interaction.

Affected upstream versions: <= GIMP_19990910
Fixed upstream versions: 2:3.0.4-4.el9_8.7
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: 83699817
CVE-2026-58384: gimp: gimp: Integer overflow in read_RLE_channel()
Component: gimp
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-04-11T00:00:00+00:00

A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitrary code execution.

Statement: A flaw was found in GIMP's PSD parser. An integer overflow in read_RLE_channel() can make the RLE row-length allocation too small and lead to heap memory corruption during subsequent row processing. Successful exploitation requires a user to open a specially crafted PSD file.

Affected upstream versions: <= GIMP_19990910
Fixed upstream versions: 2:3.0.4-4.el9_8.7
Upstream repository: https://gitlab.gnome.org/GNOME/gimp
Upstream fix commit: da29e217
CVE-2026-59724: engine.io: Engine.IO: Denial of Service via crafted WebTransport session ID
Component: engine.io
Severity: Important
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T15:35:39.813000+00:00

A flaw was found in Engine.IO. When Engine.IO servers have WebTransport enabled, a remote attacker can craft a session ID to resolve an inherited property of the clients object during WebTransport upgrade handling. This can lead to a TypeError, resulting in a denial of service (DoS) for the server. This vulnerability impacts the availability of the service.

Statement: This flaw has been rated as Important. When Engine.IO servers have WebTransport enabled, a remote attacker can trigger a denial of service. This occurs by sending a crafted session ID that resolves an inherited property during WebTransport upgrade handling, leading to a TypeError and impacting service availability.

Affected upstream versions: >= 6.5.0, < 6.6.7
Fixed upstream versions: socket.io-adapter@2.5.7
Upstream repository: https://github.com/socketio/socket.io
Upstream fix commit: 1fa1f46cd420ac5b57bb4c04c959b58f3c79158c
CVE-2026-59725: socket.io: engine.io: Socket.IO: Denial of Service via invalid binary POST requests
Component: socket.io
Severity: Important
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T15:37:52.293000+00:00

A flaw was found in Socket.IO, specifically within the Engine.IO protocol v4 polling transport. An unauthenticated attacker can exploit this vulnerability by sending invalid binary POST requests with a Content-Type of application/octet-stream. This improper handling of requests prevents the HTTP response from being properly closed, which can lead to the exhaustion of server-side connections and sockets. The primary consequence is a Denial of Service (DoS), making the affected service unavailable to legitimate users.

Statement: This flaw has been rated as Important. An unauthenticated remote attacker can exploit a vulnerability in the Engine.IO protocol v4 polling transport of Socket.IO by sending malformed binary POST requests. This can lead to server-side connection exhaustion and a denial of service, impacting the availability of applications utilizing Socket.IO.

Affected upstream versions: >= 4.1.0, < 6.6.7
Fixed upstream versions: socket.io-adapter@2.5.7
Upstream repository: https://github.com/socketio/socket.io
Upstream fix commit: fc11285e14964c2132d122164bf130c355f60671
CVE-2026-59856: vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion
Component: vim
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L)
Public date: 2026-07-09T22:39:01.803000+00:00

A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.

Statement: Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk."

Affected upstream versions: < 9.2.0736
Fixed upstream versions: v9.2.0736
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 43afc581a37a35762dd0ef292f038b9dc5680a24
CVE-2026-59857: vim: Vim: Denial of Service via out-of-bounds write in spell sound-folding
Component: vim
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-07-09T22:34:54.698000+00:00

An out-of-bounds write vulnerability in Vim's spell_soundfold_sal() function allows an attacker to corrupt memory and crash the editor (Denial of Service) by supplying a specially crafted word during spell sound-folding.

Statement: This Moderate impact flaw in Vim's spell sound-folding feature can lead to a denial of service. A local attacker could provide a specially crafted word, causing an out-of-bounds write and crashing the editor. This vulnerability primarily affects interactive users of the Vim text editor.

Affected upstream versions: < 9.2.0725
Fixed upstream versions: v9.2.0725
Upstream repository: https://github.com/vim/vim
Upstream fix commit: d22ff1c955ff87e8273210eae125aab0e85b6c30
CVE-2026-59858: vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion
Component: vim
Severity: Moderate
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 6.5 (CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2026-07-09T22:37:52.789000+00:00

A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.

Statement: This Moderate flaw in Vim's C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.

Affected upstream versions: < 9.2.0735
Fixed upstream versions: v9.2.0735
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 6b611b0d15603c52ebdad17172b0232b4f65704e
CVE-2026-59868: js-yaml: js-yaml: Denial of Service via quadratic CPU time parsing with merge keys
Component: js-yaml
Severity: Important
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T15:18:19.422000+00:00

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. When merge keys are enabled, a remote attacker could exploit this vulnerability by crafting a YAML document where a chain of mappings uses merge keys, each merging the previous one. This can lead to a significant increase in CPU time required to parse the document, resulting in a Denial of Service (DoS) for the affected system.

Statement: js-yaml versions 5.0.0 through 5.1.x are vulnerable to a denial of service. When merge keys ('<<') are enabled during YAML parsing, js-yaml re-merges the accumulated mapping into each subsequent mapping in a chain. A document consisting of a linear chain of mappings that each merge the previous one causes quadratic (O(n^2)) CPU consumption relative to input size, even though the document size itself grows only linearly. This can be triggered via yaml.load() on untrusted YAML input that uses merge keys. Fixed in js-yaml 5.2.0.

Affected upstream versions: >= 5.0.0, < 5.2.0
Fixed upstream versions: 5.2.0
Upstream repository: https://github.com/nodeca/js-yaml
Upstream fix commit: 3105455b81dee69e0fd36e09ac0b2ccfdb54adc1
CVE-2026-59869: js-yaml: js-yaml: Denial of Service via crafted YAML documents
Component: js-yaml
Severity: Important
CWE: CWE-606 (Unchecked Input for Loop Condition)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T15:15:54.675000+00:00

A flaw was found in js-yaml, a JavaScript YAML parser and dumper. A remote attacker could exploit this vulnerability by providing a specially crafted YAML document containing a chain of mappings with merge keys. This could cause the parser to consume excessive CPU resources, leading to a Denial of Service (DoS) for the affected system.

Statement: This vulnerability is rated as Important. Red Hat products utilizing `js-yaml` to process untrusted YAML input are susceptible to a denial of service, as a remote attacker can provide a crafted document that consumes excessive CPU resources. This is considered Important due to the potential for service disruption without requiring authentication or complex attack vectors.

Affected upstream versions: >= 3.0.0, < 3.15.0, >= 4.0.0, < 4.3.0
Fixed upstream versions: 3.15.0
Upstream repository: https://github.com/nodeca/js-yaml
Upstream fix commit: 24f13e79ee1343a7e30bd6f6c9d9cdbf0ac9b2b7
CVE-2026-59870: js-yaml: js-yaml: Denial of Service via crafted YAML ordered-map document
Component: js-yaml
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T15:13:20.308000+00:00

A flaw was found in js-yaml, a JavaScript YAML (YAML Ain't Markup Language) parser. An attacker could exploit this by providing a specially crafted YAML ordered-map document. This could lead to excessive CPU consumption, resulting in a denial of service (DoS) for applications processing the malicious YAML input.

Statement: js-yaml versions 5.0.0 through 5.2.0 are vulnerable to a denial of service via the omapTag.addItem() O(n^2) duplicate-key scan when parsing crafted YAML ordered-map documents with the YAML11_SCHEMA. This affects yaml.load() calls using that schema. Fixed in 5.2.1.

Affected upstream versions: >= 5.0.0, < 5.2.1
Fixed upstream versions: 5.2.1
Upstream repository: https://github.com/nodeca/js-yaml
Upstream fix commit: 39f3211a2f01b3c6982710cf21434ab7060acefe
CVE-2026-59873: tar: node-tar: Denial of Service via crafted gzip bomb
Component: tar
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T15:22:40.077000+00:00

A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.

Statement: This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library's archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.

Affected upstream versions: < 7.5.19
Fixed upstream versions: v7.5.19
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: 2812e9338665659b183aa7226518c307044957d3
CVE-2026-59874: tar: Node-tar: Denial of Service via malformed tar archive header
Component: tar
Severity: Important
CWE: CWE-606 (Unchecked Input for Loop Condition)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T15:23:47.527000+00:00

A flaw was found in node-tar, a tar archive manipulation library for Node.js. A remote attacker could exploit this vulnerability by providing a specially crafted tar archive with a negative entry size in its header. This malformed header causes the archive scanner to enter an infinite loop, repeatedly parsing the same header and preventing further processing. This can lead to a denial of service (DoS) condition, making the affected system or application unresponsive.

Statement: This Important denial of service flaw in node-tar affects Red Hat products that process untrusted tar archives. A remote attacker can provide a specially crafted archive with a malformed header, leading to an infinite loop during parsing and causing the application to become unresponsive. This can impact the availability of services relying on node-tar for archive manipulation.

Affected upstream versions: < 7.5.18
Fixed upstream versions: v7.5.18
Upstream repository: https://github.com/isaacs/node-tar
Upstream fix commit: 9e78bf058b2c22dd4d52e00d8922d5c06fc2f7b5