huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-59884: python-pyasn1: pyasn1: Denial of Service via crafted BER input
Component: python-pyasn1
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-14T16:41:10.277000+00:00

A flaw was found in pyasn1, a generic ASN.1 library for Python. The Basic Encoding Rules (BER) decoder, used by CER and DER codecs, processes long-form tags by accumulating continuation octets without an upper bound. A remote attacker can exploit this by providing a specially crafted input, leading to the construction of an arbitrarily large integer. This can cause the CPU cost to grow quadratically, resulting in a Denial of Service (DoS) for any application decoding untrusted BER, CER, or DER input.

Statement: A flaw was found in pyasn1's BER decoder. The decoder parses long-form tags by accumulating continuation octets without an upper bound, allowing crafted input to force construction of an arbitrarily large integer with quadratic CPU cost. On Python 3.11+, this can also trigger unhandled ValueError exceptions. Exploitation requires that an application passes untrusted BER, CER, or DER input directly to the pyasn1 decoder — pyasn1 is a library and does not independently accept network input. Many common uses of pyasn1 involve parsing trusted certificates or local configuration and are not exposed to this flaw. The realistic impact is a denial-of-service of the consuming Python process, with automatic recovery in typical service deployments.

Affected upstream versions: < 0.6.4
Fixed upstream versions: v0.6.4
Upstream repository: https://github.com/pyasn1/pyasn1
Upstream fix commit: 628e36ecbb5277a3f01572ce418ef54271b165a5
CVE-2026-59885: pyasn1: python-pyasn1: pyasn1: Denial of Service via crafted ASN.1 OBJECT IDENTIFIER
Component: pyasn1
Severity: Important
CWE: CWE-1050 (Excessive Platform Resource Consumption within a Loop)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-14T16:40:00.515000+00:00

A flaw was found in pyasn1, a Python library for Abstract Syntax Notation One (ASN.1). The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A remote attacker could exploit this by providing a specially crafted payload containing an OID with many arcs, leading to excessive CPU consumption and a denial of service (DoS) in applications that decode untrusted ASN.1 data. The corresponding encoders also exhibit this quadratic behavior when re-encoding attacker-supplied values.

Statement: A flaw was found in pyasn1. The BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs. A small crafted payload containing an OID with many arcs consumes excessive CPU per decode() call, allowing denial of service in applications that decode untrusted ASN.1 data (certificates, LDAP, SNMP, Kerberos). The corresponding encoders exhibit the same behavior when re-encoding attacker-supplied values. The arc-size limit introduced for CVE-2026-23490 does not mitigate this issue. This issue is fixed in pyasn1 version 0.6.4.

Affected upstream versions: < 0.6.4
Fixed upstream versions: v0.6.4
Upstream repository: https://github.com/pyasn1/pyasn1
Upstream fix commit: 45bdb19eb7df4b3780fe9c912c63e99bffc39dd9
CVE-2026-59886: pyasn1: pyasn1: Denial of Service via crafted ASN.1 REAL values
Component: pyasn1
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-14T16:38:29.691000+00:00

A remote attacker can exploit this by providing specially crafted BER/CER/DER-encoded ASN.1 data with a large exponent in the REAL value. When the application subsequently prints, logs, compares, or performs arithmetic on the decoded value, this can cause excessive CPU and memory consumption, leading to a denial of service (DoS).

Statement: This flaw in pyasn1, rated as Important, could lead to a denial of service in Red Hat products that process untrusted ASN.1 data. A remote attacker could send a specially crafted BER, CER, or DER encoded REAL value with a large exponent, causing applications to consume excessive resources during decoding operations such as printing, logging, or arithmetic, thereby rendering the service unavailable.

Affected upstream versions: < 0.6.4
Fixed upstream versions: v0.6.4
Upstream repository: https://github.com/pyasn1/pyasn1
Upstream fix commit: e60c691cb91addb8fcefa2f537e85ede6fb1e886
CVE-2026-59890: setuptools: setuptools: MANIFEST.in exclusion bypass in sdist via Unicode normalization collision (NFC/NFD)
Component: setuptools
Severity: Moderate
CWE: CWE-1025 (Comparison Using Wrong Factors)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)
Public date: 2026-07-08T16:02:07.519000+00:00

A flaw was found in setuptools, a Python package management tool. The FileList component, responsible for handling file exclusions, did not properly normalize Unicode file names when applying exclusion rules. This oversight could allow a specially crafted file name, using a different Unicode normalization form (NFD) on macOS APFS or HFS+ file systems, to bypass an intended exclusion rule (NFC). As a result, sensitive files that should have been excluded could be inadvertently included in a source distribution, leading to information disclosure.


Affected upstream versions: < 83.0.0
Fixed upstream versions: v83.0.0
Upstream repository: https://github.com/pypa/setuptools
Upstream fix commit: dd9f436a36486b4cb8a4c70a2321548b0be09b8f
CVE-2026-59939: httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies
Component: httplib2
Severity: Important
CWE: CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T19:34:05.150000+00:00

A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial of Service (DoS) by causing the client application to run out of memory and crash.

Statement: This Important vulnerability in `httplib2` allows a remote attacker to trigger a Denial of Service (DoS) in client applications. By sending a specially crafted, compressed HTTP response, a malicious server can cause the client to exhaust its memory due to unbounded decompression, leading to application crashes. This poses a significant risk to Red Hat products that use `httplib2` to process untrusted HTTP content.

Affected upstream versions: < 0.32.0
Fixed upstream versions: v0.32.0
Upstream repository: https://github.com/httplib2/httplib2
Upstream fix commit: 87581ad6cf752fe3da2090c59058261d2d00a427
CVE-2026-6019: python: Python: Cross-Site Scripting (XSS) vulnerability in http.cookies module
Component: python
Severity: Moderate
CWE: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Public date: 2026-04-22T19:28:08.720000+00:00

A flaw was found in Python's `http.cookies` module. The `Morsel.js_output()` function, responsible for generating JavaScript output for cookies, does not properly neutralize the `</script>` HTML sequence. This oversight could allow a remote attacker to inject malicious script into a web page, potentially leading to Cross-Site Scripting (XSS) attacks. Such an attack could result in information disclosure or arbitrary code execution within the user's browser.


Affected upstream versions: 3.14.0a1 < 3.14.5rc1, 3.15.0a1 < 3.15.0b1
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 76b3923d688c0efc580658476c5f525ec8735104
CVE-2026-6100: python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules
Component: python
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-13T17:15:47.606000+00:00

A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Statement: The severity of this flaw is somewhat mitigated on Red Hat platforms. By default processes are not executed with root user privilege and are limited in their scope which in turn limits the impact of this flaw.

Affected upstream versions: 3.14.0a1 < 3.14.5rc1, 3.15.0a1 < 3.15.0b1
Fixed upstream versions: v3.14.5
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 6a5f79c8d7bbf22b083b240910c7a8781a59437d
CVE-2026-64600: kernel: XFS data corruption using reflink
Component: kernel
Severity: Important
CWE: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-07-14T00:00:00+00:00

A flaw was found in the XFS filesystem. A race condition in the copy-on-write mechanism for reflinked files can cause writes to bypass the copy-on-write process and modify shared data blocks directly. As a result, data intended for a private copy may be written to the original shared location, corrupting the contents of other files that reference those blocks. A local attacker with read access to a file on an XFS filesystem with reflink enabled could exploit this flaw to corrupt files they do not have write access to, allowing content to be added to the target file. If properly exploited this vulnerability may lead to privilege escalations or arbitrary code execution.

Statement: This flaw affects XFS filesystems that have the reflink feature enabled (reflink=1), which is the default configuration for XFS filesystems created on Red Hat Enterprise Linux 8 and later. The issue is a race condition where internal file mapping information becomes stale during a lock cycle but is not refreshed before being used to determine whether data blocks are shared between files. Exploitation requires local access and read permission to the target file. Systems using XFS without reflink enabled, or using other filesystems such as ext4, are not affected. Red Hat Enterprise Linux 7 and earlier are not affected, as the reflink feature is not available on those versions.

Affected upstream versions: 4.11
Fixed upstream versions: 0, 5.15.212, 6.1.178, 6.12.96, 6.18.39, 6.6.145, 7.1.4, 7.2-rc4
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: dc11be133efca5fe3a2fb02b016dee825cc12f18
CVE-2026-7383: openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing
Component: openssl
Severity: Low
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. A signed integer overflow vulnerability exists when sizing the destination buffer for Unicode output. This can lead to a heap buffer overflow, which may result in a crash or potentially allow an attacker to execute arbitrary code. Exploitation requires an application to directly call specific functions with a large amount of attacker-controlled input.

Statement: Low impact. This flaw in OpenSSL's ASN1_mbstring_ncopy() function, leading to a heap buffer overflow, is difficult to exploit in typical Red Hat environments. Exploitation requires an application to directly call the vulnerable function with an extremely large, attacker-controlled input (over half a gigabyte), a scenario not present in standard OpenSSL certificate or network protocol handling.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21, 1.1.1 < 1.1.1zh, 1.0.2 < 1.0.2zq
Fixed upstream versions: 1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: d32350ae8ef7426718f5aa9e383d4b51398ee255
CVE-2026-7598: libssh2: integer overflow via large username or password arguments
Component: libssh2
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H)
Public date: 2026-05-01T21:30:11.006000+00:00

A flaw was found in the libssh2 library. A remote attacker can exploit an integer overflow vulnerability in the `userauth_password` function by manipulating the `username_len` or `password_len` arguments and cause a heap-based buffer overflow. This leads to a crash to the application linked to the library and potentially allows arbitrary code execution.

Statement: To exploit this flaw, an attacker needs to be able to supply an excessively large value to the arguments of the `userauth_password` function, typically to an application processing untrusted SSH authentication requests. The primary security impact of this issue is a crash to the application linked to the library due to memory corruption, potentially allowing arbitrary code execution.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this vulnerability has been rated with an important severity.

Affected upstream versions: 1.11.0, 1.11.1
Upstream repository: https://github.com/libssh2/libssh2
Upstream fix commit: 256d04b60d80bf1190e96b0ad1e91b2174d744b1
CVE-2026-8177: perl-XML-LibXML: XML::LibXML: Denial of Service via truncated UTF-8 in XML node names
Component: perl-XML-LibXML
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-10T20:48:51.816000+00:00

A flaw was found in XML::LibXML for Perl. A remote attacker could exploit this vulnerability when processing specially crafted XML node names containing incomplete UTF-8 character sequences. This can lead to an out-of-bounds read in heap memory, potentially causing the application to crash and resulting in a denial of service.

Statement: A flaw was found in perl-XML-LibXML. The XML::LibXML module reads out-of-bounds heap memory when parsing XML node names containing truncated UTF-8 byte sequences. A node name ending in the middle of a multi-byte UTF-8 sequence causes the parser to read past the end of the input string into adjacent heap memory. Any Perl process that passes attacker-controlled strings to XML::LibXML's DOM node-name methods can trigger this flaw, with the likely consequence being a crash causing denial of service. The vulnerability is in the perl-XML-LibXML package specifically, not in the core perl interpreter. In containerised or pod-based deployments, the availability impact may be reduced since crashed processes are typically auto-restarted by the container orchestrator.

Upstream repository: https://github.com/cpan-authors/XML-LibXML
Upstream fix commit: 15652bd905a6c9dda59a81b14d4766adbbae2ea8
CVE-2026-8450: perl-HTTP-Daemon: HTTP::Daemon: Arbitrary code execution via OS command injection in send_file()
Component: perl-HTTP-Daemon
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T04:22:26.539000+00:00

A flaw was found in HTTP::Daemon, a Perl module used for creating HTTP servers. A remote attacker can exploit this vulnerability by providing specially crafted input to the `send_file()` function, leading to OS command injection. This allows the attacker to execute arbitrary commands on the system with the privileges of the daemon process, potentially resulting in full system compromise or data manipulation.

Statement: This is rated as an Important security flaw becaye the function utilizes an insecure 2-argument open() call that interprets shell-magic characters (such as pipes or redirects) inside file paths. In a non-default configuration where a custom application passes untrusted user input directly to this function, a remote attacker could exploit this flaw to read or write arbitrary files, or potentially execute commands within the context of the daemon's local system user.

Affected upstream versions: <= v6.15
Fixed upstream versions: 6.17
Upstream repository: https://github.com/libwww-perl/HTTP-Daemon
Upstream fix commit: 945d35141d94490f749640bd4390acd6a2193995
CVE-2026-8643: python-pip: Path traversal via malicious entry point name in pip wheel installation allows arbitrary file overwrite
Component: python-pip
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-05-27T17:03:36.585000+00:00

A flaw was found in pip, the package installer for Python. A remote attacker can exploit this vulnerability by tricking a victim into installing a malicious Python wheel. This wheel contains specially crafted entry-point names that use directory traversal or absolute paths. This allows pip to write generated script wrappers outside the intended installation directory, leading to arbitrary file overwrite. This can severely impact system integrity and availability, and in certain scenarios, may lead to arbitrary code execution.

Statement: This Important flaw in pip's wheel installation process allows for arbitrary file overwrite due to path traversal. An attacker could exploit this by convincing a user to install a specially crafted malicious Python wheel. While file overwrites are limited to the installing user's permissions, using `pip install` with elevated privileges in Red Hat environments significantly increases the potential impact, potentially leading to system integrity compromise or arbitrary code execution.

Affected upstream versions: 24.0 < 26.1.2
Fixed upstream versions: 26.1.2
Upstream repository: https://github.com/pypa/pip
Upstream fix commit: 8eb178480bd1a2b223f509fc430796b265158dfb
CVE-2026-9076: openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption
Component: openssl
Severity: Low
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-09T00:00:00+00:00

A flaw was found in OpenSSL. When processing attacker-supplied Cryptographic Message Syntax (CMS) data using password-based decryption, an attacker can choose a stream-mode Key Encryption Key (KEK) cipher. This can trigger a heap out-of-bounds read, potentially causing an application crash and leading to a Denial of Service (DoS). This vulnerability does not require password knowledge and can be exploited before authentication.

Statement: This is a Low impact denial of service due to a heap out-of-bounds read in `kek_unwrap_key()` when processing attacker-supplied CMS data with an attacker-chosen stream-mode KEK cipher. This flaw requires specific memory conditions (input buffer ending at a page boundary with an unmapped following page) to trigger a crash, which is uncommon in typical Red Hat environments. No information disclosure is possible, and FIPS modules are not affected.

Affected upstream versions: 4.0.0 < 4.0.1, 3.6.0 < 3.6.3, 3.5.0 < 3.5.7, 3.4.0 < 3.4.6, 3.0.0 < 3.0.21, 1.1.1 < 1.1.1zh, 1.0.2 < 1.0.2zq
Fixed upstream versions: 1.0.2zq, 1.1.1zh, 3.0.21, 3.4.6, 3.5.7, 3.6.3, 4.0.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 3d8d5bc1056b2f62da9fede23fedbf47e85187b0
CVE-2026-9277: shell-quote: shell-quote: Arbitrary code execution via command injection due to unescaped line terminators
Component: shell-quote
Severity: Important
CWE: CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-05-22T13:22:38.873000+00:00

A flaw was found in the shell-quote component. The quote() function did not properly validate object-token inputs, allowing line terminators to pass unescaped into the output. A remote attacker could exploit this vulnerability by providing specially crafted input, which a POSIX shell would interpret as a command separator. This could lead to command injection, enabling the attacker to execute arbitrary code on the system.


Affected upstream versions: 1.1.0 < 1.8.4
Fixed upstream versions: 1.8.4
Upstream repository: https://github.com/ljharb/shell-quote
Upstream fix commit: 1518179
CVE-2026-9358: postcss-selector-parser: Postcss: Denial of Service via uncontrolled recursion in AST Serialization
Component: postcss-selector-parser
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L)
Public date: 2026-05-24T05:30:09.671000+00:00

A flaw was found in postcss. A remote attacker could exploit a vulnerability in the `toString` function of the AST Serialization component by executing a manipulation, leading to uncontrolled recursion. This uncontrolled recursion can result in a Denial of Service (DoS) condition, making the affected system unavailable.

Statement: Moderate: This flaw in Postcss can lead to a denial of service (DoS) in applications that process untrusted CSS. The vulnerability arises from uncontrolled recursion in the AST Serialization component when handling specially crafted CSS. Exploitation requires user interaction, such as submitting attacker-controlled CSS, which reduces the risk in environments where CSS is typically pre-compiled or not directly user-modifiable.

Affected upstream versions: 6.1.0, 6.1.1, 6.1.2, 7.1.0, 7.1.1, 7.1.2
Fixed upstream versions: 6.1.3, 7.1.3
Upstream repository: https://github.com/postcss/postcss-selector-parser
Upstream fix commit: 5bc698cef66f8abd12610dc623e5d67cbc0f869d
CVE-2026-9673: json-2-csv: json-2-csv: CSV Injection vulnerability allows arbitrary code execution via `preventCsvInjection` bypass.
Component: json-2-csv
Severity: Moderate
CWE: CWE-1236 (Improper Neutralization of Formula Elements in a CSV File)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:N)
Public date: 2026-05-28T05:00:02.387000+00:00

A flaw was found in json-2-csv. An attacker can bypass the `preventCsvInjection` option to inject malicious formulas into CSV (Comma Separated Values) files. When these manipulated CSV files are opened in spreadsheet applications, the injected formulas can execute, potentially leading to arbitrary code execution or information disclosure.

Statement: This Moderate vulnerability in `json-2-csv` allows for CSV Injection due to a bypass in the `preventCsvInjection` option. While exploitation requires a user to open a specially crafted CSV file in a spreadsheet application, successful attacks could lead to arbitrary code execution or information disclosure. This affects Red Hat Developer Hub and Red Hat Ansible Automation Platform when processing untrusted data that is subsequently exported to CSV and opened by a user.

Affected upstream versions: 3.15.0 < 5.5.11
Fixed upstream versions: *, 5.5.11
Upstream repository: https://github.com/mrodrig/json-2-csv
Upstream fix commit: 0fdd0bb6d0273178cd940afc323ccbce19688229