huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-71116: kernel: libceph: make decode_pool() more resilient against corrupted osdmaps
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.1 (CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2026-01-14T00:00:00+00:00

In the Linux kernel, the following vulnerability has been resolved:

libceph: make decode_pool() more resilient against corrupted osdmaps

If the osdmap is (maliciously) corrupted such that the encoded length
of ceph_pg_pool envelope is less than what is expected for a particular
encoding version, out-of-bounds reads may ensue because the only bounds
check that is there is based on that length value.

This patch adds explicit bounds checks for each field that is decoded
or skipped.

Statement: The Ceph client could perform out-of-bounds reads when decoding a corrupted or maliciously crafted osdmap, because the parser trusted length fields without validating each decoded or skipped element. This allows a remote Ceph peer to crash the kernel and cause a denial of service.
Although this issue is triggered over an authenticated Ceph connection, the attack direction is from the server side (OSD/monitor) to the client. Any compromised or malfunctioning Ceph node can provide a malformed osdmap that is parsed in the kernel, breaking Ceph’s security model which assumes that no cluster component should be able to crash or compromise a client, even over an authorized channel.

Affected upstream versions: 3.9
Fixed upstream versions: 0, 5.10.248, 5.15.198, 6.1.160, 6.12.64, 6.18.3, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: d061be4c8040ffb1110d537654a038b8b6ad39d2
CVE-2025-71117: kernel: Linux kernel: Denial of Service via deadlock in block layer sysfs store callbacks
Component: kernel
Severity: Low
CWE: CWE-833 (Deadlock)
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-14T00:00:00+00:00

A flaw was found in the Linux kernel. A local user could exploit a vulnerability where freezing the request queue within certain sysfs store callbacks can lead to a deadlock. This issue may occur when combined with the device-mapper multipath (dm-multipath) driver and the `queue_if_no_path` option, or when sysfs attributes are set synchronously. Successful exploitation could result in a Denial of Service (DoS) by making the system unresponsive.

Statement: This CVE is rated as Low because write access to sysfs files requires root privileges under RHEL default configurations.

Affected upstream versions: 6.11
Fixed upstream versions: 0, 6.18.3, 6.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3997b3147c7b68b0308378fa95a766015f8ceb1c
CVE-2025-71147: kernel: Linux kernel: Denial of Service due to memory leak in tpm2_load_cmd
Component: kernel
Severity: Moderate
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-23T00:00:00+00:00

A flaw was found in the Linux kernel's trusted keys subsystem. A local user could exploit a memory leak in the `tpm2_load_cmd` function, which fails to free a temporary memory allocation in certain error scenarios. This memory leak could lead to a system-wide Denial of Service (DoS) by exhausting available memory resources.


Affected upstream versions: 5.13
Fixed upstream versions: 0, 5.15.198, 6.1.160, 6.12.64, 6.18.3, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 3fd7df4636d8fd5e3592371967a5941204368936
CVE-2025-71151: kernel: cifs: Fix memory and information leak in smb3_reconfigure()
Component: kernel
Severity: Low
CWE: CWE-772 (Missing Release of Resource after Effective Lifetime)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-23T00:00:00+00:00

A memory and information leak vulnerability was found in the Linux kernel's CIFS/SMB3 filesystem driver. When smb3_reconfigure() fails during smb3_sync_session_ctx_passwords(), the newly allocated password buffers (new_password and new_password2) are not freed or securely erased. This causes a memory leak and leaves sensitive password data in kernel memory that could potentially be exposed.

Statement: This vulnerability affects systems using CIFS/SMB3 filesystem mounts with password-based authentication. The password buffers remain in kernel memory after the error, creating an information disclosure risk if kernel memory can be read through other means. The memory leak accumulates with each failed reconfigure operation.

Affected upstream versions: 6.6.64 < 6.6.120, 6.12.2 < 6.12.64, 6.11.11 < 6.12, 6.13
Fixed upstream versions: 0, 6.12, 6.12.64, 6.18.3, 6.19, 6.6.120
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: bc390b2737205163e48cc1655f6a0c8cd55b02fc
CVE-2025-71201: kernel: netfs: Fix early read unlock of page with EOF in middle
Component: kernel
Severity: Moderate
CWE: CWE-826 (Premature Release of Resource During Expected Lifetime)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-02-14T00:00:00+00:00

A race condition flaw was found in the Linux kernel's netfs subsystem. In the netfs_read_unlock_folios() function, a folio (memory page) may be unlocked prematurely before the ZERO subrequest completes clearing the tail portion of the page beyond the end-of-file. This allows an application using mmap to observe uninitialized kernel memory contents in the uncleared tail region, potentially leading to information disclosure.

Statement: This flaw primarily affects network filesystems using the netfs helper library, particularly 9P which uses synchronous reads. AFS and CIFS are less likely to exhibit this behavior due to their asynchronous read dispatch. The information disclosure is limited to uninitialized page contents and requires specific file sizes and mmap access patterns.

Affected upstream versions: 6.14
Fixed upstream versions: 0, 6.18.6, 6.19
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 5b5482c0e5ee740b35a70759d3582477aea8e8e4
CVE-2025-71238: kernel: Linux kernel (qla2xxx): Double free vulnerability leads to denial of service and potential privilege escalation.
Component: kernel
Severity: Moderate
CWE: CWE-672 (Operation on a Resource after Expiration or Release)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2026-03-04T00:00:00+00:00

A flaw was found in the Linux kernel's `qla2xxx` block SCSI generic (bsg) interface. This vulnerability, a double free, occurs because certain vendor-specific handlers incorrectly call the `bsg_job_done` function on both successful and failed operation paths. A local user could exploit this to trigger memory corruption, leading to a kernel crash and a Denial of Service (DoS). There is also a theoretical risk of local privilege escalation due to the memory corruption.

Statement: A kernel double free can be triggered in the qla2xxx bsg interface because some vendor specific handlers called bsg_job_done on both success and failure paths. This can result in the same bsg job being completed and freed twice which leads to memory corruption and a kernel crash. The issue is not network reachable. Impact is denial of service and there is a theoretical risk of local privilege escalation because the flaw is a kernel memory corruption condition.

Affected upstream versions: 5.7
Fixed upstream versions: 0, 5.10.251, 5.15.201, 6.1.164, 6.12.74, 6.18.13, 6.19.3, 6.6.127, 7.0
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 057a5bdc481e58ab853117254867ffb22caf9f6e
CVE-2025-7338: multer: Multer Denial of Service
Component: multer
Severity: Moderate
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-17T15:26:45.427000+00:00

A denial of service vulnerability was found in the Multer NPM library. This vulnerability allows an attacker to trigger a denial of service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, resulting in a process crash.


Affected upstream versions: 1.4.4-lts.1 < 2.0.2
Fixed upstream versions: 2.0.2
Upstream repository: https://github.com/expressjs/multer
Upstream fix commit: adfeaf669f0e7fe953eab191a762164a452d143b
CVE-2025-7339: on-headers: on-headers vulnerable to http response header manipulation
Component: on-headers
Severity: Low
CWE: CWE-241 (Improper Handling of Unexpected Data Type)
CVSS v3: 3.4 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N)
Public date: 2025-07-17T15:47:39.680000+00:00

A header modification flaw has been discovered in the on-headers npm library. In specific cases, response headers may be inadvertently modified when an array is passed to `response.writeHead()`.


Affected upstream versions: <= v1.0.2
Fixed upstream versions: 1.1.0
Upstream repository: https://github.com/jshttp/on-headers
Upstream fix commit: c6e384908c9c6127d18831d16ab0bd96e1231867
CVE-2025-7647: llama-index-core: Insecure Temporary File Handling in run-llama/llama_index
Component: llama-index-core
Severity: Important
CWE: CWE-378 (Creation of Temporary File With Insecure Permissions)
CVSS v3: 8.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-09-27T16:34:36.938000+00:00

A flaw was found in llama-index-core where the get_cache_dir() function creates a hardcoded /tmp/llamda_index directory without secure permissions or user isolation. On Linux systems with multiple users, this allows attackers to steal cached models, poison embeddings, or perform symlink attacks leading to information disclosure or data corruption.

Statement: The impact is IMPORTANT because this flaw affects confidentiality, integrity and availability. An attacker on the same vulnerable system can copy cached model files, poison embeddings to manipulate AI outputs, or create symlinks to overwrite important files. The issue exists in all versions up to and including 0.12.44 and is caused by insecure temporary directory creation and missing permission controls in /tmp.

Affected upstream versions: unspecified < v0.13.0
Fixed upstream versions: v0.13.0
Upstream repository: https://github.com/run-llama/llama_index
Upstream fix commit: 98816394d57c7f53f847ed7b60725e69d0e7aae4
CVE-2025-7738: python3.11-django-ansible-base: Sensitive Authenticator Secrets Returned in Clear Text via API in AAP
Component: python3.11-django-ansible-base
Severity: Moderate
CWE: CWE-312 (Cleartext Storage of Sensitive Information)
CVSS v3: 4.4 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-07-17T00:00:00+00:00

A flaw was found in Ansible Automation Platform (AAP) where the Gateway API returns the client secret for certain GitHub Enterprise authenticators in clear text. This vulnerability affects administrators or auditors accessing authenticator configurations. While access is limited to privileged users, the clear text exposure of sensitive credentials increases the risk of accidental leaks or misuse.

Statement: The Red Hat Product Security team has assessed this issue as a Moderate severity. The vulnerability is limited to authenticated and highly privileged users (administrators and auditors), and exploitation does not require user interaction. However, the exposure of OAuth2 client secrets in plain text increases the risk of accidental disclosure or misuse in scenarios involving insider threats or compromised accounts.

Affected upstream versions: <= 2025.7.1
Fixed upstream versions: 0:2.5.20250730-1.el8ap, 0:2.5.20250730-1.el9ap, 2025.7.22
Upstream repository: https://github.com/ansible/django-ansible-base
Upstream fix commit: e241ea4dce8df577eda15301e0a8e61be647b27b
CVE-2025-7783: form-data: Unsafe random function in form-data
Component: form-data
Severity: Moderate
CWE: CWE-330 (Use of Insufficiently Random Values)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
Public date: 2025-07-18T16:34:44.889000+00:00

A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data.

This presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation.

Statement: This flaw does not affect host systems. The impact of this vulnerability is limited to specific applications which integrate the `form-data` library. As a result the impact of this CVE is limited on RedHat systems.

Affected upstream versions: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3
Fixed upstream versions: v4.0.4
Upstream repository: https://github.com/form-data/form-data
Upstream fix commit: 3d1723080e6577a66f17f163ecd345a21d8d0fd0
CVE-2025-8058: glibc: Double free in glibc
Component: glibc
Severity: Moderate
CWE: CWE-415 (Double Free)
CVSS v3: 4.2 (CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L)
Public date: 2025-07-23T19:57:17.138000+00:00

A double-free vulnerability has been discovered in glibc (GNU C Library). This flaw occurs during bracket expression parsing within the regcomp function, specifically when a memory allocation failure takes place. Exploitation of a double-free vulnerability can lead to memory corruption, which could enable an attacker to achieve arbitrary code execution or a denial of service condition.


Affected upstream versions: 2.4 < 2.42
Fixed upstream versions: 2.42
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 3ff17af18c38727b88d9115e536c069e6b5d601f
CVE-2025-8114: libssh: NULL Pointer Dereference in libssh KEX Session ID Calculation
Component: libssh
Severity: Moderate
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-24T00:00:00+00:00

A flaw was found in libssh, a library that implements the SSH protocol. When calculating the session ID during the key exchange (KEX) process, an allocation failure in cryptographic functions may lead to a NULL pointer dereference. This issue can cause the client or server to crash.

Statement: The Red Hat Product Security team has assessed the severity of this vulnerability as Moderate, due to its local attack vector and high complexity of exploitation. Although it requires specific allocation failure scenarios, successful exploitation can result in a crash of SSH clients or servers using libssh. This is caused by a NULL pointer dereference during the calculation of the KEX session ID.

Affected upstream versions: <= libssh-0.11.0
Fixed upstream versions: 0.11.3, 0:0.10.4-18.el9
Upstream repository: https://git.libssh.org/projects/libssh.git
Upstream fix commit: 53ac23ded4cb2c5463f6c4cd1525331bd578812d
CVE-2025-8176: libtiff: LibTIFF Use-After-Free Vulnerability
Component: libtiff
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-26T03:32:08.851000+00:00

A flaw was found in libtiff. The `get_histogram` function in `file/tiffmedian.c` exhibits a use-after-free condition when processing a specially crafted file, allowing a local attacker to trigger memory corruption. This manipulation results in a use-after-free vulnerability, and can lead to a denial of service.

Statement: This vulnerability has been rated Important because it involves a use-after-free flaw in the get_histogram function of LibTIFF’s tiffmedian tool. Successful exploitation may allow a local attacker to execute arbitrary code or cause a denial of service, leading to loss of confidentiality, integrity, and availability.

Affected upstream versions: 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7.0
Fixed upstream versions: v4.7.1
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: fe10872e53efba9cc36c66ac4ab3b41a839d5172
CVE-2025-8177: libtiff: LibTIFF Buffer Overflow
Component: libtiff
Severity: Important
CWE: CWE-120 (Buffer Copy without Checking Size of Input ('Classic Buffer Overflow'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-07-26T04:02:07.897000+00:00

A flaw was found in libtiff. The `setrow` function in `file tools/thumbnail.c` contains a buffer overflow vulnerability triggered by manipulation of image data, which can allow a local attacker to cause a denial of service. This overflow occurs when processing a crafted file. The vulnerability stems from insufficient bounds checking during row data assignment.

Statement: This vulnerability has been rated Important because it involves a buffer overflow in the setrow function of LibTIFF’s thumbnail tool, which could allow a local attacker to execute arbitrary code or cause a denial of service. While the attack requires local access, successful exploitation could result in loss of confidentiality, integrity, and availability of the affected system.

Affected upstream versions: 4.0, 4.1, 4.2, 4.3, 4.4, 4.5, 4.6, 4.7.0
Upstream repository: https://gitlab.com/libtiff/libtiff
Upstream fix commit: e8c9d6c616b19438695fd829e58ae4fde5bfbc22
CVE-2025-8194: cpython: Cpython infinite loop when parsing a tarfile
Component: cpython
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-07-28T18:42:44.847000+00:00

A flaw was found in the Python tarfile module. Processing a specially crafted tar archive, specifically an archive with negative offsets, can cause an infinite loop and deadlock. This issue results in a denial of service in the Python application using the tarfile module.

Statement: To exploit this issue, an attacker needs to be able to process a specially crafted tar archive with a Python application using the tarfile module. Furthermore, this vulnerability will cause a denial of service with no other security impact.

Affected upstream versions: 3.11.0 < 3.11.14, 3.12.0 < 3.12.12, 3.13.0 < 3.13.6, 3.14.0a1 < 3.14.0rc2
Fixed upstream versions: v3.15.0a1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 7040aa54f14676938970e10c5f74ea93cd56aa38
CVE-2025-8291: cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked
Component: cpython
Severity: Moderate
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N)
Public date: 2025-10-07T18:10:05.908000+00:00

A zip file handling flaw has been discovered in the python standard library `zipfile` module. The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.


Affected upstream versions: 3.11.0 < 3.11.14, 3.12.0 < 3.12.12, 3.13.0 < 3.13.10, 3.14.0 < 3.14.1
Fixed upstream versions: v3.15.0a1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 162997bb70e067668c039700141770687bc8f267
CVE-2025-9086: curl: libcurl: Curl out of bounds read for cookie path
Component: curl
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-09-12T05:10:03.815000+00:00

An out of bounds read flaw has been discovered in the curl project. Under specific conditions the path comparison logic makes curl read outside a heap buffer boundary. This bug either causes a crash or it potentially makes the comparison come to the wrong conclusion and lets the clear-text site override the contents of the secure cookie, contrary to expectations and depending on the memory contents immediately following the single-byte allocation that holds the path.


Affected upstream versions: 8.15.0 <= 8.15.0, 8.14.1 <= 8.14.1, 8.14.0 <= 8.14.0, 8.13.0 <= 8.13.0
Fixed upstream versions: curl-8_16_0
Upstream repository: https://github.com/curl/curl
Upstream fix commit: c6ae07c6a541e0e96d0040afb6
CVE-2025-9230: openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap
Component: openssl
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.6 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2025-09-30T23:59:00+00:00

A flaw was found in the OpenSSL CMS implementation (RFC 3211 KEK Unwrap). This vulnerability allows memory corruption, an application level denial of service, or potential execution of attacker-supplied code via crafted CMS messages using password-based encryption (PWRI).

Statement: The vulnerability was rated as Moderate because, while the potential impact includes an application level denial of service and possible arbitrary code execution, successful exploitation is considered unlikely due to the high attack complexity and the fact that password-based CMS encryption (PWRI) is rarely used in real-world deployments.

Affected upstream versions: 3.5.0 < 3.5.4, 3.4.0 < 3.4.3, 3.3.0 < 3.3.5, 3.2.0 < 3.2.6, 3.0.0 < 3.0.18, 1.1.1 < 1.1.1zd, 1.0.2 < 1.0.2zm
Fixed upstream versions: 1.0.2zm, 1.1.1zd, 3.0.18, 3.2.6, 3.3.5, 3.4.3, 3.5.4
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: bae259a211ada6315dc50900686daaaaaa55f482
CVE-2025-9231: openssl: Timing side-channel in SM2 algorithm on 64 bit ARM
Component: openssl
Severity: Moderate
CWE: CWE-208 (Observable Timing Discrepancy)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-09-30T23:59:00+00:00

A flaw was found in the OpenSSL SM2 algorithm implementation on 64-bit ARM platforms. This vulnerability allows recovery of the private key via timing side-channel analysis during signature computations.

Statement: The vulnerability was rated as Moderate because, while it could enable recovery of private keys through timing side-channel analysis on 64-bit ARM platforms, successful exploitation requires high-precision timing measurements and a specialized attack setup. OpenSSL does not natively support SM2 certificates in TLS, limiting the exposure in common use cases. The issue only becomes relevant in custom provider contexts where SM2 is enabled, further reducing the likelihood of widespread impact. Therefore, although the confidentiality impact is high if exploited, the practical attack complexity and limited applicability justify a Moderate severity rating.

Affected upstream versions: 3.5.0 < 3.5.4, 3.4.0 < 3.4.3, 3.3.0 < 3.3.5, 3.2.0 < 3.2.6
Fixed upstream versions: 3.2.6, 3.3.5, 3.4.3, 3.5.4
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: fc47a2ec078912b3e914fab5734535e76c4820c2