huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-66471: urllib3: urllib3 Streaming API improperly handles highly compressed data
Component: urllib3
Severity: Important
CWE: CWE-409 (Improper Handling of Highly Compressed Data (Data Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-05T16:06:08.531000+00:00

A decompression handling flaw has been discovered in urllib3. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.

Statement: This is an Important flaw in urllib3's streaming API that can lead to excessive resource consumption, including high CPU usage and significant memory allocation. When processing highly compressed data from untrusted sources, even small requested chunks can trigger full decompression, posing a denial-of-service risk to client-side applications utilizing affected urllib3 versions prior to 2.6.0.

Affected upstream versions: >= 1.0, < 2.6.0
Fixed upstream versions: 2.6.0
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: c19571de34c47de3a766541b041637ba5f716ed7
CVE-2025-66506: github.com/sigstore/fulcio: Fulcio: Denial of Service via crafted OpenID Connect (OIDC) token
Component: github.com/sigstore/fulcio
Severity: Important
CWE: CWE-405 (Asymmetric Resource Consumption (Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-04T22:04:41.637000+00:00

A flaw was found in Fulcio, a free-to-use certificate authority. This vulnerability allows a denial of service (DoS) due to excessive memory allocation when processing a malicious OpenID Connect (OIDC) identity token containing numerous period characters.

Statement: This vulnerability is rated Important for Red Hat as Fulcio, a certificate authority used for issuing code signing certificates, is susceptible to a denial of service when processing a specially crafted OpenID Connect (OIDC) token. This could lead to resource exhaustion and service unavailability in affected Red Hat products that utilize Fulcio.

Affected upstream versions: < 1.8.3
Fixed upstream versions: v1.8.3
Upstream repository: https://github.com/sigstore/fulcio
Upstream fix commit: 765a0e57608b9ef390e1eeeea8595b9054c63a5a
CVE-2025-66564: github.com/sigstore/timestamp-authority: Sigstore Timestamp Authority: Denial of Service via excessive OID or Content-Type header parsing
Component: github.com/sigstore/timestamp-authority
Severity: Important
CWE: CWE-405 (Asymmetric Resource Consumption (Amplification))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-04T22:37:13.307000+00:00

A flaw was found in Sigstore Timestamp Authority. This vulnerability allows a denial of service via excessive memory allocation when processing a specially crafted Object Identifier or Content-Type header.

Statement: This vulnerability is rated Important for Red Hat products. The Sigstore Timestamp Authority, a service for issuing RFC 3161 timestamps, is prone to excessive memory allocation. This occurs when processing untrusted OID payloads with many period characters or malformed Content-Type headers. An unauthenticated attacker could exploit this flaw to trigger a denial of service in affected Red Hat products that utilize this component.

Affected upstream versions: < 2.0.3
Fixed upstream versions: v2.0.3
Upstream repository: https://github.com/sigstore/timestamp-authority
Upstream fix commit: 0cae34e197d685a14904e0bad135b89d13b69421
CVE-2025-66566: lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing
Component: lz4-java
Severity: Important
CWE: CWE-908 (Use of Uninitialized Resource)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-12-05T18:10:16.470000+00:00

A flaw was found in lz4-java. This vulnerability allows disclosure of sensitive data via crafted compressed input due to insufficient clearing of the output buffer in Java-based decompressor implementations.

Statement: This vulnerability is rated IMPORTANT because it allows for information disclosure when Java-based decompressor implementations reuse output buffers without proper clearing, potentially exposing sensitive data via crafted compressed input. JNI-based implementations of lz4-java are not affected by this issue.

Affected upstream versions: < 1.10.1
Fixed upstream versions: v1.10.1
Upstream repository: https://github.com/yawkat/lz4-java
Upstream fix commit: 33d180cb70c4d93c80fb0dc3ab3002f457e93840
CVE-2025-66626: github.com/argoproj/argo-workflows: argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
Component: github.com/argoproj/argo-workflows
Severity: Important
CWE: CWE-73 (External Control of File Name or Path)
CVSS v3: 8.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-12-09T20:19:14.680000+00:00

A path traversal and arbitrary file overwrite vulnerability has been identified in Argo Workflows during the extraction of archived artifacts, where symbolic links inside a crafted archive are not safely validated before file extraction. An attacker could exploit this flaw by submitting a malicious archive containing symbolic links that point outside the intended extraction directory, causing files to be written or overwritten in unintended locations within the workflow pod. Successful exploitation may allow an attacker to overwrite execution control files and achieve arbitrary command execution during pod startup.

Statement: Red Hat Product Security has rated this issue as High severity (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H, 8.3) because an attacker with basic workflow submission privileges can supply a specially crafted archive that is automatically extracted without proper validation. The attack complexity is low and does not require user interaction once the malicious workflow is submitted. Successful exploitation allows arbitrary file overwrite within the affected pod, including critical execution files, which can result in code execution at pod startup. While the impact is generally limited to the compromised pod and does not directly lead to host-level compromise, the integrity and availability impacts within the container are significant, justifying a High severity rating.

Affected upstream versions: github.com/argoproj/argo-workflows/v3 >= 3.7.0, < 3.7.5, github.com/argoproj/argo-workflows/v3 < 3.6.14, github.com/argoproj/argo-workflows <= 2.5.3-rc4
Fixed upstream versions: v4.0.0
Upstream repository: https://github.com/argoproj/argo-workflows
Upstream fix commit: 6b92af23f35aed4d4de8b04adcaf19d68f006de1
CVE-2025-67030: org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method
Component: org.codehaus.plexus
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L)
Public date: 2026-03-25T00:00:00+00:00

A flaw was found in plexus-utils. This vulnerability, known as a Directory Traversal, exists within the `extractFile` method. An attacker can exploit this to execute unauthorized code on the system in the context of the current working user.


Affected upstream versions: n/a
Fixed upstream versions: plexus-utils-4.0.3
Upstream repository: https://github.com/codehaus-plexus/plexus-utils
Upstream fix commit: 6d780b3378829318ba5c2d29547e0012d5b29642
CVE-2025-67268: gpsd: gpsd: Arbitrary code execution via heap-based out-of-bounds write in NMEA2000 packet handling
Component: gpsd
Severity: Important
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-02T00:00:00+00:00

A flaw was found in gpsd. The hnd_129540 function, responsible for handling NMEA2000 PGN 129540 (GNSS Satellites in View) packets, fails to properly validate the user-supplied satellite count. A remote attacker can exploit this by sending a specially crafted packet with an excessive satellite count, leading to a heap-based out-of-bounds write. This memory corruption can result in a Denial of Service (DoS) and potentially allow for arbitrary code execution.

Statement: This vulnerability is rated Important rather than Moderate because it results in a heap-based out-of-bounds write triggered by untrusted, attacker-controlled input processed in a core parsing path of gpsd. The satellite count field from a PGN 129540 NMEA2000 Fast Packet is used directly as a loop bound without validation, allowing a single malformed packet to deterministically overwrite heap memory beyond the fixed-size skyview array. Unlike logic errors that only cause graceful failures, this condition introduces active memory corruption, which can destabilize the daemon, corrupt adjacent heap objects, and compromise internal session state in ways that are non-recoverable without a restart. The flaw is reachable pre-authentication, requires no brute force or sustained traffic, and can be reliably triggered with minimal attacker effort once CAN bus access is obtained.

Affected upstream versions: n/a
Fixed upstream versions: release-3.27.1
Upstream repository: https://github.com/ntpsec/gpsd
Upstream fix commit: dc966aa74c075d0a6535811d98628625cbfbe3f4
CVE-2025-67269: gpsd: gpsd: Denial of Service due to malformed NAVCOM packet parsing
Component: gpsd
Severity: Important
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-02T00:00:00+00:00

A flaw was found in gpsd. A remote attacker can exploit this vulnerability by sending a specially crafted NAVCOM packet. When parsing the packet, an error in calculating the payload length can cause the system to attempt to process an extremely large amount of data. This leads to excessive CPU utilization, resulting in a Denial of Service (DoS) condition where the system becomes unresponsive.

Statement: This vulnerability is rated Important for Red Hat because gpsd is susceptible to a remote denial-of-service condition triggered through malformed NAVCOM packets processed from untrusted input sources. A specially crafted packet can induce an unsigned integer underflow during packet length calculation in the NAVCOM parsing state machine, resulting in an excessively large length value and causing the parser to enter a non-terminating read state. Although the flaw does not directly lead to memory corruption, its severity is elevated because it affects a core parsing path that continuously processes streaming input and can be exploited with a single malformed packet, without authentication or sustained attacker interaction. The resulting sustained 100% CPU utilization renders the gpsd service unresponsive to all dependent clients, impacting system functionality wherever gpsd is exposed to network-based inputs or externally influenced serial devices.

Affected upstream versions: n/a
Fixed upstream versions: release-3.27.1
Upstream repository: https://gitlab.com/gpsd/gpsd
Upstream fix commit: ffa1d6f40bca0b035fc7f5e563160ebb67199da7
CVE-2025-67725: tornado: Tornado Quadratic DoS via Repeated Header Coalescing
Component: tornado
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-12T05:49:41.523000+00:00

A denial of service flaw has been discovered in the Tornado networking library. In Tornado, a single maliciously crafted HTTP request can block the server's event loop for an extended period, caused by the HTTPHeaders.add method. The function accumulates values using string concatenation when the same header name is repeated, causing a Denial of Service (DoS).  Due to Python string immutability, each concatenation copies the entire string, resulting in O(n²) time complexity.

Statement: The availability impact of this flaw is partially mitigated on Red Hat products as the host systems are not at risk.

Affected upstream versions: < 6.5.3
Fixed upstream versions: v6.5.3
Upstream repository: https://github.com/tornadoweb/tornado
Upstream fix commit: 771472cfdaeebc0d89a9cc46e249f8891a6b29cd
CVE-2025-67726: tornado: Tornado Quadratic DoS via Crafted Multipart Parameters
Component: tornado
Severity: Moderate
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-12-12T06:13:51.336000+00:00

A denial of service flaw has been discovered in the Tornado networking library. Affected versions of Tornado us an inefficient algorithm when parsing parameters for HTTP header values, potentially causing a DoS. The _parseparam function in httputil.py is used to parse specific HTTP header values, such as those in multipart/form-data and repeatedly calls string.count() within a nested loop while processing quoted semicolons. If an attacker sends a request with a large number of maliciously crafted parameters in a Content-Disposition header, the server's CPU usage increases quadratically (O(n²)) during parsing. Due to Tornado's single event loop architecture, a single malicious request can cause the entire server to become unresponsive for an extended period.

Statement: The availability impact of this flaw is partially mitigated on Red Hat products as the host systems are not at risk.

Affected upstream versions: < 6.5.3
Fixed upstream versions: v6.5.3
Upstream repository: https://github.com/tornadoweb/tornado
Upstream fix commit: 771472cfdaeebc0d89a9cc46e249f8891a6b29cd
CVE-2025-67746: composer: Composer: Terminal output manipulation leading to Denial of Service
Component: composer
Severity: Low
CWE: CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'))
CVSS v3: 3.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L)
Public date: 2025-12-30T16:11:04.776000+00:00

A flaw was found in Composer, a dependency manager for PHP. A remote attacker could exploit this by injecting ANSI control characters into the terminal output of various Composer commands when Composer downloads from attacker-controlled remote sources. This can lead to mangled output, causing confusion or a Denial of Service (DoS) of the terminal application.

Statement: This vulnerability is rated Low as it primarily affects the terminal output of Composer commands. Exploitation requires an attacker to control remote sources from which Composer downloads, allowing the injection of ANSI control characters. This can lead to mangled output or a denial of service of the terminal application, but not the underlying system.

Affected upstream versions: >= 2.0, < 2.2.26, >= 2.3, < 2.9.3
Fixed upstream versions: 2.2.26
Upstream repository: https://github.com/composer/composer
Upstream fix commit: 1d40a95c9d39a6b7f80d404ab30336c586da9917
CVE-2025-67873: capstone: Capstone: Heap buffer overflow via skipdata callback allows denial of service or arbitrary code execution.
Component: capstone
Severity: Moderate
CWE: CWE-122 (Heap-based Buffer Overflow)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:H)
Public date: 2025-12-17T21:12:13.739000+00:00

A flaw was found in Capstone, a disassembly framework. A local attacker could exploit a heap buffer overflow vulnerability by providing a specially crafted skipdata callback. This flaw occurs because the skipdata length is not properly bounds-checked, which may allow an attacker to write beyond allocated memory, potentially leading to a denial of service (DoS) or arbitrary code execution.

Statement: This vulnerability is rated Moderate because a heap buffer overflow in the Capstone disassembly framework can be exploited by a local attacker providing a specially crafted skipdata callback, potentially leading to denial of service or arbitrary code execution. Exploitation requires local access and user interaction.

Affected upstream versions: <= 6.0.0-Alpha5
Fixed upstream versions: 6.0.0-Alpha6
Upstream repository: https://github.com/capstone-engine/capstone
Upstream fix commit: cbef767ab33b82166d263895f24084b75b316df3
CVE-2025-68114: capstone: Capstone: Memory corruption via unchecked vsnprintf return
Component: capstone
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2025-12-17T21:14:31.226000+00:00

A flaw was found in Capstone, a disassembly framework. An unchecked return value from vsnprintf within the SStream_concat function allows a malicious input to manipulate the internal stream index. This can lead to a stack buffer underflow or overflow, potentially enabling a local attacker to achieve information disclosure, alter data, or cause a denial of service.

Statement: This vulnerability is rated Moderate as an unchecked `vsnprintf` return in Capstone's `SStream_concat` function can lead to stack buffer underflow or overflow. Exploitation requires local access and user interaction. This affects Capstone and other components in Red Hat Enterprise Linux, OpenShift Container Platform, and Community Projects.

Affected upstream versions: <= 6.0.0-Alpha5
Fixed upstream versions: 6.0.0-Alpha6
Upstream repository: https://github.com/capstone-engine/capstone
Upstream fix commit: 2c7797182a1618be12017d7d41e0b6581d5d529e
CVE-2025-68151: github.com/coredns/coredns/core/dnsserver: CoreDNS DoS via unbounded connections and oversized messages
Component: github.com/coredns/coredns/core/dnsserver
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-01-08T15:33:12.711000+00:00

Multiple CoreDNS server implementations (gRPC, HTTPS, and HTTP/3) lack critical resource-limiting controls. An unauthenticated remote attacker can exhaust memory and degrade or crash the server by opening many concurrent connections, streams, or sending oversized request bodies. The issue is similar in nature to CVE-2025-47950 (QUIC DoS) but affects additional server types that do not enforce connection limits, stream limits, or message size constraints.


Affected upstream versions: < 1.14.0
Fixed upstream versions: v1.14.0
Upstream repository: https://github.com/coredns/coredns
Upstream fix commit: 0d8cbb1a6bcb6bc9c1a489865278b8725fa20812
CVE-2025-68158: Authlib: Authlib: Cross-Site Request Forgery due to improper session management in state storage
Component: Authlib
Severity: Moderate
CWE: CWE-352 (Cross-Site Request Forgery (CSRF))
CVSS v3: 5.7 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N)
Public date: 2026-01-08T17:58:17.724000+00:00

A flaw was found in Authlib, a Python library used for building OAuth and OpenID Connect servers. The cache-backed state and request-token storage within Authlib is not securely linked to the user's initiating session. This vulnerability allows a remote attacker to exploit a Cross-Site Request Forgery (CSRF) by obtaining a valid state, which can lead to unauthorized actions being performed on behalf of the user.

Statement: This vulnerability is rated Moderate for Red Hat products utilizing Authlib, such as Red Hat Ansible Automation Platform, Hosted OpenShift Clusters, Red Hat Quay, and Red Hat Satellite. The flaw arises from improper session management in Authlib's cache-backed state storage, allowing a remote attacker to perform Cross-Site Request Forgery (CSRF) by obtaining a valid state.

Affected upstream versions: >= 1.0.0, < 1.6.6
Fixed upstream versions: v1.6.6
Upstream repository: https://github.com/authlib/authlib
Upstream fix commit: 2808378611dd6fb2532b189a9087877d8f0c0489
CVE-2025-68160: openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter
Component: openssl
Severity: Low
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 4.7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-01-27T00:00:00+00:00

A flaw was found in OpenSSL. This vulnerability involves an out-of-bounds write in the line-buffering BIO filter, which can lead to memory corruption. While exploitation is unlikely to be under direct attacker control, a successful attack could cause an application to crash, resulting in a Denial of Service (DoS).

Statement: This vulnerability is rated Low for Red Hat. The `BIO_f_linebuffer` filter, where this heap out-of-bounds write occurs, is not used by default in TLS/SSL data paths within Red Hat products. Exploitation requires third-party applications to explicitly use this filter with a BIO chain that can short-write and process large, newline-free data influenced by an attacker, which is an unlikely scenario under attacker control. Red Hat FIPS modules are not affected by this issue.

Affected upstream versions: 3.6.0 < 3.6.1, 3.5.0 < 3.5.5, 3.4.0 < 3.4.4, 3.3.0 < 3.3.6, 3.0.0 < 3.0.19, 1.1.1 < 1.1.1ze, 1.0.2 < 1.0.2zn
Fixed upstream versions: 1.0.2zn, 1.1.1ze, 3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1
Upstream repository: https://github.com/openssl/openssl
Upstream fix commit: 4c96fbba618e1940f038012506ee9e21d32ee12c
CVE-2025-68179: kernel: Linux kernel (s390): Denial of service and data corruption due to improper page table updates
Component: kernel
Severity: Moderate
CWE: CWE-821 (Incorrect Synchronization)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-12-16T00:00:00+00:00

A flaw was found in the Linux kernel on the s390 architecture. A local user with low privileges could trigger a vulnerability by enabling ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP. This issue arises because kernel page table entries are modified without properly flushing the Translation Lookaside Buffer (TLB), which can lead to system crashes and potential data corruption. This could result in a denial of service.


Affected upstream versions: 6.2
Fixed upstream versions: 0, 6.12.58, 6.17.8, 6.18, 6.6.117
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Upstream fix commit: 7088465f10816d9425b95740b37c95f082041d76