huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-34993: aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load()
Component: aiohttp
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 7.2 (CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H)
Public date: 2026-06-02T18:29:15.847000+00:00

A flaw was found in AIOHTTP, an asynchronous HTTP client/server framework for asyncio and Python. An attacker could exploit this vulnerability by providing untrusted input to the `CookieJar.load()` function. This could potentially lead to arbitrary code execution, allowing the attacker to run malicious code on the affected system. This issue is most likely to occur in applications that allow attacker-controlled files to be loaded.

Statement: This is an Important flaw in AIOHTTP, a Python asynchronous HTTP framework, due to potential arbitrary code execution. The vulnerability arises when applications load untrusted input into the `CookieJar.load()` function. Exploitation requires an application to be configured to process attacker-controlled files, which is not a default or common scenario in most Red Hat product deployments.

Affected upstream versions: < 3.14.0
Fixed upstream versions: v3.14.0
Upstream repository: https://github.com/aio-libs/aiohttp
Upstream fix commit: dcf40f30637e8752c76781cf6703b5a236749a00
CVE-2026-3505: bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion
Component: bouncycastle
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-15T09:06:37.939000+00:00

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpg. A specially crafted PGP AEAD (Authenticated Encryption with Associated Data) message with an unbounded chunk size can lead to an excessive consumption of memory. This issue allows an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.

Statement: To exploit this issue, an attacker needs to submit a specially crafted PGP AEAD message containing an unbounded chunk size to an application. An attack typically requires the application to process this malformed data, resulting in the uncontrolled allocation of memory resources.
The primary impact of this vulnerability is a compromise of system availability, allowing an unauthenticated remote attacker to cause memory exhaustion in a JVM, resulting in a denial of service.

Affected upstream versions: 1.74 < 1.80.2, 1.81 < 1.81.1, 1.82 < 1.84
Fixed upstream versions: r1rv84
Upstream repository: https://github.com/bcgit/bc-java
Upstream fix commit: dc7530939ffb6cdb57636f3609d98e23b94e71c1
CVE-2026-3520: multer: Multer: Denial of Service via malformed requests
Component: multer
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-04T16:17:18.962000+00:00

A denial of service flaw was found in Multer, a Node.js middleware for handling `multipart/form-data`. A remote attacker can send specially crafted malformed requests which may induce a stack overflow. This can lead to a Denial of Service (DoS) making the service unavailable.


Affected upstream versions: <= v2.1.0
Fixed upstream versions: 2.1.1
Upstream repository: https://github.com/expressjs/multer
Upstream fix commit: 7e66481f8b2e6c54b982b34c152479e096ce2752
CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin
Component: github.com/helm/helm
Severity: Important
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 8.2 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H)
Public date: 2026-04-09T15:03:28.668000+00:00

A flaw was found in Helm, a package manager for Kubernetes. An attacker could exploit this vulnerability by providing a specially crafted Helm plugin. When such a plugin is installed or updated, Helm incorrectly processes its configuration, allowing the plugin's contents to be written to an arbitrary location on the filesystem. This could lead to unauthorized modification of system files or other critical data.


Affected upstream versions: >= 4.0.0, < 4.1.4
Fixed upstream versions: v4.1.4
Upstream repository: https://github.com/helm/helm
Upstream fix commit: 36c8539e99bc42d7aef9b87d136254662d04f027
CVE-2026-35205: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary code execution due to insufficient plugin provenance verification
Component: github.com/helm/helm
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-04-09T15:06:41.052000+00:00

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a malicious plugin that lacks a provenance file. Even when signature verification is enabled, Helm would incorrectly install this unverified plugin, bypassing critical security checks. This could lead to arbitrary code execution within the Kubernetes environment, allowing an attacker to gain unauthorized control.


Affected upstream versions: >= 4.0.0, < 4.1.4
Fixed upstream versions: v4.1.4
Upstream repository: https://github.com/helm/helm
Upstream fix commit: 05fa37973dc9e42b76e1d2883494c87174b6074f
CVE-2026-35206: github.com/helm/helm: Helm: Files written to unexpected directory via specially crafted Chart
Component: github.com/helm/helm
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L)
Public date: 2026-04-09T21:02:13.594000+00:00

A flaw was found in Helm, a package manager for Kubernetes. A remote attacker could exploit this vulnerability by providing a specially crafted Chart to the `helm pull --untar` command. This would cause the Chart's contents to be written to an unintended directory, potentially overwriting existing files or placing malicious files in an accessible location, leading to data integrity and availability issues.


Affected upstream versions: >= 4.0.0, < 4.1.4, < 3.20.2
Fixed upstream versions: v4.1.4
Upstream repository: https://github.com/helm/helm
Upstream fix commit: 4e7994d4467182f535b6797c94b5b0e994a91436
CVE-2026-35406: aardvark-dns: Aardvark-dns: Denial of Service via truncated TCP DNS query and connection reset
Component: aardvark-dns
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-07T21:32:23.512000+00:00

A flaw was found in aardvark-dns where a specially crafted TCP DNS query followed by a connection reset can trigger an infinite error loop, leading to 100% CPU usage and a denial of service. As aardvark-dns is only accessible via internal Podman networks, this issue can be exploited by a local container with network access.


Affected upstream versions: >= 1.16.0, < 1.17.1
Fixed upstream versions: v2.0.0
Upstream repository: https://github.com/containers/aardvark-dns
Upstream fix commit: 3b49ea7b38bdea134b7f03256f2e13f44ce73bb1
CVE-2026-35535: sudo: Sudo: Privilege escalation due to failure in privilege drop calls
Component: sudo
Severity: Important
CWE: CWE-272 (Least Privilege Violation)
CVSS v3: 7.4 (CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-04-03T02:21:33.584000+00:00

A flaw was found in Sudo. A local user could exploit a failure in the setuid, setgid, or setgroups calls, which are used to drop privileges before running the mailer. This oversight allows for privilege escalation, enabling the user to gain elevated access on the system.


Affected upstream versions: <= SUDO_1_9_0
Upstream repository: https://github.com/sudo-project/sudo
Upstream fix commit: 3e474c2f201484be83d994ae10a4e20e8c81bb69
CVE-2026-3644: cpython: Incomplete control character validation in http.cookies
Component: cpython
Severity: Moderate
CWE: CWE-791 (Incomplete Filtering of Special Elements)
CVSS v3: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)
Public date: 2026-03-16T17:37:31.344000+00:00

A control character validation flaw has been discovered in the Python http.cookie module. The Morsel.update(), |= operator, and unpickling paths were not patched to resolve  CVE-2026-0672, allowing control characters to bypass input validation. Additionally, BaseCookie.js_output() lacked the output validation applied to BaseCookie.output().


Affected upstream versions: 3.14.0 < 3.14.4, 3.15.0a1 < 3.15.0a8
Fixed upstream versions: v3.15.0b1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 57e88c1cf95e1481b94ae57abe1010469d47a6b4
CVE-2026-3731: libssh: libssh: Denial of Service via out-of-bounds read in SFTP extension name handler
Component: libssh
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2026-03-08T10:32:19.482000+00:00

A flaw was found in libssh. A remote attacker could trigger an out-of-bounds read vulnerability in the SFTP Extension Name Handler by manipulating the `idx` argument in the `sftp_extensions_get_name` or `sftp_extensions_get_data` functions. This could lead to a Denial of Service (DoS), making the affected system unresponsive.

Statement: A MODERATE impact out-of-bounds read vulnerability exists in libssh's SFTP extension. A remote attacker could exploit this flaw by manipulating an argument to the `sftp_extensions_get_name/sftp_extensions_get_data` functions, potentially leading to a denial of service or information disclosure. This affects Red Hat Enterprise Linux versions utilizing libssh.

Affected upstream versions: 0.11.0, 0.11.1, 0.11.2, 0.11.3
Fixed upstream versions: 0.11.4, 0.12.0
Upstream repository: https://gitlab.com/libssh/libssh-mirror
Upstream fix commit: 855a0853ad3abd4a6cd85ce06fce6d8d4c7a0b60
CVE-2026-37457: frr: denial of service via crafted FlowSpec component
Component: frr
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-01T00:00:00+00:00

A flaw was found in FRRouting (FRR). A remote attacker can exploit an off-by-one out-of-bounds write vulnerability in the `bgp_flowspec_op_decode()` function by supplying a specially crafted FlowSpec component. This issue can lead to a Denial of Service (DoS).

Statement: This vulnerability allows an unauthenticated remote attacker to cause a denial of service via a specially crafted FlowSpec component. Due to this reason, this issue has been rated with an important severity.

Affected upstream versions: n/a
Fixed upstream versions: frr-10.7.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: 0e6882bc72c0278988a47b2f0f73b7a91099a25c
CVE-2026-37459: frr: denial of service via crafted BGP UPDATE message
Component: frr
Severity: Important
CWE: CWE-191 (Integer Underflow (Wrap or Wraparound))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-05-04T00:00:00+00:00

A flaw was found in FRRouting (FRR). An unauthenticated remote attacker can exploit an integer underflow vulnerability by supplying a specially crafted BGP (Border Gateway Protocol) UPDATE message. This issue can lead to a Denial of Service (DoS).

Statement: This vulnerability allows an unauthenticated remote attacker to cause a denial of service via a specially crafted BGP UPDATE message. Due to this reason, this issue has been rated with an important severity.

Affected upstream versions: n/a
Fixed upstream versions: frr-10.7.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: 693a2e02687cdc9d16501275e05136edea9650d9
CVE-2026-37460: frr: FRRouting: Denial of Service via crafted BGP UPDATE message
Component: frr
Severity: Important
CWE: CWE-1286 (Improper Validation of Syntactic Correctness of Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-03T00:00:00+00:00

A flaw was found in FRRouting (FRR). Missing input validation in the `rfapiRibBi2Ri()` function allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted BGP (Border Gateway Protocol) UPDATE message. This vulnerability can disrupt network services managed by FRR.

Statement: This Important flaw in FRRouting (FRR) allows a remote, unauthenticated attacker to trigger a denial of service by sending a specially crafted BGP UPDATE message. This can lead to the disruption of network services managed by FRR instances configured to handle BGP traffic. The vulnerability does not require complex attack vectors or user interaction, making it a significant availability risk for affected systems.

Affected upstream versions: n/a
Fixed upstream versions: frr-10.7.0
Upstream repository: https://github.com/FRRouting/frr
Upstream fix commit: 7676cad65114aa23adde58
CVE-2026-37555: libsndfile: integer overflow in ima_reader_init()
Component: libsndfile
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2026-04-29T00:00:00+00:00

A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application linked to the library and memory corruption.

Statement: To exploit this issue, an attacker needs to be able to process a malicious WAV file with an application linked to the libsndfile library.

Default Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.

Due to these reasons, this flaw has been rated with an important severity.

Affected upstream versions: n/a
Upstream repository: https://github.com/libsndfile/libsndfile
Upstream fix commit: 9a829113c88a51e57c1e46473e90609e4b7df151
CVE-2026-3904: glibc: nscd client crash on x86_64 under high nscd load
Component: glibc
Severity: Moderate
CWE: CWE-366 (Race Condition within a Thread)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-03-11T13:19:09.741000+00:00

A flaw was found in glibc. When calling NSS-backed functions that support caching via nscd, the nscd client under high load on x86_64 systems may call the memcmp function on inputs that are concurrently modified by other processes or threads, causing a crash and resulting in a denial of service.

Statement: This issue is only exploitable via applications using NSS-backed functions that support caching via nscd under a high load on x86_64 systems. It depends on a race condition on inputs that are concurrently modified by other processes or threads during memory access, increasing the complexity of exploitation. Also, this flaw can only cause an application crash, limiting the security impact to a denial of service. Due to these reasons, this vulnerability has been rated with a moderate severity.

Affected upstream versions: 2.35 < 2.37
Fixed upstream versions: 2.37
Upstream repository: https://sourceware.org/git/glibc.git
Upstream fix commit: 8804157ad9da39631703b92315460808eac86b0c
CVE-2026-39892: cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API
Component: cryptography
Severity: Important
CWE: CWE-131 (Incorrect Calculation of Buffer Size)
CVSS v3: 7.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Public date: 2026-04-08T20:49:41.967000+00:00

A flaw was found in the cryptography library. This vulnerability occurs when a non-contiguous buffer is passed to certain application programming interfaces (APIs) that accept Python buffers, such as Hash.update(). A remote attacker could exploit this to cause a buffer overflow, potentially leading to a denial of service.

Statement: In default configurations Red Hat products isolate service processes from total system access. Should an attacker be able to exploit this vulnerability their impact will be limited to that service account and they will not have access to the broader system.

Affected upstream versions: >= 45.0.0, < 46.0.7
Fixed upstream versions: 46.0.7
Upstream repository: https://github.com/pyca/cryptography
Upstream fix commit: 622d672e429a7cff836a23c5903683dbec1901f5
CVE-2026-39956: jq: missing runtime type checks for _strindices lead to crash and limited memory disclosure
Component: jq
Severity: Moderate
CWE: CWE-1287 (Improper Validation of Specified Type of Input)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H)
Public date: 2026-04-13T22:10:18.817000+00:00

A flaw was found in jq, a command line JSON processor. In release builds, the `_strindices` builtin function calls the `jv_string_indexes` function without checking that the arguments are actually strings. This missing validation allows an attacker who can supply non-string inputs to cause an application crash and a limited memory read.

Statement: To exploit this flaw, a user needs to process JSON input with an attacker-supplied argument to the `_strindices` builtin. This allows the attacker to cause an application crash and a limited memory read with no other security impact. Due to these reasons, this vulnerability has been rated with a moderate severity.

Affected upstream versions: >= 69785bf77f86e2ea1b4a20ca86775916889e91c9, < fdf8ef0f0810e3d365cdd5160de43db46f57ed03
Fixed upstream versions: jq-1.8.2
Upstream repository: https://github.com/jqlang/jq
Upstream fix commit: fdf8ef0f0810e3d365cdd5160de43db46f57ed03
CVE-2026-39979: jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers
Component: jq
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H)
Public date: 2026-04-13T22:18:56.252000+00:00

A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.

Statement: To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.

Affected upstream versions: < 2f09060afab23fe9390cce7cb860b10416e1bf5f
Fixed upstream versions: jq-1.8.2
Upstream repository: https://github.com/jqlang/jq
Upstream fix commit: 2f09060afab23fe9390cce7cb860b10416e1bf5f
CVE-2026-39983: basic-ftp: basic-ftp: Command injection via CRLF sequences in file path parameters
Component: basic-ftp
Severity: Important
CWE: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
CVSS v3: 8.6 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L)
Public date: 2026-04-09T17:05:46.228000+00:00

A flaw was found in basic-ftp, an FTP client for Node.js. A remote attacker can exploit this vulnerability by injecting Carriage Return Line Feed (CRLF) sequences into file path parameters used by high-level APIs. This allows the attacker to split a single intended FTP command into multiple commands. Such command injection can lead to the execution of arbitrary commands, potentially compromising the integrity and availability of data or the system.


Affected upstream versions: < 5.2.1
Fixed upstream versions: v5.2.1
Upstream repository: https://github.com/patrickjuchli/basic-ftp
Upstream fix commit: 2ecc8e2c500c5234115f06fd1dbde1aa03d70f4b
CVE-2026-40033: freerdp: FreeRDP: Remote code execution via heap-buffer-overflow in gdi_CacheToSurface
Component: freerdp
Severity: Important
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)
Public date: 2026-05-26T14:08:47.535000+00:00

A flaw was found in FreeRDP.If a user connects to a malicious Remote Desktop (RDP) server, a security flaw in FreeRDP could cause the application to crash or allow the server to run unauthorized code on the user's system.

Statement: This vulnerability in FreeRDP could allow a malicious Remote Desktop server to run unauthorized code or crash the connecting user's system. Red Hat users are only at risk if they use the FreeRDP client to connect to an untrusted or compromised server.

Affected upstream versions: <= 3.24.1
Fixed upstream versions: 3.26.0
Upstream repository: https://github.com/FreeRDP/FreeRDP
Upstream fix commit: 23b36cd00ebf0ccd97750fcdbc9aa2f362352da7
CVE-2026-40110: jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation
Component: jupyter-server
Severity: Important
CWE: CWE-625 (Permissive Regular Expression)
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)
Public date: 2026-05-05T21:29:31.323000+00:00

A flaw was found in Jupyter Server. The Origin header validation, which uses Python's `re.match()` function, does not correctly validate incoming origins against allowed patterns. This allows a remote attacker to bypass Cross-Origin Resource Sharing (CORS) restrictions by crafting a malicious domain that partially matches a trusted one. Consequently, the attacker can make unauthorized cross-origin requests to the Jupyter Server API from an untrusted site, potentially leading to sensitive information disclosure or other unauthorized actions.


Affected upstream versions: <= 2.17.0
Fixed upstream versions: v2.18.0
Upstream repository: https://github.com/jupyter-server/jupyter_server
Upstream fix commit: 057869a327c46730afede3eab0ca2d2e3e74acea
CVE-2026-40164: jq: jq: Denial of Service via crafted JSON object causing hash collisions
Component: jq
Severity: Important
CWE: CWE-341 (Predictable from Observable State)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-04-13T23:40:12.693000+00:00

A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.


Affected upstream versions: < 0c7d133c3c7e37c00b6d46b658a02244fdd3c784
Fixed upstream versions: jq-1.8.2
Upstream repository: https://github.com/jqlang/jq
Upstream fix commit: 0c7d133c3c7e37c00b6d46b658a02244fdd3c784