huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2026-54369: acl: Symlink traversal privilege escalation via libacl functions
Component: acl
Severity: Important
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 7.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-29T13:00:00+00:00

A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.


Fixed upstream versions: 2.4.0
Upstream repository: https://cgit.git.savannah.nongnu.org/cgit/acl.git
Upstream fix commit: 3589787cd589b34bdd9265936e17190b6d3f17d1
CVE-2026-54370: acl: TOCTOU Symlink Traversal via getfacl/setfacl
Component: acl
Severity: Moderate
CWE: CWE-367 (Time-of-check Time-of-use (TOCTOU) Race Condition)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-29T13:00:00+00:00

A time-of-check to time-of-use (TOCTOU) race condition vulnerability was found in `acl`. By replacing a pathname component with a symbolic link between a security check and subsequent file operations, an attacker can redirect file access control list operations. This occurs when privileged processes invoke `getfacl` or `setfacl` over an attacker-controlled path, potentially leading to local privilege escalation.


Fixed upstream versions: 2.4.0
Upstream repository: https://cgit.git.savannah.nongnu.org/cgit/acl.git
Upstream fix commit: 3589787cd589b34bdd9265936e17190b6d3f17d1
CVE-2026-54371: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr
Component: attr
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2026-06-29T13:00:00+00:00

A flaw was found in the `attr` package. This vulnerability allows a local attacker to perform a symlink traversal attack by replacing a pathname component with a symbolic link - either during directory hierarchy traversal by `getfattr` or during backup restoration by `setfattr`, which reads and resolves full pathnames from backup files. In both cases, when these utilities are executed by a privileged process over a path controlled by the attacker, this can lead to local privilege escalation.


Fixed upstream versions: 2.6.0
Upstream repository: https://cgit.git.savannah.nongnu.org/cgit/attr.git
Upstream fix commit: c440855d6b33446edf4b5eb1a2d892281f15a99b
CVE-2026-54512: jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass
Component: jackson-databind
Severity: Important
CWE: CWE-502 (Deserialization of Untrusted Data)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-23T20:56:36.646000+00:00

A flaw was found in jackson-databind. This vulnerability allows a remote attacker to bypass the PolymorphicTypeValidator (PTV) when polymorphic typing is enabled and a type identifier contains generic parameters. By crafting a malicious type ID, an attacker can place a denied class as a generic type parameter of an allowed container. This leads to the loading and instantiation of arbitrary classes, potentially resulting in arbitrary code execution.

Statement: This vulnerability in `jackson-databind` is rated as Important. While it describes a potential bypass of the PolymorphicTypeValidator leading to arbitrary code execution, exploitation requires an attacker to already possess administrative privileges, specifically the `manage-realm` role. This flaw does not enable privilege escalation, as it does not grant additional capabilities beyond those inherently available to an existing administrator.

Affected upstream versions: >= 2.10.0, < 2.18.8, >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4
Fixed upstream versions: jackson-databind-2.18.8
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 434d6c511de7fdd9872f29157aafb6162d12d8d5
CVE-2026-54513: jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution
Component: jackson-databind
Severity: Important
CWE: CWE-184 (Incomplete List of Disallowed Inputs)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-06-23T20:53:52.543000+00:00

A flaw was found in jackson-databind, a library used for processing data. This vulnerability allows an attacker to bypass security controls designed to validate data types. By sending specially crafted input, an attacker can force the system to process untrusted data, which may lead to the execution of malicious code. This could result in a complete compromise of the affected system, impacting its confidentiality, integrity, and availability.

Statement: This Important flaw in `jackson-databind` allows for a security bypass, enabling arbitrary code execution. The vulnerability arises from insufficient validation of array component types by `BasicPolymorphicTypeValidator`, which permits deserialization of unallowlisted types when processing untrusted input. This bypass of type validation can lead to a complete system compromise, affecting confidentiality, integrity, and availability in Red Hat products utilizing `jackson-databind` for data processing.

Affected upstream versions: >= 2.10.0, < 2.18.8, >= 2.19.0, < 2.21.4, >= 3.0.0, < 3.1.4
Fixed upstream versions: jackson-databind-2.18.8
Upstream repository: https://github.com/FasterXML/jackson-databind
Upstream fix commit: 01d1692c8d0ed03e51a0e3c4f8a9e6908e4931e5
CVE-2026-55199: libssh2: libssh2: Denial of Service via crafted SSH_MSG_EXT_INFO message
Component: libssh2
Severity: Moderate
CWE: CWE-606 (Unchecked Input for Loop Condition)
CVSS v3: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-17T18:44:00+00:00

A vulnerability in libssh2 allows a malicious SSH server to freeze connected clients during the handshake process. By sending a malformed packet, the server triggers a loop that exhausts the client's CPU, resulting in a denial of service.

Statement: A Moderate-rated denial of service vulnerability in the libssh2 client allows a malicious SSH server to freeze the connecting application. By triggering an infinite CPU loop during the initial connection handshake, the server can render the client unresponsive.  Note: Red Hat Enterprise Linux (RHEL) 8 and newer are not affected by this flaw, as they do not ship the libssh2 package.

Affected upstream versions: <= libssh2-1.11.1
Upstream repository: https://github.com/libssh2/libssh2
Upstream fix commit: 17626857d20b3c9a1addfa45979dadcee1cd84a4
CVE-2026-55200: libssh2: libssh2 - Out-of-Bounds Write via Unchecked packet_length in transport.c
Component: libssh2
Severity: Moderate
CVSS v3: 7.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L)
Public date: 2026-06-17T19:03:15.183000+00:00

An out-of-bounds write vulnerability exists in the libssh2 client. A remote attacker can exploit this by sending a specially crafted SSH packet with an abnormally large length value. This corrupts the application's memory and can potentially allow the attacker to execute arbitrary code on the affected system.

Statement: An Important out-of-bounds write vulnerability was discovered in libssh2. As it only impacts client installations of the library, exploitation would require a victim to initiate an SSH connection to an attacker-controlled server. This means an attacker must first redirect client connections via DNS poisoning, a man-in-the-middle, or compromise of a trusted host. While the vulnerability does not require authentication and requires no special configuration, the client redirection prerequisites significantly limit the practical attack surface compared to a server-side flaw.

The integer overflow provides uncontrolled access to the heap, which reliably crashes the client process but is unlikely to achieve remote code execution in practice. Weaponizing the overflow for code execution would require a separate information disclosure vulnerability to defeat ASLR, along with a specific heap layout to place exploitable structures adjacent to the undersized allocation. On RHEL, ASLR is enabled by default and glibc's heap metadata integrity checks further raise the bar, making denial of service the realistic impact for most deployments.

Red Hat Enterprise Linux (RHEL) 8 and newer are not affected by this flaw, as they do not ship the libssh2 package.

Affected upstream versions: <= libssh2-1.11.1
Upstream repository: https://github.com/libssh2/libssh2
Upstream fix commit: 97acf3dfda80c91c3a8c9f2372546301d4a1a7a8
CVE-2026-55203: haproxy: HAProxy: Response smuggling due to integer overflow in FastCGI record length handling
Component: haproxy
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N)
Public date: 2026-06-18T16:05:20.100000+00:00

A flaw was found in HAProxy. A malicious FastCGI (Fast Common Gateway Interface) backend can exploit an integer overflow vulnerability in the fcgi_conn structure's drl field. This occurs when specific contentLength and paddingLength values cause the drl field to wrap to zero, leading to incorrect record consumption. This desynchronizes the FCGI framing parser, potentially resulting in response smuggling, request routing errors, or memory safety issues.

Statement: Conditions for Exploitation: Successful exploitation requires a specific configuration where HAProxy is actively utilizing a FastCGI backend. Crucially, an attacker must already have control over this backend server to supply the maliciously crafted responses. 

This requirement significantly restricts the attack vector, as it relies on an unlikely configuration or an already compromised backend, rather than a typical remote attack initiated by a client against a default frontend server.

Impact Limitations: Although the vulnerability can cause the FastCGI framing parser to desynchronize—potentially leading to response smuggling, request routing errors, or memory safety issues—the threat is contained entirely to environments that process traffic from untrusted or compromised backend servers.

Affected upstream versions: <= v3.4.0
Fixed upstream versions: v3.5-dev1
Upstream repository: https://github.com/haproxy/haproxy
Upstream fix commit: 5985276735777634d8c85f1d73bb7764aab0d6dd
CVE-2026-55204: haproxy: HAProxy: Denial of Service via HPACK dynamic table insertions
Component: haproxy
Severity: Important
CWE: CWE-476 (NULL Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-06-18T16:05:52.058000+00:00

A flaw was found in HAProxy. An attacker can trigger HPACK dynamic table insertions under memory pressure, leading to a null pointer dereference in the hpack_dht_insert() function. This can cause HAProxy worker processes to crash, resulting in a denial of service (DoS).

Statement: This Important flaw in HAProxy can lead to a denial of service. An unauthenticated remote attacker could exploit a null pointer dereference by triggering HPACK dynamic table insertions under memory pressure, causing HAProxy worker processes to crash. This impacts the availability of services relying on HAProxy as a load balancer or proxy.

Affected upstream versions: <= v3.4.0
Fixed upstream versions: v3.5-dev1
Upstream repository: https://github.com/haproxy/haproxy
Upstream fix commit: 9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513
CVE-2026-55379: python-pillow: Pillow: Denial of Service via crafted BDF font file
Component: python-pillow
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-06T18:52:11.633000+00:00

A flaw was found in Pillow, a Python imaging library. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a specially crafted BDF font file. The library's image processing function fails to properly validate dimensions from the font file, bypassing a critical security check designed to prevent excessive memory usage. This oversight can lead to the system consuming an unreasonable amount of memory, making it unavailable to legitimate users.

Statement: A flaw was found in the Pillow Python imaging library. The BDF font file parser passes attacker-controlled dimensions to Image.new() without decompression bomb validation, allowing excessive memory allocation and denial of service.

Affected upstream versions: < 12.3.0
Fixed upstream versions: 12.3.0
Upstream repository: https://github.com/python-pillow/Pillow
Upstream fix commit: 0a263e6264aa5399988d9acd3bbfbca2ca3ec77d
CVE-2026-55380: python-pillow: Pillow: Denial of Service via crafted GD 2.x image file
Component: python-pillow
Severity: Important
CWE: CWE-1285 (Improper Validation of Specified Index, Position, or Offset in Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-06T18:50:14.789000+00:00

A flaw was found in Pillow, a Python imaging library. A remote attacker could exploit this vulnerability by providing a specially crafted GD 2.x image file. The GdImageFile._open() function reads image dimensions without proper validation, leading to excessive memory allocation. This can result in a Denial of Service (DoS) due to C-heap exhaustion.

Statement: A denial-of-service vulnerability was found in Pillow's GdImageFile plugin. The GdImageFile._open() function reads image dimensions from GD 2.x file headers and stores them without performing a decompression bomb check. A crafted .gd file of approximately 1 KB can trigger an unchecked 4.3 GB C-heap allocation, potentially crashing the process or exhausting memory on systems with insufficient resources. This issue is fixed in Pillow 12.3.0.

Affected upstream versions: < 12.3.0
Fixed upstream versions: 12.3.0
Upstream repository: https://github.com/python-pillow/Pillow
Upstream fix commit: f39b0ae6624eb2d7c5c5d651d9bb5fdbd96a8675
CVE-2026-55686: github.com/containers/podman: Podman: Host filesystem modification via malicious container image WORKDIR symlink
Component: github.com/containers/podman
Severity: Moderate
CWE: CWE-59 (Improper Link Resolution Before File Access ('Link Following'))
CVSS v3: 5.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N)
Public date: 2026-06-26T16:30:41.345000+00:00

A flaw was found in Podman. A remote attacker can exploit this vulnerability by running a malicious container image where the WORKDIR (working directory) path contains a symbolic link (symlink). This can lead to the creation of a directory or modification of ownership on the host filesystem, potentially impacting system integrity.

Statement: A flaw was found in Podman where running a malicious container image with a WORKDIR path containing a symlink can create directories or modify ownership on the host filesystem. Exploitation requires the user to pull and run a specifically crafted malicious container image. Red Hat rates this as Moderate impact, consistent with the upstream assessment, because the attack requires a malicious image and the most severe outcome (ownership modification) requires additional help from an underprivileged user namespace.

Affected upstream versions: >= 3.0.0, < 5.7.1
Fixed upstream versions: v6.0.0
Upstream repository: https://github.com/podman-container-tools/podman
Upstream fix commit: d18e44e9abb3bf5b7294aa70806e1368fdddfdd0
CVE-2026-55693: vim: Vim: Out-of-bounds Write in Spell File Word Count
Component: vim
Severity: Moderate
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H)
Public date: 2026-06-25T15:34:33.424000+00:00

Vim is an open source, command line text editor. Prior to 9.2.0653, the tree_count_words() function in src/spellfile.c fills in the word-count fields of a spell-file word trie by walking it iteratively with a depth counter. The counter is bounded only by the trie structure itself; it is never checked against the size of the fixed MAXWLEN-element stack arrays it indexes (arridx[], curi[], wordcount[]). A crafted .spl/.sug file pair, loaded when the user invokes spell suggestion, can drive the descent arbitrarily deep, so the function writes past the end of those arrays. This is a stack out-of-bounds write that corrupts the call frame and crashes the editor. This vulnerability is fixed in 9.2.0653.


Affected upstream versions: < 9.2.0653
Fixed upstream versions: v9.2.0653
Upstream repository: https://github.com/vim/vim
Upstream fix commit: a80874d9b84a01040e3d1aef2d4a59e1934dafb7
CVE-2026-5588: bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid
Component: bouncycastle
Severity: Important
CWE: CWE-347 (Improper Verification of Cryptographic Signature)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2026-04-15T09:06:15.617000+00:00

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA bcpkix. The PKIX draft `CompositeVerifier` implementation improperly accepts an empty signature sequence as a valid cryptographic signature. This issue allows a remote attacker to bypass signature verification mechanisms, potentially compromising the authenticity and integrity of data.

Statement: To exploit this issue, an attacker needs to submit a crafted payload or token containing an empty signature sequence to an application using the `CompositeVerifier` for cryptographic validation. An attack typically requires the application to process this malformed data and improperly accept the empty sequence as a valid signature, bypassing standard verification checks.
The primary impact of this vulnerability is the compromise of data authenticity and integrity, allowing an attacker to forge digital signatures and impersonate trusted entities.

Affected upstream versions: 1.67 < 1.80.2, 1.81 < 1.81.1, 1.82 < 1.84, 2.0.6 < 2.0.11, 2.1.7 < 2.1.11, 2.73.7 < 2.73.11
Fixed upstream versions: r1rv84
Upstream repository: https://github.com/bcgit/bc-java
Upstream fix commit: 656bae0dbd9b1521f840521ff786e78749fe3057
CVE-2026-55892: vim: Vim: Denial of Service via crafted spell file
Component: vim
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2026-06-25T15:32:41.238000+00:00

A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by convincing a user to load a specially crafted spell file. This malicious file can trigger a stack out-of-bounds write, which corrupts the editor's memory and causes it to crash. This leads to a Denial of Service (DoS), making the editor unavailable to the user.

Statement: A flaw was found in Vim's spell file handling. The dump_prefixes() function in src/spell.c does not validate the depth of the prefix trie against the size of fixed-size stack arrays, allowing a crafted .spl file to cause a stack out-of-bounds write and crash. Red Hat ships Vim in all RHEL versions and OpenShift CoreOS. Exploitation requires a user to load a malicious spell file and run :spelldump or spelling completion.

Affected upstream versions: < 9.2.0662
Fixed upstream versions: v9.2.0662
Upstream repository: https://github.com/vim/vim
Upstream fix commit: 8325b193bba5f01e7a7d8241f
CVE-2026-5598: bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons
Component: bouncycastle
Severity: Important
CWE: CWE-385 (Covert Timing Channel)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2026-04-15T09:05:56.277000+00:00

A flaw was found in Legion of the Bouncy Castle Inc. BC-JAVA core. A covert timing channel vulnerability, caused by non-constant time comparisons, risks the leakage of private keys in the FrodoKEM implementation. An unauthenticated, remote attacker can potentially exploit this timing discrepancy to gain unauthorized access to sensitive cryptographic information.

Statement: To exploit this issue, an unauthenticated attacker needs to send highly specific, malformed ciphertexts to the target server. These payloads are used to interact with the private key of the server in a way that the vulnerable, non-constant time code paths are triggered during the verification step. An attack typically requires sending a large volume of these requests to perform statistical analysis on the resulting timing variations, increasing its complexity.
The primary security impact of this vulnerability is the potential leakage of private keys associated with the FrodoKEM implementation. This can compromise encrypted communications or authentication mechanisms.

Affected upstream versions: 1.71 < 1.80.2, 1.81 < 1.81.1, 1.82 < 1.84
Fixed upstream versions: r1rv84
Upstream repository: https://github.com/bcgit/bc-java
Upstream fix commit: 94abbd56413dfdac651fd878bc60253871ef5e87
CVE-2026-55999: xorg: X11: xserver: X.org: glamor Font Atlas Heap Buffer Overflow
Component: xorg
Severity: Important
CWE: CWE-805 (Buffer Access with Incorrect Length Value)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2026-07-08T00:00:00+00:00

A flaw was found in the glamor_font_get() function of the xorg-x11-server. This vulnerability, a heap buffer overflow, occurs when the server processes a specially crafted PCF font file where individual glyph metrics exceed the declared maximum bounds. An authenticated X client can exploit this by loading a malicious font and drawing text, potentially leading to arbitrary code execution with attacker-controlled content and extent. This affects servers utilizing the glamor acceleration backend, such as Xorg with the modesetting driver and Xwayland.

Statement: This Important flaw in xorg-x11-server allows an authenticated X client to achieve arbitrary code execution. By processing a malicious PCF font file where glyph metrics exceed declared bounds, a heap buffer overflow occurs within the glamor acceleration backend. This vulnerability primarily impacts Red Hat systems running Xorg with the modesetting driver or Xwayland, typically found in desktop environments.

Affected upstream versions: <= DRM-20051017
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: fbf7bac22e2c6bd627fb042742a23318263edae1
CVE-2026-56000: X.org: xorg-x11-server: GLX contextTags Use-After-Free in CommonMakeCurrent()
Component: X.org
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2026-07-08T00:00:00+00:00

A flaw was found in the X.org X11 server, specifically within the GLX (OpenGL Extension to the X Window System) dispatch layer. A remote attacker can exploit this vulnerability by sending a series of crafted X11 requests. This can lead to a use-after-free condition, where the server attempts to write data to memory that has already been released. The primary consequence of this memory corruption is a denial of service, potentially causing the X server to crash.

Statement: An Important use-after-free vulnerability in the X.org X11 server's GLX dispatch layer allows a remote, unauthenticated attacker to trigger a denial of service. By sending a sequence of crafted X11 requests, an attacker can cause the X server to crash, impacting the availability of systems with a running graphical environment. This is considered Important due to the remote attack vector and the potential for unauthenticated denial of service.

Affected upstream versions: <= DRM-20051017
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 2779affbdb4354e894f490e56f962527d6125043