Threat database

A security vulnerability (CVE-2026-16313) exists in the sg3_utils package used in Red Hat Enterprise Linux 8.4. The flaw allows arbitrary command execution via udev property injection in the sg_inq --export command. Red Hat has released an important security update to address this issue in affected versions of Red Hat Enterprise Linux 8.4.

A security update for the Linux kernel in Red Hat Enterprise Linux 9.4 addresses a vulnerability identified as CVE-2026-53016 related to the crypto CCP module's handling of initialization vectors. The update also includes bug fixes and enhancements unrelated to security. Red Hat rates the security impact as moderate and recommends applying the update promptly with a system reboot.

A vulnerability in libgit2's set_data function allows a remote attacker operating a malicious Git server to cause a heap out-of-bounds read. This results in a denial of service (DoS) by crashing client applications that use libgit2 during fetch or clone operations. The issue affects Red Hat Hardened Images RPMs and is rated as having an important impact due to unauthenticated remote exploitation causing client termination without compromising host integrity or sensitive data.

A security vulnerability in the gstreamer1-plugins-base package for Red Hat Enterprise Linux 10 allows arbitrary code execution due to a buffer overflow in OGG file parsing. This issue is identified as CVE-2026-18297 and is rated with an Important security impact by Red Hat. A security update addressing this vulnerability is available for multiple architectures and update streams of Red Hat Enterprise Linux 10.

A double-free vulnerability (CVE-2026-14164) exists in the libarchive library's RAR5 decompression logic due to a dangling pointer in the init_unpack() function. Libarchive is widely used for handling various archive formats and is included in multiple Red Hat Enterprise Linux 9.4 variants. This vulnerability has been rated as having moderate security impact by Red Hat.

A security vulnerability (CVE-2026-11332) in ansible-core's ansible-galaxy role install allows argument injection that can lead to arbitrary code execution. This issue affects Red Hat Enterprise Linux 9 and its variants. Red Hat has issued a security advisory with an update to address this vulnerability.

A missing await in JupyterLab's PyPIExtensionManager.install() method caused the allowlist/blocklist check to not be enforced for direct callers. This vulnerability affects only custom extensions or downstream integrations that call install() directly with untrusted input, combined with an allowlist/blocklist configured and the default PyPI Extension Manager enabled while kernels and terminals are disabled or remote. Stock JupyterLab HTTP API and Extension Manager UI are not affected. The issue is fixed in JupyterLab versions 4.6.2 and later.

CVE-2025-71176 is a vulnerability in pytest versions from 0.17.2 up to but not including 0.56.0 on UNIX systems. It involves insecure handling of temporary directories named with the pattern /tmp/pytest-of-{user}, which can allow local users to cause denial of service or potentially escalate privileges. The issue has been fixed in version 0.56.0.

Streamlink versions prior to 8.5.0 contain a vulnerability in their HLS and DASH parsers that allows arbitrary local file reading via file:// URIs. This occurs because the parsers do not validate the URI scheme of segment entries, enabling a remote playlist or manifest to specify local file paths that Streamlink will read and output. The issue is fixed in version 8.5.0.

The pydantic-settings library's NestedSecretsSettingsSource component improperly follows symbolic links inside a configured secrets directory that point outside this directory, allowing local files outside the intended secrets directory to be read into application settings. This behavior also bypasses the configured maximum size limit for secrets loading, potentially leading to excessive resource consumption. The vulnerability requires the ability to place symlinks inside the secrets directory and is not remotely exploitable on its own. It affects versions from 1.143.0 up to but not including 1.168.0. A fix is available in version 1.168.0.

Starlette's request.form() method does not enforce configured limits on max_fields and max_part_size for application/x-www-form-urlencoded content types, allowing an attacker to send requests with an arbitrarily large number of fields or very large fields. This can cause denial of service by blocking the event loop or exhausting memory. The issue affects Starlette and FastAPI applications using vulnerable versions. A patch is available that enforces these limits for url-encoded bodies.

A vulnerability in Starlette versions 1.137.0 through 1.165.9 allows an attacker to manipulate the reconstructed request URL's hostname by supplying a request path that does not start with a slash. This causes the path to be interpreted as part of the URL authority, misleading code that relies on request.url.hostname for security decisions. The issue primarily affects middleware or handlers that inspect request.url before routing, with limited exploitability due to routing returning 404 for such paths.

Starlette's HTTPEndpoint dispatches HTTP methods by lowercasing the method name and using getattr to call an attribute, without restricting to known HTTP verbs. If a route is registered without an explicit methods= argument, any HTTP method is accepted, allowing non-standard methods to invoke internal endpoint methods unintentionally. This can lead to unauthorized invocation of internal helper methods. The issue affects Starlette versions from 1.137.0 up to but not including 1.165.0 and frameworks built on it like FastAPI. A fix is available in version 1.165.0.

Starlette versions from 1.137.0 up to but not including 1.165.0 improperly validate the HTTP Host header when reconstructing request.url, allowing a malformed Host header to cause request.url.path to differ from the actual requested path. This discrepancy can lead to bypass of path-based security checks if middleware or endpoints rely on request.url.path rather than the canonical ASGI path. The vulnerability does not directly grant access or modify routing but can enable bypass only if applications depend on the flawed request.url.path for authorization. The issue is mitigated by validating the Host header per RFC 9112 and falling back to server scope for malformed values. A fix is available in version 1.165.0.