CVE-2026-1288
published 2026-06-17CVE-2026-1288: A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability…
PriorityP418medium5.5CVSS 3.1
AVLACLPRNUIRSUCNINAH
EPSS
0.12%
1.5th percentile
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| autodesk | revit | >= 2024 < 2024.3.5 | 2024.3.5 |
| autodesk | revit | >= 2024.0.0 < 2024.3.5 | 2024.3.5 |
| autodesk | revit | >= 2025 < 2025.4.5 | 2025.4.5 |
| autodesk | revit | >= 2025.0.0 < 2025.4.5 | 2025.4.5 |
| autodesk | revit | >= 2026 < 2026.4.1 | 2026.4.1 |
| autodesk | revit | >= 2026.0.0 < 2026.4.1 | 2026.4.1 |
| autodesk | revit | >= 2027 < 2027.1 | 2027.1 |
| autodesk | revit | >= 2027.0.0 < 2027.1.0 | 2027.1.0 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
cvelistv5v3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
vendor_redhat9.8CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
ghsa·2026-09-24
CVE-2026-56744 [HIGH] CWE-1288 `@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
Reported by @echennells (Eric Chennells). Migrated from public issue #191 to a private advisory.
**Affected:** `@bsv/wallet-toolbox` / `-client` / `-mobile`. Verified in `2.1.21` and `2.1.21-parity-fix.2`; the relevant code is the same at current HEAD
**Summary:**
When `createAction` runs against a remote `StorageClient`, the storage server returns the outputs to build. `buildSignableTransaction` takes each non-change output's `lockingScript` from the storage response and signs it, without comparing it to the `lockingScript` the caller supplied in `args.outputs`. `WalletPermissionsManager.createAction` parses the built transaction and has
GHSA
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
ghsa·2026-06-24
CVE-2026-57292 [MEDIUM] CWE-352 Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins Gitee Plugin has a cross-site request forgery vulnerability
Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier does not perform permission checks in several HTTP endpoints implementing form validation for its global configuration.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Gitee Plugin 1292.v2559f2f3f2c0 requires the appropriate permissions in the affected HTTP endpoints, and requires POST requests.
GHSA
Jenkins Gitee Plugin missing permission checks
ghsa·2026-06-24
CVE-2026-57291 [MEDIUM] CWE-862 Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin missing permission checks
Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier does not perform permission checks in several HTTP endpoints implementing form validation for its global configuration.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.
Additionally, these HTTP endpoints do not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Gitee Plugin 1292.v2559f2f3f2c0 requires the appropriate permissions in the affected HTTP endpoints, and requires POST requests.
GHSA
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
ghsa·2026-06-24
CVE-2026-57293 [MEDIUM] CWE-862 Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier does not correctly perform a permission check in an HTTP endpoint.
This allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored in Jenkins. Those can be used as part of an attack to capture the credentials using another vulnerability.
An enumeration of credentials IDs in Gitee Plugin 1292.v2559f2f3f2c0 requires Overall/Administer permission.
CVEList
RFA File Parsing Vulnerability in Autodesk Revit
cvelistv5·2026-06-17·CVSS 5.5
CVE-2026-1288 [MEDIUM] CWE-476 RFA File Parsing Vulnerability in Autodesk Revit
RFA File Parsing Vulnerability in Autodesk Revit
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
GHSA
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability.
ghsa_unreviewed·2026-06-17
CVE-2026-1288 [MEDIUM] CWE-476 A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability.
A maliciously crafted RFA file, when converted to FormIt via “Convert RFA to FormIt” in Autodesk Revit, can force a NULL Pointer Dereference vulnerability. Successful exploitation may cause the application to crash, leading to a denial-of-service condition.
VulDB
Autodesk Revit up to 2024.3.4/2025.4.4/2026.4.0 RFA File null pointer dereference
vuldb·2026-06-17
CVE-2026-1288 [LOW] Autodesk Revit up to 2024.3.4/2025.4.4/2026.4.0 RFA File null pointer dereference
A vulnerability classified as problematic was found in Autodesk Revit up to 2024.3.4/2025.4.4/2026.4.0. Affected by this vulnerability is an unknown functionality of the component RFA File Handler. Executing a manipulation can lead to null pointer dereference.
The identification of this vulnerability is CVE-2026-1288. The attack can only be executed locally. There is no exploit available.
Upgrading the affected component is advised.
GHSA
Keycloak Services has Improper Validation of Consistency within Input
ghsa·2026-05-27
CVE-2026-9689 [MEDIUM] CWE-1288 Keycloak Services has Improper Validation of Consistency within Input
Keycloak Services has Improper Validation of Consistency within Input
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
Red Hat
kernel: nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
vendor_redhat·2026-10-06·CVSS 7.0
CVE-2026-98250 [MEDIUM] CWE-1288 kernel: nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
kernel: nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
In the Linux kernel, the following vulnerability has been resolved:
nfsd: fix handling of NFSEXP_PNFS in the netlink codepath
The rework of how block layouts were checked moved the check for
NFSEXP_PNFS out of nfsd4_setup_layout_type() and into the callers. That
patch didn't account for the new call in nfsd4_setup_layout_type().
A flaw was found in the Linux kernel's Network File System daemon (nfsd). When configuring file exports through the Netlink interface, nfsd attempts to initialize parallel NFS (pNFS) layouts without verifying that pNFS is enabled for the export. A privileged local user managing NFS exports could trigger this condition, potentially leading to improper export configuration and unexpected system behav
Red Hat
trafficserver: trafficserver: Security restriction bypass via improper access control
vendor_redhat·2026-10-02·CVSS 9.3
CVE-2026-102795 [CRITICAL] CWE-1288 trafficserver: trafficserver: Security restriction bypass via improper access control
trafficserver: trafficserver: Security restriction bypass via improper access control
Improper Access Control vulnerability in Apache Traffic Server.
This issue affects Apache Traffic Server: from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3.
Users are recommended to upgrade to version 9.2.15 or 10.1.4, which fixes the issue.
This CVE supersedes CVE-2026-41920, whose record listed the affected 9.x versions as 9.0.0 through 9.1.14 and the fixed version as 9.1.15. All 9.2.x releases before 9.2.15 are affected.
A flaw was found in Apache Traffic Server. Due to improper access controls, an unauthenticated remote attacker can bypass intended access restrictions. This vulnerability may allow an attacker to modify sensitive data or gain unauthorized access to protected resources.
Statement
Red Hat
kernel: tcp: reject non zerocopy devmem tx
vendor_redhat·2026-09-17·CVSS 7.8
CVE-2026-90051 [HIGH] CWE-1288 kernel: tcp: reject non zerocopy devmem tx
kernel: tcp: reject non zerocopy devmem tx
In the Linux kernel, the following vulnerability has been resolved:
tcp: reject non zerocopy devmem tx
Devmem tcp tx doesn't work without zero-copy, however it's not currently
enforced if NETIF_F_SG isn't present. In this case, tcp_sendmsg_locked()
will try the copy path and try to copy data from an iovec which consists
of offsets into the dma-buf and would normally fail. Moreover,
d9c56501c72fd ("net: tcp: block mixing readable and unreadable frags")
relies on that and assumes that the devmem binding is present IFF we're
using the zero-copy path, which can be used to mix net-iov and pages in
a single skb, and break invariants. Let's reject devmem tx without
zero-copy.
Note, the parameter check the patch is modifying is too loose, we can
create a
Red Hat
kernel: Linux Kernel: Denial of Service due to improper user space vector validation in block layer
vendor_redhat·2026-09-11·CVSS 4.7
CVE-2026-89584 [MEDIUM] CWE-1288 kernel: Linux Kernel: Denial of Service due to improper user space vector validation in block layer
kernel: Linux Kernel: Denial of Service due to improper user space vector validation in block layer
A flaw was found in the Linux kernel's block layer. This vulnerability arises from insufficient validation of user-space data structures (vectors) against the device's Direct Memory Access (DMA) alignment requirements. A local attacker could exploit this by providing misaligned data, causing the system to reject the input with an error and potentially leading to a Denial of Service (DoS).
Red Hat
kernel: samples/damon/mtier: fail early if address range parameters are invalid
vendor_redhat·2026-08-28·CVSS 5.5
CVE-2026-80592 [MEDIUM] CWE-1288 kernel: samples/damon/mtier: fail early if address range parameters are invalid
kernel: samples/damon/mtier: fail early if address range parameters are invalid
In the Linux kernel, the following vulnerability has been resolved:
samples/damon/mtier: fail early if address range parameters are invalid
The comment on top of `struct damon_region` clearly says that
For any use case, @ar should be non-zero positive size.
which is now verified in damon_verify_new_region() if the kernel is built
with DAMON_DEBUG_SANITY.
The WARN_ONCE() can be triggered if the mtier sample module is enabled
before node{0,1}_{start,end}_addr have been properly initialized, which is
obviously not good.
------------[ cut here ]------------
start 0 >= end 0
WARNING: mm/damon/core.c:217 at damon_new_region+0xf4/0x118, CPU#59: bash/341468
Call trace:
damon_new_region+0xf4/0x118 (P)
damon_set_regions
Red Hat
kernel: mptcp: avoid combining some incoming suboptions
vendor_redhat·2026-08-26·CVSS 9.8
CVE-2026-80587 [CRITICAL] CWE-1288 kernel: mptcp: avoid combining some incoming suboptions
kernel: mptcp: avoid combining some incoming suboptions
In the Linux kernel, the following vulnerability has been resolved:
mptcp: avoid combining some incoming suboptions
Some MPTCP suboptions are mutually exclusive according to the RFC8684,
but also because in different places, the code doesn't expect some
combinations to be present. That's specially true for suboptions that
would be present twice, but with different attributes.
The new restrictions are the same as the ones applied on the output
side, with mptcp_write_options. The same rules can be reused with a
small fix: an MP_FASTCLOSE can be used with a DSS when the sender picks
this option [1], which is not the case on Linux. Here are the rules:
Which options can be used together?
X: mutually exclusive
O: often used together
C: can
Red Hat
kernel: ntfs: validate resident index root values on lookup
vendor_redhat·2026-08-15·CVSS 9.8
CVE-2026-72199 [CRITICAL] CWE-1288 kernel: ntfs: validate resident index root values on lookup
kernel: ntfs: validate resident index root values on lookup
A flaw was found in the NTFS filesystem driver of the Linux kernel. This vulnerability arises from insufficient validation of resident index root values during lookup operations. An attacker could potentially craft a malicious NTFS filesystem that, when processed by the kernel, leads to inconsistent internal data structures. This could result in system instability or a denial of service (DoS) condition.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Re
Red Hat
kernel: ntfs: validate index block header more strictly
vendor_redhat·2026-08-15·CVSS 9.8
CVE-2026-72206 [CRITICAL] CWE-1288 kernel: ntfs: validate index block header more strictly
kernel: ntfs: validate index block header more strictly
A flaw was found in the Linux kernel's NTFS filesystem driver. Insufficient validation of index block headers within INDX blocks could allow a local attacker to craft a malicious NTFS filesystem image. When this image is processed by the kernel, it could lead to a kernel panic due to an out-of-bounds read, resulting in a denial of service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red
Red Hat
kernel: Linux kernel sched_ext: Incorrect warning during core scheduling
vendor_redhat·2026-08-10
CVE-2026-68421 [LOW] CWE-1288 kernel: Linux kernel sched_ext: Incorrect warning during core scheduling
kernel: Linux kernel sched_ext: Incorrect warning during core scheduling
In the Linux kernel, the following vulnerability has been resolved:
sched_ext: Don't warn on core-sched forced idle in put_prev_task_scx()
put_prev_task_scx() warns when a runnable task drops to a lower sched_class
without SCX_OPS_ENQ_LAST, on the assumption that balance_one() would have
kept it running. Core scheduling breaks that: a forced-idle SMT sibling
reschedules through the core_pick fast path in pick_next_task(), which skips
pick_task_scx() and thus balance_one(), so a runnable task can drop to idle
with ENQ_LAST unset.
Gate the warning on sched_cpu_cookie_match(): a cookie mismatch means core
scheduling forced the idle, while a match (or core scheduling off) still
catches a genuine missing-ENQ_LAST drop.
A
Red Hat
keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check
vendor_redhat·2026-07-28·CVSS 3.4
CVE-2026-18209 [LOW] CWE-1288 keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check
keycloak-services: keycloak-services: OIDC redirect_uri fragment bypass in HTTP parameter pollution check
A flaw was found in the keycloak-services component of Keycloak, which handles OpenID Connect (OIDC) authentication flows. The issue occurs because the security check designed to prevent HTTP parameter pollution only inspects the query portion of a redirect URL and ignores the fragment portion. When a client is configured with a wildcard redirect URI, an attacker can use this to inject duplicate security parameters into the login response. If a client application is not configured correctly, it might trust the attacker's injected data instead of the real security information from Keycloak, leading to session fixation or account confusion.
Statement: The Red Hat Product Security team
Red Hat
keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change
vendor_redhat·2026-07-16·CVSS 5.5
CVE-2026-15943 [MEDIUM] CWE-1288 keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change
keycloak-services: keycloak-services: OIDC IdP update reuses masked client secret after token URL change
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improper validation, Keycloak reuses the existing real secret even if security-sensitive fields like the token URL have been changed, allowing an attacker to redirect and capture the secret.
A flaw was found in the Keycloak keycloak-services component, which handles the management of identity providers. The issue occurs when a delegated administrator updates an OIDC identity provider using a masked client secret sentinel value. Due to improp
Red Hat
keycloak-services: keycloak-services: OIDC email_verified claim incorrectly applied to userinfo email
vendor_redhat·2026-07-05·CVSS 4.8
CVE-2026-14781 [MEDIUM] CWE-1288 keycloak-services: keycloak-services: OIDC email_verified claim incorrectly applied to userinfo email
keycloak-services: keycloak-services: OIDC email_verified claim incorrectly applied to userinfo email
A flaw exists in the org.keycloak.broker.oidc package where the OIDC broker incorrectly synchronizes the email_verified claim. When an OIDC identity provider is configured with trustEmail=true and the userinfo endpoint is enabled, Keycloak retrieves the email address from the userinfo response but retrieves the email_verified status exclusively from the id_token.
The root cause is a lack of validation ensuring that the email_verified claim in the id_token actually refers to the email address returned by the userinfo endpoint. If these two sources return different email addresses, the id_token's email_verified=true claim is blindly applied to the userinfo email.
Exploitation Conditions:
Th
Red Hat
golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images
vendor_redhat·2026-06-25·CVSS 7.5
CVE-2026-46601 [HIGH] CWE-1288 golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images
golang.org/x/image/webp: golang.org/x/image/webp: Denial of Service via malformed VP8 chunk in WebP images
The webp decoder can panic when processing a VP8 chunk with dimensions that do not match the canvas size.
A flaw was found in the `golang.org/x/image/webp` library's WebP decoder. A remote attacker could exploit this vulnerability by providing a specially crafted WebP image containing a VP8 chunk with mismatched dimensions. This could cause the decoder to panic, leading to a denial of service (DoS) for applications processing such images.
Statement: Red Hat products are not affected by this vulnerability. The vulnerable WebP decoder in golang.org/x/image/webp is present as a transitive dependency but is never imported or called by any affected product. VolSync is a storage replicat
Red Hat
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
vendor_redhat·2026-06-22·CVSS 5.9
CVE-2026-53538 [MEDIUM] CWE-1288 python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
python-multipart: Python-Multipart: Information disclosure due to parser differential in form data handling
Python-Multipart is a streaming multipart parser for Python. Prior to 0.0.30, QuerystringParser treated ; as a field separator in application/x-www-form-urlencoded bodies, in addition to &. The WHATWG URL standard, modern browsers, and Python's urllib.parse (since the CVE-2021-23336 fix) treat only & as a separator. This creates a parser differential: the same bytes are tokenized into different fields than a WHATWG compliant intermediary would produce, allowing an attacker to smuggle extra form fields past an upstream body inspecting component. This vulnerability is fixed in 0.0.30.
A flaw was found in Python-Multipart, a tool used for processing web form data. A remote attacker co
Red Hat
libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling
vendor_redhat·2026-06-04·CVSS 5.4
CVE-2026-40930 [MEDIUM] CWE-1288 libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling
libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling
LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.
A flaw was found in libpng, a library used for processing PNG (Portable Network Graphics) image files. In version 1.8.0, a remote attacker could provide a specially crafted APNG (Animated Portable Network Graphics)
Red Hat
kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
vendor_redhat·2026-05-28·CVSS 7.0
CVE-2026-46117 [HIGH] CWE-1288 kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
kernel: RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss()
A flaw was found in the Linux kernel's RDMA/mana component. A local user could trigger a kernel corruption by providing specific configurations through the user Application Programming Interface (uAPI) that cause an internal error. This issue arises when Work Queues (WQs) are specified to share the same Completion Queue (CQ), leading to an unstable system state.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Af
Red Hat
kernel: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
vendor_redhat·2026-05-27·CVSS 5.5
CVE-2026-45873 [LOW] CWE-1288 kernel: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
kernel: netfilter: nft_set_rbtree: check for partial overlaps in anonymous sets
No description is available for this CVE.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 9) - Fix deferred
Red Hat
keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604
vendor_redhat·2026-05-27·CVSS 4.2
CVE-2026-9689 [MEDIUM] CWE-1288 keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604
keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604
A flaw was found in Keycloak, an open-source identity and access management solution. When a client application is configured to accept broad redirect Uniform Resource Identifiers (URIs), a remote attacker can manipulate the authentication process by crafting a special web address. If a user clicks this link, the client application might incorrectly prioritize attacker-controlled information over legitimate data. This vulnerability, known as HTTP parameter pollution, could allow an attacker to bypass security measures or gain unauthorized access to resources.
Statement: This Moderate severity flaw in Keycloak arises from HTTP parameter pollution when a clie
Red Hat
kernel: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
vendor_redhat·2026-05-27·CVSS 5.5
CVE-2026-46002 [LOW] CWE-1288 kernel: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
kernel: ext2: reject inodes with zero i_nlink and valid mode in ext2_iget()
A flaw was found in the Linux kernel's ext2 filesystem. A local attacker could create a specially crafted filesystem image with malformed inodes (index nodes) that, when mounted, would not be properly rejected by the ext2_iget() function. This could lead to a kernel warning and potentially a system crash, resulting in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affe
Red Hat
kernel: erofs: fix inline data read failure for ztailpacking pclusters
vendor_redhat·2026-05-27·CVSS 5.5
CVE-2026-45943 [MEDIUM] CWE-1288 kernel: erofs: fix inline data read failure for ztailpacking pclusters
kernel: erofs: fix inline data read failure for ztailpacking pclusters
A flaw was found in the Linux kernel's erofs filesystem. This issue occurs when compressed folios for ztailpacking pclusters are not validated before being added to I/O chains. An attacker could potentially trigger a NULL pointer dereference, leading to a system crash and a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Not affected
Package: kernel (Red Hat Enterprise Linux 9) - Not aff
Red Hat
kernel: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
vendor_redhat·2026-05-06·CVSS 5.5
CVE-2026-43081 [MEDIUM] CWE-1288 kernel: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
kernel: net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
A flaw was found in the Linux kernel's Integrated Packet Accelerator (IPA) driver. Incorrectly configured register field masks for IPA version 5.0 and newer could lead to system instability. This issue may manifest as a warning when attempting to send commands to the MPSS remoteproc, potentially resulting in a denial of service where the system fails to operate as intended.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Linu
Red Hat
kernel: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
vendor_redhat·2026-05-06·CVSS 5.5
CVE-2026-43265 [LOW] CWE-1288 kernel: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
kernel: KVM: x86: Ignore -EBUSY when checking nested events from vcpu_block()
A flaw was found in the Linux kernel's Kernel-based Virtual Machine (KVM) for x86 architectures. A local user or a malicious guest operating system could manipulate the virtual CPU (vCPU) state by injecting events while the vCPU is in a blocking state. This could lead to a spurious exit to userspace, potentially causing the virtual machine to crash, resulting in a Denial of Service (DoS).
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: ke
Red Hat
kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-31709 [HIGH] CWE-1288 kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
kernel: smb: client: validate the whole DACL before rewriting it in cifsacl
A flaw was found in the Linux kernel's Server Message Block (SMB) client, specifically within the cifsacl functionality. A malicious SMB server could provide a malformed Discretionary Access Control List (DACL) that claims to contain more Access Control Entries (ACEs) than are actually present. This insufficient validation allows the kernel to read or copy data beyond the intended memory boundaries, leading to memory corruption. This could potentially result in information disclosure or a denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat E
Red Hat
kernel: btrfs: reject root items with drop_progress and zero drop_level
vendor_redhat·2026-05-01·CVSS 7.0
CVE-2026-43046 [MEDIUM] CWE-1288 kernel: btrfs: reject root items with drop_progress and zero drop_level
kernel: btrfs: reject root items with drop_progress and zero drop_level
A flaw was found in the Linux kernel's btrfs filesystem. This vulnerability allows an attacker with local access to trigger a kernel bug (system crash) by providing specially crafted, malformed btrfs metadata on disk. Specifically, an invalid state where drop_progress.objectid is non-zero and drop_level is zero in a root_item is not properly validated when read from disk. This can lead to a denial of service (DoS) when the system attempts to recover relocation or drop a snapshot.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affecte
Red Hat
kernel: ext4: reject mount if bigalloc with s_first_data_block != 0
vendor_redhat·2026-04-22·CVSS 5.5
CVE-2026-31447 [MEDIUM] CWE-1288 kernel: ext4: reject mount if bigalloc with s_first_data_block != 0
kernel: ext4: reject mount if bigalloc with s_first_data_block != 0
A flaw was found in the `ext4` filesystem component of the Linux kernel. This vulnerability occurs when a local user attempts to mount an `ext4` filesystem that is configured with `bigalloc` and a non-zero `s_first_data_block` value, a configuration that is not supported. The consequence is a Denial of Service (DoS), as the system will reject the mount operation, preventing access to the filesystem.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 7) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package: k
Red Hat
kernel: crypto: algif_aead - Revert to operating out-of-place
vendor_redhat·2026-04-22·CVSS 5.5
CVE-2026-31431 [MEDIUM] CWE-1288 kernel: crypto: algif_aead - Revert to operating out-of-place
kernel: crypto: algif_aead - Revert to operating out-of-place
A flaw was found in the Linux kernel's algif_aead cryptographic algorithm interface. An incorrect 'in-place operation' was introduced, where the source and destination data mappings were different. This could lead to unexpected behavior or data integrity issues during cryptographic operations, potentially impacting the reliability of encrypted communications.
Package: kernel (Red Hat Enterprise Linux 10) - Fix deferred
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Fix deferred
Package: kernel-rt (Red Hat Enterprise Linux 8) - Fix deferred
P
Red Hat
avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
vendor_redhat·2026-04-03·CVSS 5.5
CVE-2026-34933 [MEDIUM] CWE-1288 avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
avahi: avahi-daemon: Avahi: Denial of Service via D-Bus method call
Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. Prior to version 0.9-rc4, any unprivileged local user can crash avahi-daemon by sending a single D-Bus method call with conflicting publish flags. This issue has been patched in version 0.9-rc4.
A flaw was found in Avahi. An unprivileged local user can exploit this vulnerability by sending a D-Bus method call with conflicting publish flags. This can lead to a denial of service (DoS) by crashing the avahi-daemon, making the service unavailable.
Package: avahi (Red Hat Enterprise Linux 10) - Fix deferred
Package: avahi (Red Hat Enterprise Linux 6) - Fix deferred
Package: avahi (Red Hat Enterprise Linux 7) - Fix d
Red Hat
kernel: netfilter: nft_set_rbtree: validate open interval overlap
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23333 [LOW] CWE-1288 kernel: netfilter: nft_set_rbtree: validate open interval overlap
kernel: netfilter: nft_set_rbtree: validate open interval overlap
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_set_rbtree: validate open interval overlap
Open intervals do not have an end element, in particular an open
interval at the end of the set is hard to validate because of it is
lacking the end element, and interval validation relies on such end
element to perform the checks.
This patch adds a new flag field to struct nft_set_elem, this is not an
issue because this is a temporary object that is allocated in the stack
from the insert/deactivate path. This flag field is used to specify that
this is the last element in this add/delete command.
The last flag is used, in combination with the start element cookie, to
check if there is a partial overl
Red Hat
kernel: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23310 [LOW] CWE-1288 kernel: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
kernel: bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
In the Linux kernel, the following vulnerability has been resolved:
bpf/bonding: reject vlan+srcmac xmit_hash_policy change when XDP is loaded
bond_option_mode_set() already rejects mode changes that would make a
loaded XDP program incompatible via bond_xdp_check(). However,
bond_option_xmit_hash_policy_set() has no such guard.
For 802.3ad and balance-xor modes, bond_xdp_check() returns false when
xmit_hash_policy is vlan+srcmac, because the 802.1q payload is usually
absent due to hardware offload. This means a user can:
1. Attach a native XDP program to a bond in 802.3ad/balance-xor mode
with a compatible xmit_hash_policy (e.g. layer2+3).
2. Change xmit_hash_policy to vlan+srcmac while XDP remains loaded.
Red Hat
kernel: net: usb: kaweth: validate USB endpoints
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23312 [LOW] CWE-1288 kernel: net: usb: kaweth: validate USB endpoints
kernel: net: usb: kaweth: validate USB endpoints
In the Linux kernel, the following vulnerability has been resolved:
net: usb: kaweth: validate USB endpoints
The kaweth driver should validate that the device it is probing has the
proper number and types of USB endpoints it is expecting before it binds
to it. If a malicious device were to not have the same urbs the driver
will crash later on when it blindly accesses these endpoints.
A flaw was found in the Linux kernel's kaweth driver. A malicious USB device can exploit this vulnerability by not providing the expected number and types of USB endpoints during device probing. The driver fails to validate these endpoints, leading to an attempt to blindly access them, which can cause the driver to crash. This results in a Denial of Service (D
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-06-17
Published