CVE-2025-49178

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore

A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2025-5449

Libssh: integer overflow in libssh sftp server packet length validation leading to denial of service

A flaw was found in the SFTP server message decoding logic of libssh. The issue occurs due to an incorrect packet length check that allows an integer overflow when handling large payload sizes on 32-bit systems. This issue leads to failed memory allocation and causes the server process to crash, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Libssh Redhat

Products

Libssh Enterprise Linux Openshift and 1 more

CVE-2025-5372

Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Libssh Redhat

Products

Libssh Enterprise Linux Openshift and 6 more

CVE-2025-5351

Libssh: double free vulnerability in libssh key export functions

A flaw was found in the key export functionality of libssh. The issue occurs in the internal function responsible for converting cryptographic keys into serialized formats. During error handling, a memory structure is freed but not cleared, leading to a potential double free issue if an additional failure occurs later in the function. This condition may result in heap corruption or application instability in low-memory scenarios, posing a risk to system reliability where key export operations are performed.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Libssh Redhat

Products

Libssh Enterprise Linux Openshift and 2 more

CVE-2025-5222

Icu: stack buffer overflow in the srbroot::addtag function

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat Unicode

Products

Enterprise Linux Openshift Rhel E4s and 3 more

CVE-2025-4969

Libsoup: off-by-one out-of-bounds read in find_boundary() in soup-multipart.c

A vulnerability was found in the libsoup package. This flaw stems from its failure to correctly verify the termination of multipart HTTP messages. This can allow a remote attacker to send a specially crafted multipart HTTP body, causing the libsoup-consuming server to read beyond its allocated memory boundaries (out-of-bounds read).

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2025-26466

Openssh: denial-of-service in openssh

A flaw was found in the OpenSSH package. For each ping packet the SSH server receives, a pong packet is allocated in a memory buffer and stored in a queue of packages. It is only freed when the server/client key exchange has finished. A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. Consequently, the server may become unavailable, resulting in a denial of service attack.

CVSS 3.1 · 5.9 Medium EPSS 38.7% KEV · Not listed

Vendors

Canonical Debian Openbsd and 1 more

Products

Ubuntu Linux Debian Linux Openssh and 3 more

CVE-2025-26465

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

CVSS 3.1 · 6.8 Medium EPSS 7.7% KEV · Not listed

Vendors

Debian Netapp Openbsd and 1 more

Products

Debian Linux Active Iq Unified Manager Ontap and 7 more

CVE-2025-2784

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Libsoup Codeready Linux Builder Codeready Linux Builder For Arm64 and 23 more

CVE-2025-2487

389-ds-base: null pointer dereference leads to denial of service

A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server Eus Enterprise Linux and 2 more

CVE-2025-3359

Gnuplot: segmentation fault via io_str_init_static_internal function

A flaw was found in GNUPlot. A segmentation fault via IO_str_init_static_internal may jeopardize the environment.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Els

CVE-2025-0620

Samba: smbd doesn't pick up group membership changes when re-authenticating an expired smb session

A flaw was found in Samba. The smbd service daemon does not pick up group membership changes when re-authenticating an expired SMB session. This issue can expose file shares until clients disconnect and then connect again.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat Samba

Products

Enterprise Linux Openshift Rhel Els and 1 more

CVE-2024-7006

Libtiff: null pointer dereference in tif_dirinfo.c

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux Enterprise Linux For Arm 64 and 4 more

CVE-2025-11568

Luksmeta: data corruption when handling luks1 partitions with luksmeta

A data corruption vulnerability has been identified in the luksmeta utility when used with the LUKS1 disk encryption format. An attacker with the necessary permissions can exploit this flaw by writing a large amount of metadata to an encrypted device. The utility fails to correctly validate the available space, causing the metadata to overwrite and corrupt the user's encrypted data. This action leads to a permanent loss of the stored information. Devices using the LUKS formats other than LUKS1 are not affected by this issue.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2025-11234

Qemu-kvm: vnc websocket handshake use-after-free

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Aus and 5 more

CVE-2025-10911

Libxslt: use-after-free with key data stored cross-rvt

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Discovery Enterprise Linux Enterprise Linux Eus and 10 more

CVE-2025-1118

Grub2: commands/dump: the dump command is not in lockdown when secure boot is enabled

A flaw was found in grub2. Grub's dump command is not blocked when grub is in lockdown mode, which allows the user to read any memory information, and an attacker may leverage this in order to extract signatures, salts, and other sensitive information from the memory.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2025-1125

Grub2: fs/hfs: integer overflow may lead to heap based out-of-bounds write

When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesystem may lead some of those buffer size calculation to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result the hfsplus_open_compressed_real() function will write past of the internal buffer length. This flaw may be leveraged to corrupt grub's internal critical data and may result in arbitrary code execution by-passing secure boot protections.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Enterprise Linux Openshift and 1 more

CVE-2025-0690

Grub2: read: integer overflow may lead to out-of-bounds write

The read command is used to read the keyboard input from the user, while reads it keeps the input length in a 32-bit integer value which is further used to reallocate the line buffer to accept the next character. During this process, with a line big enough it's possible to make this variable to overflow leading to a out-of-bounds write in the heap based buffer. This flaw may be leveraged to corrupt grub's internal critical data and secure boot bypass is not discarded as consequence.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Els

CVE-2025-0686

Grub2: romfs: integer overflow when handling symlinks may lead to heap based out-of-bounds write when reading dat

A flaw was found in grub2. When performing a symlink lookup from a romfs filesystem, grub's romfs filesystem module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some of those buffer size calculations to overflow, causing it to perform a grub_malloc() operation with a smaller size than expected. As a result, the grub_romfs_read_symlink() may cause out-of-bounds writes when the calling grub_disk_read() function. This issue may be leveraged to corrupt grub's internal critical data and can result in arbitrary code execution by-passing secure boot protections.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Grub2 Enterprise Linux Openshift and 1 more