RHSA-2026:30078

Vulnerability from csaf_redhat - Published: 2026-06-25 18:29 - Updated: 2026-06-26 06:47
Summary
Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)
Severity
Important
Notes
Topic: Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA) is now available.
Details: Red Hat® AI Inference Server Model Optimization Tools
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
CVE-2025-14926

A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious SEW model checkpoint, causing arbitrary code execution in the context of the user converting the file.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2025-14927

A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious SEW-D model checkpoint, causing arbitrary code execution in the context of the user converting the file.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2025-14928

A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious HuBERT model checkpoint, causing arbitrary code execution in the context of the user converting the file.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2025-14930

A flaw was found in the Hugging Face Transformers library. The parsing of weights fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious GLM4 model, resulting in arbitrary code execution in the context of the current user processing the file.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-4775

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-4786

A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing "%action" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.

7.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L
CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-4878

A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.

6.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H
CWE-367 - Time-of-check Time-of-use (TOCTOU) Race Condition
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-6100

A flaw was found in Python's decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-825 - Expired Pointer Dereference
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-10118

A flaw was found in Poppler's Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.

7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-34588

A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-34982

A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.

8.2 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N
CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-35385

A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.

7.5 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-281 - Improper Preservation of Permissions
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-37555

A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application linked to the library and memory corruption.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
CWE-190 - Integer Overflow or Wraparound
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-39979

A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.

8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
CWE-125 - Out-of-bounds Read
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-40164

A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq's hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-341 - Predictable from Observable State
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Workaround
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Workaround
Threats
Impact Important
CVE-2026-44431

A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.

5.9 (Medium)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-201 - Insertion of Sensitive Information Into Sent Data
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Threats
Impact Moderate
CVE-2026-44432

A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Product Identifier Version Remediation
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 —
Vendor Fix fix
Unresolved product id: Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 —
Vendor Fix fix
Threats
Impact Important
References
URL Category
https://access.redhat.com/errata/RHSA-2026:30078 self
https://access.redhat.com/security/cve/CVE-2025-14926 external
https://access.redhat.com/security/cve/CVE-2025-14927 external
https://access.redhat.com/security/cve/CVE-2025-14928 external
https://access.redhat.com/security/cve/CVE-2025-14930 external
https://access.redhat.com/security/cve/CVE-2026-10118 external
https://access.redhat.com/security/cve/CVE-2026-34588 external
https://access.redhat.com/security/cve/CVE-2026-34982 external
https://access.redhat.com/security/cve/CVE-2026-35385 external
https://access.redhat.com/security/cve/CVE-2026-37555 external
https://access.redhat.com/security/cve/CVE-2026-39979 external
https://access.redhat.com/security/cve/CVE-2026-40164 external
https://access.redhat.com/security/cve/CVE-2026-44431 external
https://access.redhat.com/security/cve/CVE-2026-44432 external
https://access.redhat.com/security/cve/CVE-2026-4775 external
https://access.redhat.com/security/cve/CVE-2026-4786 external
https://access.redhat.com/security/cve/CVE-2026-4878 external
https://access.redhat.com/security/cve/CVE-2026-6100 external
https://access.redhat.com/security/updates/classi… external
https://www.redhat.com/en/products/ai/inference-server external
https://security.access.redhat.com/data/csaf/v2/a… self
https://access.redhat.com/security/cve/CVE-2025-14926 self
https://bugzilla.redhat.com/show_bug.cgi?id=2424723 external
https://www.cve.org/CVERecord?id=CVE-2025-14926 external
https://nvd.nist.gov/vuln/detail/CVE-2025-14926 external
https://www.zerodayinitiative.com/advisories/ZDI-… external
https://access.redhat.com/security/cve/CVE-2025-14927 self
https://bugzilla.redhat.com/show_bug.cgi?id=2424751 external
https://www.cve.org/CVERecord?id=CVE-2025-14927 external
https://nvd.nist.gov/vuln/detail/CVE-2025-14927 external
https://www.zerodayinitiative.com/advisories/ZDI-… external
https://access.redhat.com/security/cve/CVE-2025-14928 self
https://bugzilla.redhat.com/show_bug.cgi?id=2424731 external
https://www.cve.org/CVERecord?id=CVE-2025-14928 external
https://nvd.nist.gov/vuln/detail/CVE-2025-14928 external
https://www.zerodayinitiative.com/advisories/ZDI-… external
https://access.redhat.com/security/cve/CVE-2025-14930 self
https://bugzilla.redhat.com/show_bug.cgi?id=2424769 external
https://www.cve.org/CVERecord?id=CVE-2025-14930 external
https://nvd.nist.gov/vuln/detail/CVE-2025-14930 external
https://www.zerodayinitiative.com/advisories/ZDI-… external
https://access.redhat.com/security/cve/CVE-2026-4775 self
https://bugzilla.redhat.com/show_bug.cgi?id=2450768 external
https://www.cve.org/CVERecord?id=CVE-2026-4775 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4775 external
https://access.redhat.com/security/cve/CVE-2026-4786 self
https://bugzilla.redhat.com/show_bug.cgi?id=2458049 external
https://www.cve.org/CVERecord?id=CVE-2026-4786 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4786 external
https://github.com/python/cpython/issues/148169 external
https://github.com/python/cpython/pull/148170 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-4878 self
https://bugzilla.redhat.com/show_bug.cgi?id=2451615 external
https://www.cve.org/CVERecord?id=CVE-2026-4878 external
https://nvd.nist.gov/vuln/detail/CVE-2026-4878 external
https://bugzilla.redhat.com/show_bug.cgi?id=2447554 external
https://access.redhat.com/security/cve/CVE-2026-6100 self
https://bugzilla.redhat.com/show_bug.cgi?id=2457932 external
https://www.cve.org/CVERecord?id=CVE-2026-6100 external
https://nvd.nist.gov/vuln/detail/CVE-2026-6100 external
https://github.com/python/cpython/commit/6a5f79c8… external
https://github.com/python/cpython/commit/8fc66aef… external
https://github.com/python/cpython/commit/c3cf71c3… external
https://github.com/python/cpython/issues/148395 external
https://github.com/python/cpython/pull/148396 external
https://mail.python.org/archives/list/security-an… external
https://access.redhat.com/security/cve/CVE-2026-10118 self
https://bugzilla.redhat.com/show_bug.cgi?id=2460428 external
https://www.cve.org/CVERecord?id=CVE-2026-10118 external
https://nvd.nist.gov/vuln/detail/CVE-2026-10118 external
https://gitlab.freedesktop.org/poppler/poppler/-/… external
https://access.redhat.com/security/cve/CVE-2026-34588 self
https://bugzilla.redhat.com/show_bug.cgi?id=2455408 external
https://www.cve.org/CVERecord?id=CVE-2026-34588 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34588 external
https://github.com/AcademySoftwareFoundation/open… external
https://access.redhat.com/security/cve/CVE-2026-34982 self
https://bugzilla.redhat.com/show_bug.cgi?id=2455400 external
https://www.cve.org/CVERecord?id=CVE-2026-34982 external
https://nvd.nist.gov/vuln/detail/CVE-2026-34982 external
http://www.openwall.com/lists/oss-security/2026/04/01/1 external
https://github.com/vim/vim/commit/75661a66a1db1e1… external
https://github.com/vim/vim/releases/tag/v9.2.0276 external
https://github.com/vim/vim/security/advisories/GH… external
https://access.redhat.com/security/cve/CVE-2026-35385 self
https://bugzilla.redhat.com/show_bug.cgi?id=2454469 external
https://www.cve.org/CVERecord?id=CVE-2026-35385 external
https://nvd.nist.gov/vuln/detail/CVE-2026-35385 external
https://marc.info/?l=openssh-unix-dev&m=177513443… external
https://www.openssh.org/releasenotes.html#10.3p1 external
https://www.openwall.com/lists/oss-security/2026/… external
https://access.redhat.com/security/cve/CVE-2026-37555 self
https://bugzilla.redhat.com/show_bug.cgi?id=2463856 external
https://www.cve.org/CVERecord?id=CVE-2026-37555 external
https://nvd.nist.gov/vuln/detail/CVE-2026-37555 external
https://github.com/libsndfile/libsndfile/commit/9… external
https://github.com/libsndfile/libsndfile/issues/833 external
https://access.redhat.com/security/cve/CVE-2026-39979 self
https://bugzilla.redhat.com/show_bug.cgi?id=2458077 external
https://www.cve.org/CVERecord?id=CVE-2026-39979 external
https://nvd.nist.gov/vuln/detail/CVE-2026-39979 external
https://github.com/jqlang/jq/commit/2f09060afab23… external
https://github.com/jqlang/jq/security/advisories/… external
https://access.redhat.com/security/cve/CVE-2026-40164 self
https://bugzilla.redhat.com/show_bug.cgi?id=2458084 external
https://www.cve.org/CVERecord?id=CVE-2026-40164 external
https://nvd.nist.gov/vuln/detail/CVE-2026-40164 external
https://github.com/jqlang/jq/commit/0c7d133c3c7e3… external
https://github.com/jqlang/jq/security/advisories/… external
https://access.redhat.com/security/cve/CVE-2026-44431 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477167 external
https://www.cve.org/CVERecord?id=CVE-2026-44431 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44431 external
https://github.com/urllib3/urllib3/security/advis… external
https://access.redhat.com/security/cve/CVE-2026-44432 self
https://bugzilla.redhat.com/show_bug.cgi?id=2477154 external
https://www.cve.org/CVERecord?id=CVE-2026-44432 external
https://nvd.nist.gov/vuln/detail/CVE-2026-44432 external
https://github.com/urllib3/urllib3/security/advis… external
Acknowledgments
Quang Luong PrymEvol
Ali Raza
AISLE Research
To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Inference Server Model Optimization Tools",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:30078",
        "url": "https://access.redhat.com/errata/RHSA-2026:30078"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14926",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14926"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14927",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14927"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14928",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14928"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-14930",
        "url": "https://access.redhat.com/security/cve/CVE-2025-14930"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-10118",
        "url": "https://access.redhat.com/security/cve/CVE-2026-10118"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34588",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34588"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-34982",
        "url": "https://access.redhat.com/security/cve/CVE-2026-34982"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-35385",
        "url": "https://access.redhat.com/security/cve/CVE-2026-35385"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-37555",
        "url": "https://access.redhat.com/security/cve/CVE-2026-37555"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-39979",
        "url": "https://access.redhat.com/security/cve/CVE-2026-39979"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-40164",
        "url": "https://access.redhat.com/security/cve/CVE-2026-40164"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4775",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4775"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4786",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-4878",
        "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-6100",
        "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30078.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference Server Model Optimization Tools 3.3.5 (CUDA)",
    "tracking": {
      "current_release_date": "2026-06-26T06:47:00+00:00",
      "generator": {
        "date": "2026-06-26T06:47:00+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.2.5"
        }
      },
      "id": "RHSA-2026:30078",
      "initial_release_date": "2026-06-25T18:29:28+00:00",
      "revision_history": [
        {
          "date": "2026-06-25T18:29:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-06-25T18:29:43+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-26T06:47:00+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.3",
                "product": {
                  "name": "Red Hat AI Inference Server 3.3",
                  "product_id": "Red Hat AI Inference Server 3.3",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.3::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
                  "product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3A21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis/model-opt-cuda-rhel9\u0026tag=1782352950"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
                  "product_id": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/model-opt-cuda-rhel9@sha256%3Af94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969?arch=arm64\u0026repository_url=registry.redhat.io/rhaiis/model-opt-cuda-rhel9\u0026tag=1782352950"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64 as a component of Red Hat AI Inference Server 3.3",
          "product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64"
        },
        "product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.3"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64 as a component of Red Hat AI Inference Server 3.3",
          "product_id": "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        },
        "product_reference": "registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.3"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-14926",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2025-12-23T22:01:56.621147+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424723"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious SEW model checkpoint, causing arbitrary code execution in the context of the user converting the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when converting a malicious SEW model checkpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted SEW model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14926"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424723",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424723"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14926",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14926"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14926",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14926"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1147/"
        }
      ],
      "release_date": "2025-12-23T21:04:32.162000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid converting SEW model checkpoints from untrusted or unverified sources. Ensure that all SEW model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when converting a malicious SEW model checkpoint"
    },
    {
      "cve": "CVE-2025-14927",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2025-12-23T22:04:01.976430+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424751"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious SEW-D model checkpoint, causing arbitrary code execution in the context of the user converting the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when converting a malicious SEW-D model checkpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted SEW-D model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14927"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424751",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424751"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14927",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14927"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14927",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14927"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1148/"
        }
      ],
      "release_date": "2025-12-23T21:04:28.008000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid converting SEW-D model checkpoints from untrusted or unverified sources. Ensure that all SEW-D model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when converting a malicious SEW-D model checkpoint"
    },
    {
      "cve": "CVE-2025-14928",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "discovery_date": "2025-12-23T22:02:35.224747+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424731"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The convert_config function fails to validate a user-supplied string before using it to execute Python code. An attacker can exploit this flaw by providing a malicious HuBERT model checkpoint, causing arbitrary code execution in the context of the user converting the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when converting a malicious HuBERT model checkpoint",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted HuBERT model checkpoint, limiting the possibility of exploitation. Additionally, model checkpoints are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14928"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424731",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424731"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14928",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14928"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14928",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14928"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1146/"
        }
      ],
      "release_date": "2025-12-23T21:04:48.438000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid converting HuBERT model checkpoints from untrusted or unverified sources. Ensure that all HuBERT model checkpoints processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when converting a malicious HuBERT model checkpoint"
    },
    {
      "cve": "CVE-2025-14930",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2025-12-23T22:05:28.509553+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2424769"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Hugging Face Transformers library. The parsing of weights fails to validate user-supplied data, causing a deserialization of untrusted data. An attacker can exploit this issue by providing a malicious GLM4 model, resulting in arbitrary code execution in the context of the current user processing the file.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "transformers: code execution when processing a malicious GLM4 model file",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker must convince a user to process a specially crafted GLM4 model file or visiting a malicious page, limiting the possibility of exploitation. Additionally, model files are not typically processed by users with administrative privileges, limiting the potential for a full system compromise. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-14930"
        },
        {
          "category": "external",
          "summary": "RHBZ#2424769",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2424769"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-14930",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-14930"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-14930",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14930"
        },
        {
          "category": "external",
          "summary": "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/",
          "url": "https://www.zerodayinitiative.com/advisories/ZDI-25-1145/"
        }
      ],
      "release_date": "2025-12-23T21:04:52.512000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid processing GLM4 model files from untrusted or unverified sources. Ensure that all GLM4 model files processed by the Hugging Face Transformers library originate from trusted repositories or have been verified for integrity. If that is not possible, consider processing untrusted models within an isolated sandbox environment.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "transformers: code execution when processing a malicious GLM4 model file"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Quang Luong",
            "PrymEvol"
          ]
        }
      ],
      "cve": "CVE-2026-4775",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-03-24T14:23:23.826000+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2450768"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw in the libtiff library, affecting the processing of specially crafted TIFF files, could lead to a denial of service or potentially arbitrary code execution. This vulnerability, caused by a signed integer overflow during TIFF image processing, results in an out-of-bounds heap write. Red Hat products that process untrusted TIFF files using libtiff may be impacted.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4775"
        },
        {
          "category": "external",
          "summary": "RHBZ#2450768",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450768"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4775",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4775"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4775"
        }
      ],
      "release_date": "2026-03-24T14:33:35.730000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid processing untrusted or maliciously crafted TIFF files with applications linked against the libtiff library. If processing untrusted TIFF files is unavoidable, consider running the affected applications within a sandboxed environment to limit the potential impact of successful exploitation. This operational control helps contain the effects of an out-of-bounds write, reducing the risk of denial of service or arbitrary code execution.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libtiff: libtiff: Arbitrary code execution or denial of service via signed integer overflow in TIFF file processing"
    },
    {
      "cve": "CVE-2026-4786",
      "cwe": {
        "id": "CWE-88",
        "name": "Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)"
      },
      "discovery_date": "2026-04-13T22:01:38.006388+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458049"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the Python webbrowser.open() API. If a specially crafted URL containing \"%action\" is processed, an attacker could bypass a previous mitigation for CVE-2026-4519. This bypass allows for command injection into the underlying shell, potentially leading to arbitrary code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw in the Python `webbrowser.open()` API allows for command injection and arbitrary code execution when processing specially crafted URLs containing \"%action\". This bypasses a previous mitigation for CVE-2026-4519.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458049",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458049"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4786",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4786"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148169",
          "url": "https://github.com/python/cpython/issues/148169"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148170",
          "url": "https://github.com/python/cpython/pull/148170"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/JQDUNJVB4AQNTJECSUKOBDU3XCJIPSE5/"
        }
      ],
      "release_date": "2026-04-13T21:52:19.036000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: cpython: Python: Arbitrary code execution via command injection in webbrowser.open() API"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ali Raza"
          ]
        }
      ],
      "cve": "CVE-2026-4878",
      "cwe": {
        "id": "CWE-367",
        "name": "Time-of-check Time-of-use (TOCTOU) Race Condition"
      },
      "discovery_date": "2026-03-26T06:56:21.213270+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2451615"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in libcap. A local unprivileged user can exploit a Time-of-check-to-time-of-use (TOCTOU) race condition in the `cap_set_file()` function. This allows an attacker with write access to a parent directory to redirect file capability updates to an attacker-controlled file. By doing so, capabilities can be injected into or stripped from unintended executables, leading to privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw. A Time-of-Check-to-Time-of-Use (TOCTOU) race condition in libcap\u0027s cap_set_file() allows a local unprivileged user to escalate privileges. An attacker with write access to a parent directory can exploit a narrow window during file capability updates to redirect capabilities to an attacker-controlled file. This can lead to the injection of elevated privileges into an unintended executable when privileged processes, such as setcap or container tooling, invoke cap_set_file() on attacker-influenced paths.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "RHBZ#2451615",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2451615"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-4878",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4878"
        },
        {
          "category": "external",
          "summary": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447554"
        }
      ],
      "release_date": "2026-04-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()"
    },
    {
      "cve": "CVE-2026-6100",
      "cwe": {
        "id": "CWE-825",
        "name": "Expired Pointer Dereference"
      },
      "discovery_date": "2026-04-13T18:01:31.970255+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2457932"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Python\u0027s decompression modules, including `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile`. This vulnerability, a use-after-free, can occur if a program attempts to re-use a decompression object after a memory allocation error, especially when the system is experiencing high memory usage. Exploitation of this flaw could potentially allow an attacker to execute arbitrary code or access sensitive data. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The severity of this flaw is somewhat mitigated on Red Hat platforms. By default processes are not executed with root user privilege and are limited in their scope which in turn limits the impact of this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "RHBZ#2457932",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2457932"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-6100",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6100"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d",
          "url": "https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2",
          "url": "https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20",
          "url": "https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/issues/148395",
          "url": "https://github.com/python/cpython/issues/148395"
        },
        {
          "category": "external",
          "summary": "https://github.com/python/cpython/pull/148396",
          "url": "https://github.com/python/cpython/pull/148396"
        },
        {
          "category": "external",
          "summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/",
          "url": "https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/"
        }
      ],
      "release_date": "2026-04-13T17:15:47.606000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "AISLE Research"
          ],
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2026-10118",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-21T23:20:23+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2460428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Poppler\u0027s Splash backend. A remote attacker could exploit this vulnerability by crafting a malicious PDF file that, when rendered, triggers an integer overflow in the `tilingPatternFill` function. This overflow leads to an undersized heap memory allocation, allowing a subsequent out-of-bounds write. Successful exploitation could result in arbitrary code execution, information disclosure, or denial of service within the context of the application processing the PDF.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important heap-based memory corruption flaw in Poppler\u0027s Splash backend. Processing a specially crafted PDF document can lead to an integer overflow, resulting in an undersized heap allocation and a subsequent out-of-bounds write. This could allow an attacker to achieve arbitrary code execution, disclose sensitive information, or cause a denial of service within the context of the application rendering the PDF. To successfully exploit this vulnerability the attacker needs to be able to supply the maliciously crafted PDF file to the application consuming poppler or trick the user to process the PDF file using the Poppler\u0027s backend.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-10118"
        },
        {
          "category": "external",
          "summary": "RHBZ#2460428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-10118",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-10118"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-10118"
        },
        {
          "category": "external",
          "summary": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715",
          "url": "https://gitlab.freedesktop.org/poppler/poppler/-/work_items/1715"
        }
      ],
      "release_date": "2026-06-01T15:25:35.578000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, users should avoid opening untrusted or suspicious PDF documents with applications that utilize the Poppler library for rendering. Limiting exposure to untrusted content can reduce the risk of exploitation.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "poppler: Integer overflow in Poppler SplashOutputDev::tilingPatternFill leads to heap buffer overflow via unchecked dimension multiplication"
    },
    {
      "cve": "CVE-2026-34588",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-06T16:02:38.673068+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455408"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenEXR, an image storage format for the motion picture industry. A remote attacker could exploit an integer overflow vulnerability in the `internal_exr_undo_piz()` function by providing a specially crafted EXR file. This flaw leads to out-of-bounds reads and writes, which may allow for arbitrary code execution or sensitive information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34588"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455408",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455408"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34588",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34588"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34588"
        },
        {
          "category": "external",
          "summary": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf",
          "url": "https://github.com/AcademySoftwareFoundation/openexr/security/advisories/GHSA-588r-cr5c-w6hf"
        }
      ],
      "release_date": "2026-04-06T15:31:57.602000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenEXR: OpenEXR: Arbitrary code execution and information disclosure via crafted EXR file"
    },
    {
      "cve": "CVE-2026-34982",
      "cwe": {
        "id": "CWE-78",
        "name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
      },
      "discovery_date": "2026-04-06T16:02:10.004743+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2455400"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in Vim. A modeline is used to set specific editor options directly from a text file. However, the `complete`, `guitabtooltip`, `printheader` options and the `mapset` function lack proper security checks, allowing an attacker to bypass restrictions and cause arbitrary OS command execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "vim: arbitrary command execution via modeline sandbox bypass",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this vulnerability, an attacker needs to convince a user to open a specially crafted file. The arbitrary OS command execution is restricted to the privileges of the user running Vim, limiting the potential of a full system compromise.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "RHBZ#2455400",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2455400"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-34982",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-34982"
        },
        {
          "category": "external",
          "summary": "http://www.openwall.com/lists/oss-security/2026/04/01/1",
          "url": "http://www.openwall.com/lists/oss-security/2026/04/01/1"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615",
          "url": "https://github.com/vim/vim/commit/75661a66a1db1e1f3f1245c615"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/releases/tag/v9.2.0276",
          "url": "https://github.com/vim/vim/releases/tag/v9.2.0276"
        },
        {
          "category": "external",
          "summary": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9",
          "url": "https://github.com/vim/vim/security/advisories/GHSA-8h6p-m6gr-mpw9"
        }
      ],
      "release_date": "2026-04-06T15:16:48.809000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the modeline support by adding the following command to the Vim configuration file:\n\n~~~\nset nomodeline\n~~~",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "vim: arbitrary command execution via modeline sandbox bypass"
    },
    {
      "cve": "CVE-2026-35385",
      "cwe": {
        "id": "CWE-281",
        "name": "Improper Preservation of Permissions"
      },
      "discovery_date": "2026-04-02T17:01:07.052864+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2454469"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in OpenSSH. When the `scp` command is used by a root user to download a file with the legacy protocol option (`-O`) and without preserving original file permissions (`-p`), the downloaded file can be installed with elevated privileges (setuid or setgid). This unexpected behavior could allow a malicious file to execute with higher permissions than intended, posing a security risk through potential privilege escalation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "RHBZ#2454469",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2454469"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-35385",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-35385"
        },
        {
          "category": "external",
          "summary": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2",
          "url": "https://marc.info/?l=openssh-unix-dev\u0026m=177513443901484\u0026w=2"
        },
        {
          "category": "external",
          "summary": "https://www.openssh.org/releasenotes.html#10.3p1",
          "url": "https://www.openssh.org/releasenotes.html#10.3p1"
        },
        {
          "category": "external",
          "summary": "https://www.openwall.com/lists/oss-security/2026/04/02/3",
          "url": "https://www.openwall.com/lists/oss-security/2026/04/02/3"
        }
      ],
      "release_date": "2026-04-02T16:30:59.615000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "OpenSSH: OpenSSH: Privilege escalation via scp legacy protocol when not preserving file mode"
    },
    {
      "cve": "CVE-2026-37555",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "discovery_date": "2026-04-29T17:00:55.901773+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2463856"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in the libsndfile library. An integer overflow in the IMA ADPCM codec can occur when a specially crafted WAV audio file is processed, specifically with malicious samplesperblock and blocks values. This can lead to a heap-based buffer overflow, causing a crash to the application linked to the library and memory corruption.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "libsndfile: integer overflow in ima_reader_init()",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this issue, an attacker needs to be able to process a malicious WAV file with an application linked to the libsndfile library.\n\nDefault Red Hat Enterprise Linux security features, including SELinux enforcement, Address Space Layout Randomization (ASLR) and NX (No-Execute) stack protection, significantly increase the difficulty of achieving arbitrary code execution, limiting the impact of this vulnerability.\n\nDue to these reasons, this flaw has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-37555"
        },
        {
          "category": "external",
          "summary": "RHBZ#2463856",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2463856"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-37555",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-37555"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-37555",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-37555"
        },
        {
          "category": "external",
          "summary": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151",
          "url": "https://github.com/libsndfile/libsndfile/commit/9a829113c88a51e57c1e46473e90609e4b7df151"
        },
        {
          "category": "external",
          "summary": "https://github.com/libsndfile/libsndfile/issues/833",
          "url": "https://github.com/libsndfile/libsndfile/issues/833"
        }
      ],
      "release_date": "2026-04-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Do not process untrusted WAV files with the libsndfile library.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "libsndfile: integer overflow in ima_reader_init()"
    },
    {
      "cve": "CVE-2026-39979",
      "cwe": {
        "id": "CWE-125",
        "name": "Out-of-bounds Read"
      },
      "discovery_date": "2026-04-13T23:01:01.219840+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458077"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jq, a command line JSON processor, specifically in the libjq API. Parsing a malformed JSON input from a non-NUL-terminated buffer using the `jv_parse_sized` function can cause an out-of-bounds read, resulting in an application crash and a possible memory disclosure within the error message generated by the parser.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "To exploit this flaw, an attacker needs to supply malformed JSON from a non-NUL-terminated buffer to an application using the `jv_parse_sized` function. This allows the attacker to trigger the out-of-bounds read, causing an application crash and potentially disclosing memory with no other security impact. As this issue affects the libjq library, it is more likely to be exposed to untrusted input. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-39979"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458077",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458077"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-39979",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-39979"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39979"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f",
          "url": "https://github.com/jqlang/jq/commit/2f09060afab23fe9390cce7cb860b10416e1bf5f"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p",
          "url": "https://github.com/jqlang/jq/security/advisories/GHSA-2hhh-px8h-355p"
        }
      ],
      "release_date": "2026-04-13T22:18:56.252000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, manually ensure that every buffer is NUL-terminated before passing it to the \u0027jv_parse_sized\u0027 function.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jq: out-of-bounds read in jv_parse_sized() on error formatting for non-NUL-terminated buffers"
    },
    {
      "cve": "CVE-2026-40164",
      "cwe": {
        "id": "CWE-341",
        "name": "Predictable from Observable State"
      },
      "discovery_date": "2026-04-14T00:01:04.003115+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2458084"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in jq, a command-line JSON processor. A remote attacker could exploit this vulnerability by providing a specially crafted JSON object. This object leverages a weakness in jq\u0027s hashing algorithm, which uses a hardcoded, publicly known seed. By crafting the JSON object to cause hash collisions, an attacker can degrade the performance of JSON object hash table operations, leading to significant CPU exhaustion and a denial of service (DoS) for systems processing the malicious JSON data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jq: jq: Denial of Service via crafted JSON object causing hash collisions",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-40164"
        },
        {
          "category": "external",
          "summary": "RHBZ#2458084",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2458084"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-40164",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-40164"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-40164"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784",
          "url": "https://github.com/jqlang/jq/commit/0c7d133c3c7e37c00b6d46b658a02244fdd3c784"
        },
        {
          "category": "external",
          "summary": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29",
          "url": "https://github.com/jqlang/jq/security/advisories/GHSA-wwj8-gxm6-jc29"
        }
      ],
      "release_date": "2026-04-13T23:40:12.693000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jq: jq: Denial of Service via crafted JSON object causing hash collisions"
    },
    {
      "cve": "CVE-2026-44431",
      "cwe": {
        "id": "CWE-201",
        "name": "Insertion of Sensitive Information Into Sent Data"
      },
      "discovery_date": "2026-05-13T17:01:41.663622+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477167"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477167",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
        }
      ],
      "release_date": "2026-05-13T15:20:24.588000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
    },
    {
      "cve": "CVE-2026-44432",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-05-13T17:01:01.083841+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477154"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
          "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477154",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
        }
      ],
      "release_date": "2026-05-13T15:17:12.611000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-06-25T18:29:28+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:30078",
          "product_ids": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:30078"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:21867e83ef2af0458c1eff854005781fbb527370bca8a1e90b404b5119ad2478_amd64",
            "Red Hat AI Inference Server 3.3:registry.redhat.io/rhaiis/model-opt-cuda-rhel9@sha256:f94dff371b3c38a7d62490bcd72aa98829b762330b3603d6f19abb287b2f8969_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.