{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Red Hat AI Inference Server 3.2.2 (cuda-ubi9) is now available.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat\u00ae AI Inference Server",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:5809",
        "url": "https://access.redhat.com/errata/RHSA-2026:5809"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-68131",
        "url": "https://access.redhat.com/security/cve/CVE-2025-68131"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69227",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69227"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2025-69228",
        "url": "https://access.redhat.com/security/cve/CVE-2025-69228"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-25048",
        "url": "https://access.redhat.com/security/cve/CVE-2026-25048"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-28356",
        "url": "https://access.redhat.com/security/cve/CVE-2026-28356"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-32981",
        "url": "https://access.redhat.com/security/cve/CVE-2026-32981"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://www.redhat.com/en/products/ai/inference-server",
        "url": "https://www.redhat.com/en/products/ai/inference-server"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_5809.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat AI Inference Server 3.2.2 (cuda-ubi9)",
    "tracking": {
      "current_release_date": "2026-03-30T13:21:31+00:00",
      "generator": {
        "date": "2026-03-30T13:21:31+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.4"
        }
      },
      "id": "RHSA-2026:5809",
      "initial_release_date": "2026-03-25T13:08:34+00:00",
      "revision_history": [
        {
          "date": "2026-03-25T13:08:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-03-25T13:08:45+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-03-30T13:21:31+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat AI Inference Server 3.2",
                "product": {
                  "name": "Red Hat AI Inference Server 3.2",
                  "product_id": "Red Hat AI Inference Server 3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ai_inference_server:3.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat AI Inference Server"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
                  "product_id": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-cuda-rhel9@sha256%3Abd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba?arch=amd64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1774351144"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64",
                "product": {
                  "name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64",
                  "product_id": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/vllm-cuda-rhel9@sha256%3Aee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68?arch=arm64\u0026repository_url=registry.redhat.io/rhaiis\u0026tag=1774351144"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "arm64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64 as a component of Red Hat AI Inference Server 3.2",
          "product_id": "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64"
        },
        "product_reference": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64 as a component of Red Hat AI Inference Server 3.2",
          "product_id": "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
        },
        "product_reference": "registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64",
        "relates_to_product_reference": "Red Hat AI Inference Server 3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-68131",
      "cwe": {
        "id": "CWE-212",
        "name": "Improper Removal of Sensitive Information Before Storage or Transfer"
      },
      "discovery_date": "2025-12-31T02:00:55.240416+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2426395"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in cbor2. When a CBORDecoder instance is reused across multiple decode operations, values marked with the shareable tag (28) persist in memory. This allows an attacker-controlled message to read sensitive data from previously decoded messages if the decoder is reused across trust boundaries, leading to information disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. The flaw in cbor2 allows information disclosure if a CBORDecoder instance is reused across trust boundaries. This could lead to an attacker-controlled message reading sensitive data from previously decoded messages. This affects Red Hat AI Inference Server, Red Hat Enterprise Linux AI, and Red Hat OpenShift AI when processing untrusted CBOR data with a reused decoder.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-68131"
        },
        {
          "category": "external",
          "summary": "RHBZ#2426395",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2426395"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-68131",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-68131"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-68131",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-68131"
        },
        {
          "category": "external",
          "summary": "https://github.com/agronholm/cbor2/pull/268",
          "url": "https://github.com/agronholm/cbor2/pull/268"
        },
        {
          "category": "external",
          "summary": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh",
          "url": "https://github.com/agronholm/cbor2/security/advisories/GHSA-wcj4-jw5j-44wh"
        }
      ],
      "release_date": "2025-12-31T01:15:36.827000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-25T13:08:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:5809",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5809"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, applications utilizing the `cbor2` library should avoid reusing `CBORDecoder` instances when processing data from different trust levels. If `CBORDecoder` reuse is unavoidable, ensure that sensitive data is not processed by a decoder instance that will subsequently handle untrusted input. This operational control prevents an attacker from accessing prior decoded information.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "cbor2: cbor2: Information Disclosure via shared memory in CBORDecoder reuse"
    },
    {
      "cve": "CVE-2025-69227",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-01-06T00:01:17.036900+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2427256"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in aiohttp, an asynchronous HTTP client/server framework for Python. A remote attacker could exploit this vulnerability by sending a specially crafted POST request to an application using the Request.post() method, provided that Python optimizations are enabled. This could lead to an infinite loop, resulting in a Denial of Service (DoS) attack, making the affected application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "aiohttp: aiohttp: Denial of Service via specially crafted POST request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products as it can lead to a Denial of Service (DoS) in applications utilizing the `aiohttp` library. Exploitation requires Python optimizations to be explicitly enabled (e.g., via `-O` or `PYTHONOPTIMIZE=1`) and the application to process POST requests using the `Request.post()` method. Red Hat products are affected if they meet these specific configuration and usage criteria.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69227"
        },
        {
          "category": "external",
          "summary": "RHBZ#2427256",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427256"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69227",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69227"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69227",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69227"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259",
          "url": "https://github.com/aio-libs/aiohttp/commit/bc1319ec3cbff9438a758951a30907b072561259"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23",
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-jj3x-wxrx-4x23"
        }
      ],
      "release_date": "2026-01-05T23:19:31.396000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-25T13:08:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:5809",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5809"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "aiohttp: aiohttp: Denial of Service via specially crafted POST request"
    },
    {
      "cve": "CVE-2025-69228",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-01-06T00:01:02.119065+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2427254"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in aiohttp. A remote attacker can craft a malicious request that, when processed by an aiohttp server using the `Request.post()` method, causes the server\u0027s memory to fill uncontrollably. This can lead to a Denial of Service (DoS) by freezing the server, making it unavailable to legitimate users.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability is rated Moderate for Red Hat products. A flaw in aiohttp allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted POST request to an aiohttp server that utilizes the `Request.post()` method. This can lead to uncontrolled memory consumption, freezing the server and making the server unavailable.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-69228"
        },
        {
          "category": "external",
          "summary": "RHBZ#2427254",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427254"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-69228",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-69228"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-69228",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-69228"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60",
          "url": "https://github.com/aio-libs/aiohttp/commit/b7dbd35375aedbcd712cbae8ad513d56d11cce60"
        },
        {
          "category": "external",
          "summary": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf",
          "url": "https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6jhg-hg63-jvvf"
        }
      ],
      "release_date": "2026-01-05T23:30:33.440000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-25T13:08:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:5809",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5809"
        },
        {
          "category": "workaround",
          "details": "No mitigation is currently available that meets Red Hat Product Security\u2019s standards for usability, deployment, applicability, or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "aiohttp: aiohttp: Denial of Service via memory exhaustion from crafted POST request"
    },
    {
      "cve": "CVE-2026-25048",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2026-03-05T16:01:14.634884+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2444840"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in xgrammar, an open-source library for structured generation. This vulnerability allows an attacker to trigger a segmentation fault, causing the program to crash and resulting in a Denial of Service (DoS). The issue occurs due to improper handling of multi-level nested syntax.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "xgrammar: xgrammar: Denial of Service via multi-level nested syntax",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-25048"
        },
        {
          "category": "external",
          "summary": "RHBZ#2444840",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2444840"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-25048",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-25048"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-25048",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25048"
        },
        {
          "category": "external",
          "summary": "https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32",
          "url": "https://github.com/mlc-ai/xgrammar/releases/tag/v0.1.32"
        },
        {
          "category": "external",
          "summary": "https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3",
          "url": "https://github.com/mlc-ai/xgrammar/security/advisories/GHSA-7rgv-gqhr-fxg3"
        }
      ],
      "release_date": "2026-03-05T15:34:42.095000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-25T13:08:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:5809",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5809"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "xgrammar: xgrammar: Denial of Service via multi-level nested syntax"
    },
    {
      "cve": "CVE-2026-28356",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-03-12T18:01:57.290176+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2447059"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in multipart. The parse_options_header function in multipart.py uses a regular expression with an ambiguous alternation, causing an exponential backtracking (ReDoS) when parsing a specially crafted HTTP or multipart segment headers. A web application parsing request headers or multipart/form-data streams can block request handling threads for multiple seconds per request, eventually resulting in a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "multipart: denial of service via maliciously crafted HTTP or multipart segment headers",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue is only exploitable in applications using the multipart.parse_form_data function directly or indirectly when parsing request headers or multipart/form-data streams. Also, the security impact of this flaw is limited to a denial of service, there is no corruption of memory or arbitrary code execution. Due to these reasons, this vulnerability has been rated with an important severity.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-28356"
        },
        {
          "category": "external",
          "summary": "RHBZ#2447059",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2447059"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-28356",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-28356"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-28356",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28356"
        },
        {
          "category": "external",
          "summary": "https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3",
          "url": "https://github.com/defnull/multipart/security/advisories/GHSA-p2m9-wcp5-6qw3"
        }
      ],
      "release_date": "2026-03-12T16:45:01.070000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-25T13:08:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:5809",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5809"
        },
        {
          "category": "workaround",
          "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "multipart: denial of service via maliciously crafted HTTP or multipart segment headers"
    },
    {
      "cve": "CVE-2026-32981",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2026-03-17T20:01:37.453284+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2448440"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A path traversal flaw has been identified in Ray Dashboard in the Ray Pypi package. Due to improper validation and sanitization of user-supplied paths in the static file handling mechanism, an attacker can use traversal sequences (e.g., ../) to access files outside the intended static directory, resulting in local file disclosure.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "ray: Ray Dashboard Path Traversal Leading to Local File Disclosure",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
          "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-32981"
        },
        {
          "category": "external",
          "summary": "RHBZ#2448440",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448440"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-32981",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-32981"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-32981",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32981"
        },
        {
          "category": "external",
          "summary": "https://github.com/ray-project/ray",
          "url": "https://github.com/ray-project/ray"
        },
        {
          "category": "external",
          "summary": "https://packetstorm.news/files/id/215801/",
          "url": "https://packetstorm.news/files/id/215801/"
        },
        {
          "category": "external",
          "summary": "https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure",
          "url": "https://www.vulncheck.com/advisories/ray-dashboard-path-traversal-leading-to-local-file-disclosure"
        }
      ],
      "release_date": "2026-03-17T19:33:50.107000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-03-25T13:08:34+00:00",
          "details": "For more information visit https://access.redhat.com/errata/RHSA-2026:5809",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:5809"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:bd371b1b8785b2f5799cbca4a12a1c66a1e8a37017334a79eaa1067b24b6a6ba_amd64",
            "Red Hat AI Inference Server 3.2:registry.redhat.io/rhaiis/vllm-cuda-rhel9@sha256:ee2846fae19a57151e878992484359bb834d91cada6b53c58e5c2a0b5675aa68_arm64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "ray: Ray Dashboard Path Traversal Leading to Local File Disclosure"
    }
  ]
}