RHSA-2026:73909
Vulnerability from csaf_redhat - Published: 2026-09-30 10:27 - Updated: 2026-09-30 19:08Summary
Red Hat Security Advisory: Red Hat AI Base Images 3.0.3 (rocm)
Severity
Important
Notes
Topic: Red Hat AI Base Images 3.0.3 (rocm) is now available.
Details: Red Hat® AI Base Images
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64 | — |
Vendor Fix
fix
|
Threats
Impact
Moderate
A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.
CWE-121 - Stack-based Buffer OverflowAffected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Low
A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client's stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.
8.4 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in SQLite's FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A double free issue has been identified in libarchive's RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user's system.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user's system.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Linux-PAM's `pam_userdb` module. This vulnerability, categorized as an Observable Timing Discrepancy (CWE-208), allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during plaintext password comparison, an attacker can deduce the password. This flaw is exploitable when the `pam_userdb` module is configured to store and compare credentials in plaintext, which is not a default setting.
4.8 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.
4.7 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses > instead of >=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.
5.9 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.
7.5 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.
5.3 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A command injection vulnerability in Vim's C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.
6.5 (Medium)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Moderate
A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.
7.7 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract's deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.
7.1 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.
7.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A vulnerability in Vim's shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.
7.3 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
A flaw in Vim's netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.
8.8 (High)
Affected products
Fixed
1 product, the same list as for
CVE-2023-52355
Threats
Impact
Important
References
288 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat AI Base Images 3.0.3 (rocm) is now available.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat\u00ae AI Base Images",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:73909",
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2023-52355",
"url": "https://access.redhat.com/security/cve/CVE-2023-52355"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2025-6170",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11822",
"url": "https://access.redhat.com/security/cve/CVE-2026-11822"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11824",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-11940",
"url": "https://access.redhat.com/security/cve/CVE-2026-11940"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-12912",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-14164",
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15308",
"url": "https://access.redhat.com/security/cve/CVE-2026-15308"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-15588",
"url": "https://access.redhat.com/security/cve/CVE-2026-15588"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-16118",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-29111",
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-41989",
"url": "https://access.redhat.com/security/cve/CVE-2026-41989"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44431",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-44432",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47162",
"url": "https://access.redhat.com/security/cve/CVE-2026-47162"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-47167",
"url": "https://access.redhat.com/security/cve/CVE-2026-47167"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48864",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-52858",
"url": "https://access.redhat.com/security/cve/CVE-2026-52858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54369",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-54411",
"url": "https://access.redhat.com/security/cve/CVE-2026-54411"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-55693",
"url": "https://access.redhat.com/security/cve/CVE-2026-55693"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57455",
"url": "https://access.redhat.com/security/cve/CVE-2026-57455"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-57456",
"url": "https://access.redhat.com/security/cve/CVE-2026-57456"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58010",
"url": "https://access.redhat.com/security/cve/CVE-2026-58010"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58011",
"url": "https://access.redhat.com/security/cve/CVE-2026-58011"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58012",
"url": "https://access.redhat.com/security/cve/CVE-2026-58012"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58013",
"url": "https://access.redhat.com/security/cve/CVE-2026-58013"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58014",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58015",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-58016",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59856",
"url": "https://access.redhat.com/security/cve/CVE-2026-59856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59858",
"url": "https://access.redhat.com/security/cve/CVE-2026-59858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-60002",
"url": "https://access.redhat.com/security/cve/CVE-2026-60002"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6477",
"url": "https://access.redhat.com/security/cve/CVE-2026-6477"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73066",
"url": "https://access.redhat.com/security/cve/CVE-2026-73066"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73072",
"url": "https://access.redhat.com/security/cve/CVE-2026-73072"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73076",
"url": "https://access.redhat.com/security/cve/CVE-2026-73076"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73077",
"url": "https://access.redhat.com/security/cve/CVE-2026-73077"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-73078",
"url": "https://access.redhat.com/security/cve/CVE-2026-73078"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://www.redhat.com/en/products/ai",
"url": "https://www.redhat.com/en/products/ai"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_73909.json"
}
],
"title": "Red Hat Security Advisory: Red Hat AI Base Images 3.0.3 (rocm)",
"tracking": {
"current_release_date": "2026-09-30T19:08:27+00:00",
"generator": {
"date": "2026-09-30T19:08:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.4.0"
}
},
"id": "RHSA-2026:73909",
"initial_release_date": "2026-09-30T10:27:31+00:00",
"revision_history": [
{
"date": "2026-09-30T10:27:31+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-09-30T10:27:36+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-09-30T19:08:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift AI 3.0",
"product": {
"name": "Red Hat OpenShift AI 3.0",
"product_id": "Red Hat OpenShift AI 3.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_ai:3.0::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift AI"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64",
"product": {
"name": "registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64",
"product_id": "registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64",
"product_identification_helper": {
"purl": "pkg:oci/base-image-rocm-rhel9@sha256%3A235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe?arch=amd64\u0026repository_url=registry.redhat.io/rhai/base-image-rocm-rhel9\u0026tag=1790276886"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64 as a component of Red Hat OpenShift AI 3.0",
"product_id": "Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
},
"product_reference": "registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64",
"relates_to_product_reference": "Red Hat OpenShift AI 3.0"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-52355",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2023-11-24T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2251326"
}
],
"notes": [
{
"category": "description",
"text": "An out-of-memory flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFRasterScanlineSize64() API. This flaw allows a remote attacker to cause a denial of service via a crafted input with a size smaller than 379 KB.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The identified out-of-memory vulnerability in libtiff, triggered by a crafted TIFF file passed to the TIFFRasterScanlineSize64() API, presents a moderate severity concern rather than a important one due to several factors. Primarily, the exploit requires the crafted input to be smaller than 379 KB, imposing a limitation on the potential impact and reducing the likelihood of successful exploitation in practical scenarios. Furthermore, the nature of the vulnerability is limited to denial-of-service attacks, which, although disruptive, do not inherently pose a direct risk of data compromise or system compromise. However, it\u0027s important to acknowledge that denial-of-service attacks can still have significant operational implications, particularly in environments reliant on continuous availability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2023-52355"
},
{
"category": "external",
"summary": "RHBZ#2251326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2251326"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2023-52355",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-52355"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52355"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/issues/621",
"url": "https://gitlab.com/libtiff/libtiff/-/issues/621"
}
],
"release_date": "2023-11-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libtiff: TIFFRasterScanlineSize64 produce too-big size and could cause OOM"
},
{
"acknowledgments": [
{
"names": [
"Ahmed Lekssays"
]
}
],
"cve": "CVE-2025-6170",
"cwe": {
"id": "CWE-121",
"name": "Stack-based Buffer Overflow"
},
"discovery_date": "2025-06-16T05:33:22.955000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2372952"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the interactive shell of the xmllint command-line tool, used for parsing XML files. When a user inputs an overly long command, the program does not check the input size properly, which can cause it to crash. This issue might allow attackers to run harmful code in rare configurations without modern protections.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The Red Hat Product Security team has rated the severity of this vulnerability as Low, since it affects only the interactive shell mode of the xmllint tool and requires a user to manually run the tool and enter or receive specially crafted input. The exploitation requires local access and a highly specific usage scenario that is uncommon in typical environments. While it can cause a crash, the impact is limited to availability, and exploitation is unlikely in real-world deployments.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2025-6170"
},
{
"category": "external",
"summary": "RHBZ#2372952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2372952"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2025-6170",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-6170"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6170"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941",
"url": "https://gitlab.gnome.org/GNOME/libxml2/-/issues/941"
}
],
"release_date": "2025-06-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to a widespread installation base, or stability. It is strongly recommended to apply the upstream patch once available.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 2.5,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "libxml2: Stack Buffer Overflow in xmllint Interactive Shell Command Handling"
},
{
"cve": "CVE-2026-6477",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-05-14T14:01:31.087667+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477442"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as lo_export(), lo_read(), lo_lseek64(), and lo_tell64(). This allows the superuser to send an arbitrarily large response, overwriting the client\u0027s stack memory, specifically in tools like psql and pg_dump. This could lead to arbitrary code execution on the client system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This IMPORTANT buffer overflow in PostgreSQL libpq allows a malicious server superuser to overwrite client stack memory via lo_* functions. Exploitation requires the victim to connect to a compromised or malicious server (UI:R). The scope is changed as the server attack affects the client system. Impact is high to confidentiality, integrity, and availability through potential client-side code execution. Affects versions before 18.4, 17.10, 16.14, 15.18, and 14.23.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6477"
},
{
"category": "external",
"summary": "RHBZ#2477442",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477442"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6477",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6477"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477"
},
{
"category": "external",
"summary": "https://www.postgresql.org/support/security/CVE-2026-6477/",
"url": "https://www.postgresql.org/support/security/CVE-2026-6477/"
}
],
"release_date": "2026-05-14T13:00:12.497000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Only connect to trusted PostgreSQL servers. Avoid using psql or pg_dump against untrusted or potentially compromised database servers.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.4,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory"
},
{
"cve": "CVE-2026-11822",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-09T20:01:15.006955+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487258"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite\u0027s FTS5 full-text search extension. This vulnerability involves memory corruption, specifically an out-of-bounds read and a heap buffer overflow, which can be triggered by supplying a crafted database with malformed FTS5 page data. When an FTS5 MATCH query is executed against such a database, an attacker can cause process crashes, memory exhaustion, or achieve arbitrary code execution, potentially compromising the system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This flaw in the SQLite FTS5 full-text search extension can lead to arbitrary code execution or denial of service. Exploitation requires an application to process a specially crafted SQLite database containing malformed FTS5 page data, which could occur if an attacker provides a malicious database to a vulnerable application. This risk is elevated in scenarios where applications handle untrusted SQLite database files.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11822"
},
{
"category": "external",
"summary": "RHBZ#2487258",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487258"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11822",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11822"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11822"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension",
"url": "https://www.vulncheck.com/advisories/sqlite-before-memory-corruption-in-fts5-extension"
}
],
"release_date": "2026-06-09T19:08:31.019000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data"
},
{
"cve": "CVE-2026-11824",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-09T20:02:19.874232+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487269"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in SQLite, specifically within its FTS5 full-text search extension. Attackers can exploit a heap-based buffer overflow by providing a specially crafted database. This crafted database contains malicious metadata that triggers an integer underflow during FTS5 MATCH query processing. Successful exploitation of this vulnerability can lead to a crash of the application or allow for arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in SQLite\u0027s FTS5 full-text search extension can lead to arbitrary code execution or application crashes due to a heap-based buffer overflow. Exploitation requires an attacker to provide a specially crafted SQLite database, which must then be processed by an application compiled with FTS5 support. While requiring user interaction and local access, the potential for full impact on system resources justifies the Important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11824"
},
{
"category": "external",
"summary": "RHBZ#2487269",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487269"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11824",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11824"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11824"
},
{
"category": "external",
"summary": "https://sqlite.org/releaselog/3_53_2.html",
"url": "https://sqlite.org/releaselog/3_53_2.html"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/061febcf41ca",
"url": "https://sqlite.org/src/info/061febcf41ca"
},
{
"category": "external",
"summary": "https://sqlite.org/src/info/4a5ad516ea93",
"url": "https://sqlite.org/src/info/4a5ad516ea93"
},
{
"category": "external",
"summary": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate",
"url": "https://www.vulncheck.com/advisories/sqlite-before-heap-buffer-overflow-via-fts5-fts5chunkiterate"
}
],
"release_date": "2026-06-09T19:21:42.603000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5"
},
{
"cve": "CVE-2026-11940",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-23T17:05:33.822236+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2491848"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `tarfile.extractall()` function within Python. A remote attacker could exploit this vulnerability by providing a specially crafted archive. This archive could bypass security filters by using a hardlink that references a symlink, allowing the symlink to be recreated outside the intended destination directory. This could lead to out-of-destination file reads or writes, potentially resulting in information disclosure or arbitrary file modification.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat products that appear in dependency searches under names containing \"tarfile\" but that are not the CPython standard-library tarfile module are not affected by this flaw. Matches such as the Go packages under github.com/containers/image / go.podman.io/image (.../docker/tarfile and .../docker/internal/tarfile) and the Apache Camel artifacts (camel-tarfile, camel-quarkus-tarfile) are unrelated implementations in other languages and do not include the vulnerable CPython tarfile.extractall() filter logic. The separately packaged PyPI component backports-tarfile is also out of scope for this CVE as assigned: it is not the CPython stdlib module named in the advisory and this CVE tracks the interpreter-provided tarfile shipped in Red Hat python3* packages.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-11940"
},
{
"category": "external",
"summary": "RHBZ#2491848",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2491848"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-11940",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-11940"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11940"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/151558",
"url": "https://github.com/python/cpython/issues/151558"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/151559",
"url": "https://github.com/python/cpython/pull/151559"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/LD6QIISNQFQYOIEPJNEUIPV7S3V76FZH/"
}
],
"release_date": "2026-06-23T16:04:17.321000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: cpython: CPython: tarfile extraction filter bypass allows escaping the destination directory"
},
{
"acknowledgments": [
{
"names": [
"Ariel Sch\u00f6n"
]
}
],
"cve": "CVE-2026-12912",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-06-25T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492871"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libtiff. A remote attacker could exploit this vulnerability by providing a specially crafted PixarLog-compressed TIFF image. This issue occurs when decoding Pixarlog codec images with the PIXARLOGDATAFMT_8BITABGR output format and a specific stride value, leading to a heap-based buffer overflow. This could potentially result in arbitrary code execution or a denial of service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important heap-based buffer overflow in libtiff affecting applications that explicitly configure the library to decode Pixarlog-compressed TIFF images using the PIXARLOGDATAFMT_8BITABGR output format with SamplesPerPixel == 3. Standard image reading functions, such as TIFFReadRGBAImage, are not directly impacted as they do not typically select this specific format. Exploitation requires processing a specially crafted TIFF image under these specific conditions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-12912"
},
{
"category": "external",
"summary": "RHBZ#2492871",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492871"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-12912",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-12912"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12912"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873",
"url": "https://gitlab.com/libtiff/libtiff/-/merge_requests/873"
},
{
"category": "external",
"summary": "https://gitlab.com/libtiff/libtiff/-/work_items/824",
"url": "https://gitlab.com/libtiff/libtiff/-/work_items/824"
}
],
"release_date": "2026-04-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this issue, applications processing untrusted TIFF images should avoid explicitly configuring `PIXARLOGDATAFMT_8BITABGR` when decoding PixarLog-compressed TIFF images with three samples per pixel. This specific combination of output format and samples per pixel is required to trigger the heap-based buffer overflow.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "libtiff: libtiff: Heap-based buffer overflow via crafted PixarLog-compressed TIFF image"
},
{
"cve": "CVE-2026-14164",
"cwe": {
"id": "CWE-415",
"name": "Double Free"
},
"discovery_date": "2026-06-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2493411"
}
],
"notes": [
{
"category": "description",
"text": "A double free issue has been identified in libarchive\u0027s RAR5 reader. During parsing of a specially crafted RAR5 archive, the filtered_buf pointer may remain stale after being freed during unpacking state reinitialization. Subsequent processing of another archive entry can trigger a second free of the same memory region, resulting in a double-free condition. Successful exploitation may cause applications using the vulnerable libarchive API to terminate unexpectedly, leading to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has assessed this CVE as 7.5 CVSS with Moderate security Impact. This assessment reflects the library\u0027s typical deployment within enterprise software, where libarchive is frequently embedded into automated, network-accessible services that receive and process archives originating from remote sources. In these environments, a specially crafted RAR5 archive may be delivered and processed automatically without requiring direct user interaction, allowing a remote attacker to trigger the vulnerability and cause the affected application or service processing the archive to terminate unexpectedly, resulting in a denial of service.\n\nFrom a standalone library perspective, however, the vulnerable code is only reached when an application opens and processes a crafted RAR5 archive. Evaluating libarchive in isolation, without considering downstream deployment models, the vulnerability more closely aligns with a CVSS score of 5.5-CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H (Moderate), reflecting an Attack Vector of Local (AV:L) and User Interaction Required (UI:R). This is because the crafted archive must first be delivered to and processed by a local application before the vulnerable parsing logic is executed. \n\nRed Hat\u0027s assigned score instead reflects the operational deployment of libarchive in automated, network-facing workloads in downstream environment models rather than the standalone library in isolation.\n\n```\n\nThis vulnerability only affects libarchive releases that include support for the RAR5 archive format. RAR5 support was first introduced upstream in libarchive 3.4.0 (https://github.com/libarchive/libarchive/wiki/ReleaseNotes#libarchive-340). Earlier libarchive releases do not contain the vulnerable RAR5 parsing code and are therefore not affected.\n\nRed Hat Enterprise Linux 6, 7, and 8 ship Libarchive versions prior to v3.4.0 that do not include RAR5 support and are therefore not affected.\n\n```",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-14164"
},
{
"category": "external",
"summary": "RHBZ#2493411",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2493411"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-14164",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-14164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-14164"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/issues/3069",
"url": "https://github.com/libarchive/libarchive/issues/3069"
},
{
"category": "external",
"summary": "https://github.com/libarchive/libarchive/pull/3071",
"url": "https://github.com/libarchive/libarchive/pull/3071"
}
],
"release_date": "2026-05-24T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "No mitigation is currently available that meets Red Hat Product Security\u0027s standards for usability, deployment, applicability, or stability. Customers are advised to apply the appropriate security update once it becomes available.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libarchive: Double-Free Vulnerability in RAR5 Decompression Logic via dangling filtered_buf pointer in init_unpack()"
},
{
"cve": "CVE-2026-15308",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-09T18:02:10.090070+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498608"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Python. Its incremental HTML parser can be exploited by a remote attacker. By sending specially crafted, uncontrolled data with repeated, incomplete markup declarations, the attacker can cause the system to consume excessive central processing unit (CPU) resources. This leads to a denial of service, making the affected system unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Python\u0027s `html.parser.HTMLParser` can lead to a denial of service. By supplying specially crafted, malformed HTML with repeated unterminated markup declarations, an attacker can cause excessive CPU consumption, rendering the system unresponsive. Red Hat products utilizing this parser to process untrusted HTML content are susceptible to resource exhaustion.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15308"
},
{
"category": "external",
"summary": "RHBZ#2498608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498608"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15308",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15308"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15308"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9",
"url": "https://github.com/python/cpython/commit/07efb08123ba9367a7107325adb9d5626dca1ca9"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced",
"url": "https://github.com/python/cpython/commit/7933f4bf7131aa4140750f9404f5de0aa2969ced"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606",
"url": "https://github.com/python/cpython/commit/bcf98ddbc40ec9b3ee87da0124a5660b19b7e606"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd",
"url": "https://github.com/python/cpython/commit/e9f92ac0b298292e7ff998e52cb8ccacfb27a0bd"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/issues/153030",
"url": "https://github.com/python/cpython/issues/153030"
},
{
"category": "external",
"summary": "https://github.com/python/cpython/pull/153031",
"url": "https://github.com/python/cpython/pull/153031"
},
{
"category": "external",
"summary": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/",
"url": "https://mail.python.org/archives/list/security-announce@python.org/thread/F6453LWKSHKCTWFLCOURWPLETNUIW2Z5/"
}
],
"release_date": "2026-07-09T17:10:57.317000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "python: Python: CPU Denial of Service in HTML parser via repeated unterminated markup declarations"
},
{
"acknowledgments": [
{
"names": [
"Gitee Codepecker Lab"
]
}
],
"cve": "CVE-2026-15588",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-07-13T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499675"
}
],
"notes": [
{
"category": "description",
"text": "A denial-of-service and resource exhaustion vulnerability exists within the `GDBus` component of GLib. The `gdbusauth` authentication mechanism fails to enforce proper length limitations on data lines read from a client. An unauthenticated local or remote attacker can exploit this lack of input validation by sending excessively long streams of data, causing the application to consume massive amounts of system memory and CPU, potentially leading to a crash or system hang.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in the `GDBus` component of GLib. A local or remote unauthenticated attacker could send an engineered stream of data without line length limitations during the authentication process (`gdbusauth`), leading to excessive memory allocation and CPU consumption. This resource exhaustion can result in a denial-of-service (DoS) condition, causing applications or services dependent on GLib to become unstable or crash.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-15588"
},
{
"category": "external",
"summary": "RHBZ#2499675",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499675"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-15588",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-15588"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-15588"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3985"
}
],
"release_date": "2026-07-12T10:10:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "GDBusServer: glib2: GDBusServer pre-authentication DoS via unbounded SASL line buffering"
},
{
"acknowledgments": [
{
"names": [
"asotyc"
]
}
],
"cve": "CVE-2026-16118",
"cwe": {
"id": "CWE-122",
"name": "Heap-based Buffer Overflow"
},
"discovery_date": "2026-07-17T13:20:23.862000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2501732"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in xdgmime. A heap-based buffer overflow can be triggered in _xdg_mime_magic_parse_magic_line() in the xdgmimemagic.c file on little-endian systems when an attacker-controlled MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) is parsed by an application performing MIME type detection (e.g., via g_content_type_guess()). When performing byte-swap, incorrect pointer arithmetic on the write side causes an out-of-bounds write of 2 bytes, resulting in an application crash or memory corruption.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this issue, an attacker must convince a user to install a malicious MIME magic file in a user-writable XDG data location (e.g., in the $XDG_DATA_HOME/mime/magic path) and process it with an application performing MIME type detection, limiting its exposure. Also, only little-endian systems are vulnerable. Due to these reasons, this issue has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-16118"
},
{
"category": "external",
"summary": "RHBZ#2501732",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2501732"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-16118",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-16118"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-16118"
},
{
"category": "external",
"summary": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41",
"url": "https://gitlab.freedesktop.org/xdg/xdgmime/-/work_items/41"
}
],
"release_date": "2026-07-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Do not install a MIME magic file or content from untrusted sources.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "xdgmime: heap-based buffer overflow in _xdg_mime_magic_parse_magic_line() in xdgmimemagic.c"
},
{
"cve": "CVE-2026-29111",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"discovery_date": "2026-03-23T22:01:54.593547+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2450505"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in systemd, a system and service manager. An unprivileged user can exploit this vulnerability by making an Inter-Process Communication (IPC) API call with spurious data. In older versions (v249 and earlier), this can lead to stack overwriting with attacker-controlled content, potentially enabling arbitrary code execution or privilege escalation. In newer versions (v250 and later), the flaw causes systemd to assert and freeze, resulting in a Denial of Service (DoS).",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-29111"
},
{
"category": "external",
"summary": "RHBZ#2450505",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2450505"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-29111",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-29111"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29111"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a",
"url": "https://github.com/systemd/systemd/commit/1d22f706bd04f45f8422e17fbde3f56ece17758a"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6",
"url": "https://github.com/systemd/systemd/commit/20021e7686426052e3a7505425d7e12085feb2a6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412",
"url": "https://github.com/systemd/systemd/commit/21167006574d6b83813c7596759b474f56562412"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd",
"url": "https://github.com/systemd/systemd/commit/3cee294fe8cf4fa0eff933ab21416d099942cabd"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f",
"url": "https://github.com/systemd/systemd/commit/42aee39107fbdd7db1ccd402a2151822b2805e9f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f",
"url": "https://github.com/systemd/systemd/commit/54588d2dedff54bfb6036670820650e4ea74628f"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69",
"url": "https://github.com/systemd/systemd/commit/7ac3220213690e8a8d6d2a6e81e43bd1dce01d69"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6",
"url": "https://github.com/systemd/systemd/commit/80acea4ef80a4bb78560ed970c34952299b890d6"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c",
"url": "https://github.com/systemd/systemd/commit/b5fd14693057e5f2c9b4a49603be64ec3608ff6c"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8",
"url": "https://github.com/systemd/systemd/commit/efa6ba2ab625aaa160ac435a09e6482fc63bdbe8"
},
{
"category": "external",
"summary": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764",
"url": "https://github.com/systemd/systemd/security/advisories/GHSA-gx6q-6f99-m764"
}
],
"release_date": "2026-03-23T21:03:56.120000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "systemd: systemd: Arbitrary code execution or Denial of Service via spurious IPC API call data"
},
{
"cve": "CVE-2026-41989",
"cwe": {
"id": "CWE-131",
"name": "Incorrect Calculation of Buffer Size"
},
"discovery_date": "2026-04-23T05:00:56.113348+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2461063"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Libgcrypt. A remote attacker could exploit this vulnerability by sending crafted Elliptic Curve Diffie-Hellman (ECDH) ciphertext to the `gcry_pk_decrypt` function. This can lead to a heap-based buffer overflow, potentially causing a denial of service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-41989"
},
{
"category": "external",
"summary": "RHBZ#2461063",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461063"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-41989",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-41989"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41989"
},
{
"category": "external",
"summary": "https://dev.gnupg.org/T8211",
"url": "https://dev.gnupg.org/T8211"
},
{
"category": "external",
"summary": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html",
"url": "https://lists.gnupg.org/pipermail/gnupg-announce/2026q2/000503.html"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/04/21/1",
"url": "https://www.openwall.com/lists/oss-security/2026/04/21/1"
}
],
"release_date": "2026-04-23T04:30:26.124000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Libgcrypt: Libgcrypt: Denial of Service and buffer overflow via crafted ECDH ciphertext"
},
{
"cve": "CVE-2026-44431",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"discovery_date": "2026-05-13T17:01:41.663622+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477167"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. When using the low-level API via `ProxyManager.connection_from_url().urlopen()` with `assert_same_host=False`, cross-origin redirects can still forward sensitive headers. This could allow a remote attacker to gain unauthorized access to sensitive information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44431"
},
{
"category": "external",
"summary": "RHBZ#2477167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477167"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44431",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44431"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44431"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-qccp-gfcp-xxvc"
}
],
"release_date": "2026-05-13T15:20:24.588000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "urllib3: urllib3: Information disclosure via cross-origin redirects forwarding sensitive headers"
},
{
"cve": "CVE-2026-44432",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"discovery_date": "2026-05-13T17:01:01.083841+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477154"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-44432"
},
{
"category": "external",
"summary": "RHBZ#2477154",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477154"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-44432",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-44432"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44432"
},
{
"category": "external",
"summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j",
"url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j"
}
],
"release_date": "2026-05-13T15:17:12.611000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "urllib3: urllib3: Denial of Service due to excessive HTTP response decompression"
},
{
"cve": "CVE-2026-47162",
"cwe": {
"id": "CWE-140",
"name": "Improper Neutralization of Delimiters"
},
"discovery_date": "2026-06-11T19:00:56.050612+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487964"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source text editor. This vulnerability, located in the netrw plugin, involves a code injection issue when the editor processes directory paths. A malicious directory name, if crafted by an attacker, could bypass security measures and allow for the execution of unauthorized commands. This could lead to arbitrary code execution on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary Code Execution via crafted directory names",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47162"
},
{
"category": "external",
"summary": "RHBZ#2487964",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487964"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47162",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47162"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47162"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b",
"url": "https://github.com/vim/vim/commit/f08ab2f4d7d2947c8dd6c179ae08ee6146a2694b"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0495",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0495"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c",
"url": "https://github.com/vim/vim/security/advisories/GHSA-crm5-rh6j-2c7c"
}
],
"release_date": "2026-06-11T18:32:14.471000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary Code Execution via crafted directory names"
},
{
"cve": "CVE-2026-47167",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-06-11T19:02:45.999423+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487996"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, a command-line text editor. This vulnerability, identified as a code injection, affects the cucumber filetype plugin when Vim is configured with Ruby support. An attacker could exploit this by creating a malicious repository containing specially crafted step-definition patterns. If a user opens this repository and triggers a specific function, the crafted patterns are unsafely processed, potentially allowing the attacker to execute unauthorized commands on the user\u0027s system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via crafted step-definition patterns",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Vim\u0027s cucumber filetype plugin, when configured with Ruby support, allows for arbitrary code execution. An attacker could exploit this by convincing a user to open a specially crafted repository and trigger a specific step-jump mapping, leading to local command execution. This risk is contingent on user interaction with untrusted content and the presence of the Ruby-enabled cucumber plugin.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-47167"
},
{
"category": "external",
"summary": "RHBZ#2487996",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487996"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-47167",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-47167"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47167"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934",
"url": "https://github.com/vim/vim/commit/a65a52d684bc58535ad28a4ae824d22e76399934"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0496",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0496"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9",
"url": "https://github.com/vim/vim/security/advisories/GHSA-4473-94jm-w5x9"
}
],
"release_date": "2026-06-11T18:31:44.286000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this issue, users should exercise caution when opening untrusted files or repositories with Vim, particularly those that might trigger the `cucumber` filetype plugin. Avoiding interaction with untrusted content can prevent the execution of malicious step-definition patterns.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary code execution via crafted step-definition patterns"
},
{
"acknowledgments": [
{
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2026-48864",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-04-21T23:19:41+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2460425"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in libsolv. This heap buffer overflow occurs during the decompression of attacker-controlled compressed data within `.solv` files due to insufficient input validation. An attacker can provide a specially crafted `.solv` file, which, when processed by a vulnerable application, can lead to out-of-bounds memory access. This could result in information disclosure, alteration of program execution, or a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This heap buffer overflow in libsolv\u0027s page decompression logic can lead to out-of-bounds reads and writes when processing specially crafted `.solv` files. Exploitation requires a victim application to ingest malicious repository metadata, limiting the attack vector to scenarios involving user interaction or untrusted content sources. Given the user interaction needed, Red Hat Product Security has rated this vulnerability as having a impact of Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48864"
},
{
"category": "external",
"summary": "RHBZ#2460425",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460425"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48864",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48864"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48864"
}
],
"release_date": "2026-05-26T16:07:55.363000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "libsolv: Heap buffer overflow in libsolv repopagestore via unchecked decompression of malicious .solv page data"
},
{
"cve": "CVE-2026-52858",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-06-11T19:01:57.042099+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2487981"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, a widely used command-line text editor. This vulnerability allows a local attacker to execute arbitrary code on the system. By opening a specially crafted Python file and then triggering the omni-completion feature, the attacker can cause Vim to run malicious code from a sibling Python package. This could lead to a complete compromise of the user\u0027s system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via Python omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Vim that allows a local attacker to achieve arbitrary code execution. The flaw occurs when a user opens a specially crafted Python file and invokes omni-completion, leading to the execution of malicious code from a co-located Python package. This risk is present in Red Hat Enterprise Linux and other products where Vim is deployed with Python omni-completion enabled, potentially compromising the editing user\u0027s system.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-52858"
},
{
"category": "external",
"summary": "RHBZ#2487981",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2487981"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-52858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-52858"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-52858"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d",
"url": "https://github.com/vim/vim/commit/4b850457e12e1a678dd209f2868154f7553cbf8d"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0561",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0561"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c",
"url": "https://github.com/vim/vim/security/advisories/GHSA-52mc-rq6p-rc7c"
}
],
"release_date": "2026-06-11T18:32:32.722000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Users can mitigate this vulnerability by disabling Python omni-completion in Vim if it is not essential for their workflow. This prevents the execution of untrusted Python code when opening hostile files. To disable this feature, ensure that the `omnifunc` option in your Vim configuration (e.g., `~/.vimrc`) is not set to `pythoncomplete#Complete` or `python3complete#Complete`. Alternatively, users should avoid invoking omni-completion (`Ctrl-X Ctrl-O`) on Python files from untrusted sources. Disabling Python omni-completion may affect Python development functionality within Vim.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary code execution via Python omni-completion"
},
{
"acknowledgments": [
{
"names": [
"Andrew Tridgell \u003ctridge60@gmail.com\u003e",
"Alexander Peslyak \u003csolar@openwall.com\u003e"
]
}
],
"cve": "CVE-2026-54369",
"cwe": {
"id": "CWE-59",
"name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
},
"discovery_date": "2026-06-16T23:47:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2490277"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the `acl` package, specifically within its `libacl` pathname-based functions. A local attacker could exploit this vulnerability by using a symbolic link to replace a pathname component. This could allow the attacker to redirect access control list (ACL) read or write operations to arbitrary files or directories, leading to unauthorized manipulation of ACLs and ultimately local privilege escalation.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "acl: Symlink traversal privilege escalation via libacl functions",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat rates this flaw as Important because a local attacker who controls any component of a pathname processed by a privileged process using libacl can redirect ACL operations to arbitrary files. Exploitation requires local access with the ability to create symlinks in a directory that a privileged program later processes with acl_get_file() or acl_set_file(). In default RHEL and OpenShift CoreOS configurations, standard file permission settings limit where unprivileged users can create symlinks, reducing the practical attack surface. Programs that operate on user-supplied paths with elevated privileges are most at risk.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54369"
},
{
"category": "external",
"summary": "RHBZ#2490277",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2490277"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54369",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54369"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54369"
}
],
"release_date": "2026-06-29T13:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Restrict unprivileged users from creating symlinks in directories that privileged processes operate on with ACL commands. Where possible, use the fs.protected_symlinks sysctl (enabled by default on RHEL 7+), which prevents symlink following in world-writable sticky directories unless the owner of the symlink matches the owner of the target file or directory.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "acl: Symlink traversal privilege escalation via libacl functions"
},
{
"cve": "CVE-2026-54411",
"cwe": {
"id": "CWE-208",
"name": "Observable Timing Discrepancy"
},
"discovery_date": "2026-06-14T18:00:55.002567+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2488766"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Linux-PAM\u0027s `pam_userdb` module. This vulnerability, categorized as an Observable Timing Discrepancy (CWE-208), allows a local or network-adjacent attacker to recover plaintext passwords. By repeatedly attempting authentication and measuring response-timing differences during plaintext password comparison, an attacker can deduce the password. This flaw is exploitable when the `pam_userdb` module is configured to store and compare credentials in plaintext, which is not a default setting.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Linux-PAM\u0027s `pam_userdb` module allows a local or network-adjacent attacker to recover plaintext passwords through a timing discrepancy. This vulnerability requires the `pam_userdb` module to be explicitly configured to store and compare credentials in plaintext, which is not a default or recommended configuration in Red Hat Enterprise Linux environments. The impact is limited by the need for repeated authentication attempts and specific, non-default module configurations.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-54411"
},
{
"category": "external",
"summary": "RHBZ#2488766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2488766"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-54411",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-54411"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-54411",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54411"
},
{
"category": "external",
"summary": "https://cwe.mitre.org/data/definitions/208.html",
"url": "https://cwe.mitre.org/data/definitions/208.html"
},
{
"category": "external",
"summary": "https://github.com/linux-pam/linux-pam",
"url": "https://github.com/linux-pam/linux-pam"
},
{
"category": "external",
"summary": "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h",
"url": "https://github.com/linux-pam/linux-pam/blob/master/libpam/include/pam_inline.h"
},
{
"category": "external",
"summary": "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327",
"url": "https://github.com/linux-pam/linux-pam/blob/master/modules/pam_userdb/pam_userdb.c#L327"
}
],
"release_date": "2026-06-14T17:21:43.853000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this issue, administrators should ensure that the `pam_userdb` module is not configured to store or compare credentials in plaintext. Verify that `pam_userdb` is either configured with a strong cryptographic hashing method or, if not required, is disabled. Avoid using `crypt=none` or omitting the `crypt=` argument when configuring `pam_userdb`. If changes are made to PAM configuration files, services relying on PAM may need to be restarted for the changes to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "linux-pam: Plaintext password recovery via timing discrepancy in pam_userdb module"
},
{
"cve": "CVE-2026-55693",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"discovery_date": "2026-06-25T16:02:21.870241+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492980"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. A remote attacker could exploit this vulnerability by tricking a user into loading a specially crafted spell file. When the user invokes spell suggestion, the editor attempts to process the malicious file, leading to an out-of-bounds write that corrupts memory and causes the application to crash, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Out-of-bounds Write in Spell File Word Count",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact vulnerability in Vim\u0027s spell suggestion feature allows an attacker to cause a denial of service. By tricking a user into loading a specially crafted spell file and invoking spell suggestion, an out-of-bounds write can occur, leading to a crash of the editor. This requires user interaction and a malicious file, limiting its immediate exploitability.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-55693"
},
{
"category": "external",
"summary": "RHBZ#2492980",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492980"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-55693",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-55693"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55693"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7",
"url": "https://github.com/vim/vim/commit/a80874d9b84a01040e3d1aef2d4a59e1934dafb7"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0653",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0653"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq",
"url": "https://github.com/vim/vim/security/advisories/GHSA-wgh4-64f7-q3jq"
}
],
"release_date": "2026-06-25T15:34:33.424000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Out-of-bounds Write in Spell File Word Count"
},
{
"cve": "CVE-2026-57455",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-06-25T16:01:18.343208+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492968"
}
],
"notes": [
{
"category": "description",
"text": "A memory corruption flaw in Vim allows an attacker to cause a Denial of Service (DoS). When a SOFO-based spell language is active, providing an excessively long word to the spell checker triggers a stack out-of-bounds write in the spell_soundfold_sofo() function, causing the editor to crash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate impact flaw in Vim, a command-line text editor, is due to a stack out-of-bounds write in the spell checker. Exploitation requires a user to open a specially crafted file or encounter a long word via spell suggestion while a SOFO-based spell language is active, leading to a Denial of Service. This is not a default configuration in most Red Hat environments, limiting the attack surface.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57455"
},
{
"category": "external",
"summary": "RHBZ#2492968",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492968"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57455",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57455"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57455"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b",
"url": "https://github.com/vim/vim/commit/497f931f85339d175d7f69588dd249e8ccfed41b"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0698",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0698"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4",
"url": "https://github.com/vim/vim/security/advisories/GHSA-q8mh-6qm3-25g4"
}
],
"release_date": "2026-06-25T15:22:37.949000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this issue disable spell checking or avoid using SOFO-based spell files. This can be achieved globally by adding set nospell to your ~/.vimrc configuration file. Ensure your systems utilize standard UTF-8 encoding. This flaw is strictly confined to legacy 8-bit encodings and cannot be triggered under default Red Hat configurations.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo()"
},
{
"cve": "CVE-2026-57456",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-06-25T16:01:37.648886+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492972"
}
],
"notes": [
{
"category": "description",
"text": "There is a security flaw in Vim. If you use Vim to open a malicious file written by a hacker, and you use the auto-complete feature while typing, the file can secretly force your computer to run unauthorized commands or malware.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This flaw is rated as Important. A vulnerability in Vim\u0027s Python omni-completion feature allows for arbitrary code execution. By opening a specially crafted file, a local attacker could execute arbitrary Python code due to improper handling of docstrings during omni-completion, leading to a compromise of the system where Vim is running.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-57456"
},
{
"category": "external",
"summary": "RHBZ#2492972",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492972"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-57456",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-57456"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57456"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8",
"url": "https://github.com/vim/vim/commit/cce141c42740f122dd8486ae04e21c2a81016ba8"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0699",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0699"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3",
"url": "https://github.com/vim/vim/security/advisories/GHSA-ppj8-wqjf-6fp3"
}
],
"release_date": "2026-06-25T15:16:16.015000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, users should avoid opening untrusted Python files or using Python omni-completion on such files. If Python omni-completion is not required, it can be disabled by adding `autocmd FileType python setlocal omnifunc=` to your `.vimrc` file. This will prevent the vulnerable code from being executed. Disabling Python omni-completion will remove the ability to use `Ctrl-X Ctrl-O` for Python code completion. A restart of Vim is required for the changes to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58010",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:21:49.589000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492243"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the gvs_tuple_is_normal function in the glib/gvariant-serialiser.c file when doing an alignment padding check because the bounds check uses \u003e instead of \u003e=, causing an out-of-bounds read of only 1 byte. This issue can cause a minor information disclosure of 1 byte and a denial of service when the out-of-bounds read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications calling the `g_variant_is_normal_form()`,\u00a0`g_variant_get_normal_form()` or\u00a0`g_variant_byteswap()` functions that process untrusted GVariant data received from D-Bus, network or file are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 1 byte, leading to an information disclosure of only 1 byte and a denial of service when the out-of-bounds read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58010"
},
{
"category": "external",
"summary": "RHBZ#2492243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492243"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58010",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58010"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58010"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3915"
}
],
"release_date": "2026-03-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in glib/gvariant-serialiser.c via gvs_tuple_is_normal()"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58011",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"discovery_date": "2026-06-24T16:30:03.305000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492245"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An out-of-bounds read of only 2 bytes can occur in the g_date_time_get_ymd function in the glib/gdatetime.c file when an invalid GDateTime object produced by the g_date_time_add_full function is processed. This flaw can corrupt the date output and potentially cause logic errors that may lead to a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications that allow a user to submit a date to `g_date_time_add_full()` and later call any getter functions, such as `g_date_time_get_month()` or `g_date_time_get_year()`, with the returned GDateTime object are vulnerable to this issue. This flaw can cause an out-of-bounds read of only 2 bytes, leading to a denial of service due to logic errors that a corrupted date can trigger. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58011"
},
{
"category": "external",
"summary": "RHBZ#2492245",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492245"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58011",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58011"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58011"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3917"
}
],
"release_date": "2026-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, in applications processing user-supplied dates, implement input validation to ensure the supplied date is within the supported range before calling g_date_time_add_full() with untrusted data, specifically rejecting inputs that result in a negative or zero days field.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: out-of-bounds read in glib/gdatetime.c:g_date_time_get_ymd via invalid GDateTime"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58012",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:40:58.048000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492247"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A buffer over-read can occur in the g_regex_replace function when used with the `G_REGEX_RAW` compile flag and case-change replacement escapes because the string_append function processes matched substrings using UTF-8 functions that assume valid UTF-8 input, even when the string is treated as raw bytes. This vulnerability can cause a minor information disclosure of 1-5 bytes and a denial of service when the buffer over-read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications that use g_regex_replace() or g_regex_replace_eval() with the G_REGEX_RAW compile flag and allow user-controlled replacement strings containing case-change escapes (\\u,\u00a0\\l,\u00a0\\U,\u00a0\\L) are vulnerable to this issue. This flaw can cause a buffer over-read of 1-5 bytes, leading to a minor information disclosure and a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58012"
},
{
"category": "external",
"summary": "RHBZ#2492247",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492247"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58012",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58012"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58012"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3918"
}
],
"release_date": "2026-03-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement strict input validation to sanitize user-supplied replacement strings, specifically rejecting or escaping case-change modifiers (\\u, \\l, \\U, \\L) before calling g_regex_replace() or g_regex_replace_eval() when the G_REGEX_RAW compile flag is used. Removing the G_REGEX_RAW flag or hardcoding the replacement strings will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in g_regex_replace() via glib/gregex.c:string_append() and g_utf8_next_char()"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58013",
"cwe": {
"id": "CWE-126",
"name": "Buffer Over-read"
},
"discovery_date": "2026-06-24T16:49:18.947000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492248"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A buffer over-read can occur in g_io_channel_read_line_backend() in the giochannel.c file when a custom line terminator with a length greater than one is set, causing memcmp to read past the GString buffer. This vulnerability can cause a minor information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications calling g_io_channel_set_line_term() with a multi-byte line terminator (length greater than one) and subsequently calling g_io_channel_read_line_backend() are vulnerable to this issue. This flaw can cause a buffer over-read of 8 bytes, leading to an information disclosure of 7 bytes or a denial of service when the buffer over-read crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58013"
},
{
"category": "external",
"summary": "RHBZ#2492248",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492248"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58013",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58013"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58013"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3925"
}
],
"release_date": "2026-04-03T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, restrict any custom line terminator string passed to g_io_channel_set_line_term() to a maximum length of one byte before calling g_io_channel_read_line_backend(). Using the default line terminators will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: buffer over-read in glib/giochannel.c via \"g_io_channel_read_line_backend\""
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58014",
"cwe": {
"id": "CWE-193",
"name": "Off-by-one Error"
},
"discovery_date": "2026-06-24T17:16:25.796000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492255"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. An off-by-one error can occur in the g_key_file_get_locale_string_list function in the gkeyfile.c file when loading a key file with an empty value. This flaw can cause an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications loading or parsing untrusted key files, typically .desktop or .ini files, are vulnerable to this issue. This flaw can cause an off-by-one error, leading to an out-of-bounds access of 1 byte or a denial of service when the out-of-bounds access crosses a page boundary. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58014"
},
{
"category": "external",
"summary": "RHBZ#2492255",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492255"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58014",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58014"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58014"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3930"
}
],
"release_date": "2026-04-07T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted key files (such as .desktop or .ini files), specifically rejecting or stripping empty values before calling g_key_file_get_locale_string_list(). Alternatively, restricting the application to only load key files from trusted sources will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: off-by-one error in glib/gkeyfile.c via \"g_key_file_get_locale_string_list\""
},
{
"acknowledgments": [
{
"names": [
"Thepwnisher"
]
}
],
"cve": "CVE-2026-58015",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-06-24T17:22:00.405000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492256"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. The D-Bus client-side implementation of the DBUS_COOKIE_SHA1 SASL authentication mechanism does not validate the cookie_context parameter received from the server. A malicious D-Bus server can supply a cookie_context containing path traversal sequences, causing the client to read an arbitrary file and exfiltrate sensitive data by verifying guessed file contents against a generated hash.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "To exploit this flaw, an attacker must be in a position to perform a man-in-the-middle (MitM) attack on the connection or operate a malicious server that the client connects to. Furthermore, extracting data requires an oracle attack (guessing and hashing), increasing the complexity of exploitation. However, if successful, this issue allows the exfiltration of sensitive secrets, such as SSH keys or API tokens, from the filesystem. Due to these reasons, this vulnerability has been rated with a moderate severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58015"
},
{
"category": "external",
"summary": "RHBZ#2492256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492256"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58015",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58015"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58015"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3931"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, ensure that applications only connect to trusted D-Bus servers and operate within secure, isolated networks to prevent man-in-the-middle (MitM) attacks. If feasible, configuring the D-Bus connection to strictly require the EXTERNAL authentication mechanism and disabling DBUS_COOKIE_SHA1 will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive"
},
{
"acknowledgments": [
{
"names": [
"linhlhq"
]
}
],
"cve": "CVE-2026-58016",
"cwe": {
"id": "CWE-191",
"name": "Integer Underflow (Wrap or Wraparound)"
},
"discovery_date": "2026-06-24T17:29:08.344000+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2492257"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in GLib. A state confusion issue exists in g_dbus_node_info_new_for_xml() in the gio/gdbusintrospection.c file when processing malformed D-Bus introspection XML, specifically with a `node` element nested within other elements like `method`, `signal`, `property` or `arg`. This issue can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\"",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Any applications processing D-Bus introspection XML input from untrusted sources with g_dbus_node_info_new_for_xml() are vulnerable to this issue. In GLib itself, the gdbus command line tool is the primary vector for local exploitation. However, other applications using the vulnerable function may process untrusted input in a way that allows a remote attacker to trigger this flaw. This vulnerability can cause an unsigned integer overflow and lead to an out-of-bounds read, resulting in a denial of service. As this vulnerability allows a remote attacker to cause a denial of service, it has been rated with an important severity.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-58016"
},
{
"category": "external",
"summary": "RHBZ#2492257",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492257"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-58016",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-58016"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-58016"
},
{
"category": "external",
"summary": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932",
"url": "https://gitlab.gnome.org/GNOME/glib/-/issues/3932"
}
],
"release_date": "2026-04-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, implement input validation to sanitize untrusted D-Bus introspection XML, specifically rejecting malformed structures such as \u003cnode\u003e elements improperly nested within \u003cmethod\u003e, \u003csignal\u003e, \u003cproperty\u003e or \u003carg\u003e elements before calling g_dbus_node_info_new_for_xml(). Alternatively, restricting the application to only process XML input from trusted, authenticated sources will completely neutralize this issue.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "glib: integer underflow in gio/gdbusintrospection.c via \"g_dbus_node_info_new_for_xml\""
},
{
"cve": "CVE-2026-59856",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-07-09T23:01:40.406872+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498867"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Vim, an open-source command-line text editor. The PHP omni-completion script improperly handles specially crafted input. When a victim opens a malicious PHP file and invokes omni-completion, an unescaped class or trait name can be interpreted as Ex commands. This allows a remote attacker to achieve arbitrary operating-system command execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Product Security has rated this vulnerability as having a Moderate impact. While successful exploitation allows for arbitrary operating-system command execution when a user opens a crafted PHP file and triggers omni-completion, this feature is disabled by default in Red Hat products. The requirement for a non-default configuration, combined with mandatory user interaction, significantly reduces the real-world risk.\"",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59856"
},
{
"category": "external",
"summary": "RHBZ#2498867",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498867"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59856",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59856"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59856"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24",
"url": "https://github.com/vim/vim/commit/43afc581a37a35762dd0ef292f038b9dc5680a24"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97",
"url": "https://github.com/vim/vim/security/advisories/GHSA-fh26-8f79-wj97"
}
],
"release_date": "2026-07-09T22:39:01.803000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Users should exercise caution when opening untrusted PHP files and avoid invoking omni-completion on them. To prevent exploitation, the PHP omni-completion script can be disabled by moving or renaming `phpcomplete.vim`. For example, execute `mv /usr/share/vim/vim*/autoload/phpcomplete.vim /usr/share/vim/vim*/autoload/phpcomplete.vim.bak`. This action will disable PHP omni-completion functionality. A restart of Vim is necessary for this change to take effect.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Arbitrary code execution via crafted PHP file in omni-completion"
},
{
"cve": "CVE-2026-59858",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"discovery_date": "2026-07-09T23:01:43.278752+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498868"
}
],
"notes": [
{
"category": "description",
"text": "A command injection vulnerability in Vim\u0027s C omni-completion script allows an attacker to execute arbitrary commands if a user is tricked into opening a maliciously crafted tags file and manually invoking the autocomplete feature.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Vim\u0027s C omni-completion script allows for arbitrary command execution. Exploitation requires a user to open a specially crafted C source file along with a malicious project tags file and then invoke C omni-completion. This limits the attack vector as it relies on specific user interaction and the presence of a hostile tags file, making it less likely to be exploited without user awareness.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59858"
},
{
"category": "external",
"summary": "RHBZ#2498868",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498868"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59858",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59858"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59858"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e",
"url": "https://github.com/vim/vim/commit/6b611b0d15603c52ebdad17172b0232b4f65704e"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x",
"url": "https://github.com/vim/vim/security/advisories/GHSA-mf92-v4xw-j45x"
}
],
"release_date": "2026-07-09T22:37:52.789000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Users are advised to avoid opening untrusted C source files or project tags files in Vim. Exercising caution and only processing trusted content prevents exploitation.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "LOCAL",
"availabilityImpact": "LOW",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion"
},
{
"cve": "CVE-2026-60002",
"cwe": {
"id": "CWE-825",
"name": "Expired Pointer Dereference"
},
"discovery_date": "2026-07-08T01:01:33.808610+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2497936"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in OpenSSH. A remote attacker could exploit a use-after-free vulnerability on the client side when a server changes its host key during a key re-exchange. This could lead to high impact on confidentiality and integrity, and low impact on availability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important flaw in OpenSSH client could allow a malicious SSH server to execute arbitrary code on the connecting client due to a use-after-free vulnerability during host key re-exchange. While requiring a connection to a specially crafted server, the potential for high impact on client confidentiality and integrity elevates the severity beyond Moderate.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-60002"
},
{
"category": "external",
"summary": "RHBZ#2497936",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2497936"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-60002",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-60002"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60002"
},
{
"category": "external",
"summary": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2",
"url": "https://marc.info/?l=openssh-unix-dev\u0026m=178333966933090\u0026w=2"
},
{
"category": "external",
"summary": "https://www.openssh.org/releasenotes.html#10.4p1",
"url": "https://www.openssh.org/releasenotes.html#10.4p1"
},
{
"category": "external",
"summary": "https://www.openwall.com/lists/oss-security/2026/07/06/5",
"url": "https://www.openwall.com/lists/oss-security/2026/07/06/5"
}
],
"release_date": "2026-07-08T00:17:33.058000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this issue, OpenSSH clients should only connect to trusted SSH servers. Enforcing strict host key checking and carefully managing `known_hosts` files can help prevent connections to servers with unexpected or altered host keys, thereby reducing exposure to this client-side vulnerability.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.7,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openssh: OpenSSH: Use-after-free vulnerability during host key re-exchange on the client side"
},
{
"cve": "CVE-2026-73066",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-11T15:01:14.226581+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514011"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Tesseract, an open-source Optical Character Recognition (OCR) engine. A remote attacker could exploit this by providing a specially crafted .traineddata LSTM model component. When Tesseract\u0027s deserializer processes this component during OCR recognition, an unchecked integer multiplication can occur, leading to an undersized buffer and a heap out-of-bounds write. This vulnerability could result in a denial of service or potentially arbitrary code execution.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73066"
},
{
"category": "external",
"summary": "RHBZ#2514011",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514011"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73066",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73066"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73066"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72",
"url": "https://github.com/tesseract-ocr/tesseract/commit/2f4d2f4bf45c363785d7bf1da29b6628f8939a72"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/pull/4588",
"url": "https://github.com/tesseract-ocr/tesseract/pull/4588"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3",
"url": "https://github.com/tesseract-ocr/tesseract/releases/tag/5.5.3"
},
{
"category": "external",
"summary": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8",
"url": "https://github.com/tesseract-ocr/tesseract/security/advisories/GHSA-7j76-5rq5-5jg8"
}
],
"release_date": "2026-08-11T14:49:16.817000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid processing `.traineddata` files from untrusted sources with Tesseract. Ensure that only `.traineddata` files from known, reputable origins are used for OCR recognition.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "tesseract: Tesseract: Heap out-of-bounds write via crafted .traineddata"
},
{
"cve": "CVE-2026-73072",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"discovery_date": "2026-08-11T15:41:15.596551+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514037"
}
],
"notes": [
{
"category": "description",
"text": "A heap buffer overflow in Vim allows a local attacker to cause a denial of service or potentially execute arbitrary code. The flaw is triggered by processing a specially crafted spell file, where the set_sofo() function fails to reset internal data between sections, leading to an out-of-bounds write.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Heap buffer overflow allows arbitrary code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A local attacker can exploit an Important heap buffer overflow in Vim to execute arbitrary code by tricking a user into loading a malicious spell file.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73072"
},
{
"category": "external",
"summary": "RHBZ#2514037",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514037"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73072",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73072"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a",
"url": "https://github.com/vim/vim/commit/05c41c922309c7a11b6ec2f124be66551c90d66a"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/releases/tag/v9.2.0846",
"url": "https://github.com/vim/vim/releases/tag/v9.2.0846"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64",
"url": "https://github.com/vim/vim/security/advisories/GHSA-9jqx-hgpr-6v64"
}
],
"release_date": "2026-08-11T15:31:35.331000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "If spell checking is unused, disable it with set nospell in ~/.vimrc and do not set spelllang. If spell is required, load only trusted .spl files from Vim\u2019s spell directories and do not place untrusted spell files on runtimepath. Additionally, consider disabling modelines (set nomodeline in ~/.vimrc) to prevent untrusted text files from automatically overriding these settings when opened.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Heap buffer overflow allows arbitrary code execution"
},
{
"cve": "CVE-2026-73076",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-11T15:41:02.894650+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514034"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in Vim allows remote attackers to execute arbitrary commands by crafting a malicious .VimballRecord file that injects OS commands executed when processed by the vimball#RmVimball() function.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary command execution via crafted vimball",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important vulnerability in Vim where a crafted vimball can lead to arbitrary command execution. The flaw allows an attacker to embed malicious commands within a `.VimballRecord` file, which are then executed with user privileges during a later, unrelated vimball installation or removal. This extends the impact of processing untrusted vimball files beyond the initial installation.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73076"
},
{
"category": "external",
"summary": "RHBZ#2514034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514034"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73076",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73076"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73076"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452",
"url": "https://github.com/vim/vim/commit/581a2f3ac9c6f96a26324f6b2c8c11415fd0d452"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2",
"url": "https://github.com/vim/vim/security/advisories/GHSA-r22p-fhw4-84p2"
}
],
"release_date": "2026-08-11T15:37:59.894000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "Avoid installing or removing vimballs from untrusted sources. This vulnerability relies on a user processing a malicious vimball, which then injects commands that are executed during a subsequent vimball operation. Exercise caution when handling vimball files from unknown or unverified origins.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary command execution via crafted vimball"
},
{
"cve": "CVE-2026-73077",
"cwe": {
"id": "CWE-78",
"name": "Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)"
},
"discovery_date": "2026-08-11T16:11:25.535913+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514065"
}
],
"notes": [
{
"category": "description",
"text": "A vulnerability in Vim\u0027s shell script plugins (sh.vim, zsh.vim, ps1.vim) allows arbitrary code execution if a user selects maliciously crafted text in Visual mode and triggers a keyword lookup, due to improperly escaped shell metacharacters.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Vim\u0027s shell plugins allows full system compromise in Red Hat environments if a user selects crafted text in Visual mode and triggers a keyword lookup. This does not affect RHEL 8 and older versions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73077"
},
{
"category": "external",
"summary": "RHBZ#2514065",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514065"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73077",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73077"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73077"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e",
"url": "https://github.com/vim/vim/commit/c5a82fe013e73c98004ad7cd4f906b1ad1ed610e"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2",
"url": "https://github.com/vim/vim/security/advisories/GHSA-r5v6-q6j8-8qw2"
}
],
"release_date": "2026-08-11T15:39:24.579000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this vulnerability, users can disable the `keywordprg` option for shell script filetypes. This prevents Vim from executing external commands via the `K` command with potentially untrusted input. Create or edit the following files in your Vim configuration directory:\n\n- `~/.vim/after/ftplugin/sh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/zsh.vim`: `setlocal keywordprg=`\n- `~/.vim/after/ftplugin/ps1.vim`: `setlocal keywordprg=`\n\nThis change takes effect the next time a shell script is opened in Vim.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary Code Execution via Insecure Shell Command Handling"
},
{
"cve": "CVE-2026-73078",
"cwe": {
"id": "CWE-77",
"name": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)"
},
"discovery_date": "2026-08-11T16:10:59.827742+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2514058"
}
],
"notes": [
{
"category": "description",
"text": "A flaw in Vim\u0027s netrw plugin fails to sanitize special characters in directory paths when creating GUI menu entries. Browsing or bookmarking a maliciously crafted path in GUI Vim allows attackers to execute arbitrary OS commands as the running user.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Important vulnerability in Vim\u0027s `netrw` plugin allows for arbitrary command execution in GUI Vim. By crafting a malicious directory path, an attacker could exploit improper neutralization of special characters when the path is browsed or bookmarked, leading to command injection. This issue specifically impacts GUI installations and requires user interaction.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-73078"
},
{
"category": "external",
"summary": "RHBZ#2514058",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2514058"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-73078",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73078"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-73078"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69",
"url": "https://github.com/vim/vim/commit/29c6fd090d4520592f8be7d9ec81190edf25ef69"
},
{
"category": "external",
"summary": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2",
"url": "https://github.com/vim/vim/security/advisories/GHSA-rcr7-f3wr-22r2"
}
],
"release_date": "2026-08-11T15:41:08.048000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-09-30T10:27:31+00:00",
"details": "For more information visit https://access.redhat.com/errata/RHSA-2026:73909",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:73909"
},
{
"category": "workaround",
"details": "To mitigate this issue, avoid browsing or bookmarking untrusted or maliciously crafted directory paths within GUI Vim. Users should exercise caution when interacting with `netrw` menu entries derived from external or untrusted sources.",
"product_ids": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift AI 3.0:registry.redhat.io/rhai/base-image-rocm-rhel9@sha256:235969824675477d8b34f5603f7d70ea713b9f07a2c376429e5d0f61761706fe_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.
Loading…