Red Hat Security Advisory

RHSA-2026:16009

Red Hat AI Inference Server 3.3.3 (ROCm)

Released 2026-05-11 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-rocm-rhel9

Fixes 22 records

TI-2026-23747 CVE-2026-30922 · GHSA-jr27-m4p2-rc6r

pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

HIGH 72

pyasn1 is a generic ASN.1 library for Python.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00835 Published 2026-03-18 Partial fix · 0.6.3 CWE-674

TI-2026-21200 CVE-2026-26209 · GHSA-3c37-wwvx-h642

cbor2 has a Denial of Service via Uncontrolled Recursion in cbor2.loads

HIGH 72

cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.00397 Published 2026-03-23 Partial fix · 5.9.0 CWE-674

TI-2026-04471 CVE-2026-5121 · GHSA-2vwv-vqpv-v8vc

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

MEDIUM 51

A flaw was found in libarchive.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01092 Published 2026-03-30 Partial fix · 3.1.2-14.el7_9.2, 3.3.3-7.el8_10 +51 CWE-190

TI-2026-29006 CVE-2026-40192 · GHSA-whj4-6x5x-4v2j

Pillow is vulnerable to a FITS GZIP decompression bomb

MEDIUM 45

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00671 Published 2026-04-15 Partial fix · 12.2.0 CWE-400

TI-2026-30619 CVE-2026-42311 · GHSA-pwv6-vv43-88gr

Pillow: OOB Write with Invalid PSD Tile Extents (Integer Overflow)

MEDIUM 44

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.0015 Published 2026-05-09 Partial fix · 12.2.0 CWE-190

TI-2026-04544 CVE-2026-5201 · GHSA-9pr2-m366-8728

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

MEDIUM 41

A flaw was found in the gdk-pixbuf library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01148 Published 2026-03-31 Partial fix · 2.42.12-4.el10_1.5, 2.42.12-4.el10_2.5 +20 CWE-122

TI-2026-03838 CVE-2026-4424 · GHSA-c75f-55f6-f63q

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

MEDIUM 41

A flaw was found in libarchive.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01287 Published 2026-03-19 Partial fix · 3.7.7-8.el10_1, 3.7.7-5.el10_0 +54 CWE-125

TI-2026-21585 CVE-2026-27135

nghttp2 Denial of service: Assertion failure due to the missing state validation

MEDIUM 40

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00823 Published 2026-03-18 Fixed in 1.68.1 CWE-617

TI-2026-03561 CVE-2026-4111 · GHSA-xrqh-48jh-pjv2

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

MEDIUM 40

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00721 Published 2026-03-13 Partial fix · 3.7.7-5.el10_1, 3.7.7-5.el10_0 +33 CWE-835

TI-2026-22691 CVE-2026-28417

Vim has OS Command Injection in netrw

LOW 39

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01353 Published 2026-02-27 Fixed in 9.2.0073 CWE-86

TI-2026-22004 CVE-2026-27622 · GHSA-cr4v-6jm6-4963

OpenEXR CompositeDeepScanLine integer-overflow leads to heap OOB write

LOW 38

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.

CVSS 4.0HIGH 8.4 Local No auth User interaction EPSS 0.00241 Published 2026-03-03 Partial fix · 3.2.6, 3.3.8 +1 CWE-787

TI-2026-25809 CVE-2026-33412

Vim affected by Command injection via newline in glob()

LOW 36

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00867 Published 2026-03-24 Fixed in 9.2.0202 CWE-78

TI-2026-22695 CVE-2026-28421

Vim has a heap-buffer-overflow and a segmentation fault

LOW 35

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00206 Published 2026-02-27 Fixed in 9.2.0077 CWE-122

TI-2026-03926 CVE-2026-4519 · GHSA-rm92-fj5q-mpj5

webbrowser.open() allows leading dashes in URLs

LOW 33

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.

CVSS 4.0HIGH 7.0 Local No auth User interaction EPSS 0.0032 Published 2026-03-20 Fixed in 3.10.21, 3.11.16 +4 CWE-20

TI-2023-21222 CVE-2023-40403 · GHSA-j822-w26r-9cxf

Apple iOS and iPadOS: Processing web content may disclose sensitive information

LOW 32

The issue was addressed with improved memory handling.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01327 Published 2023-09-26 Partial fix · 17, 12.7 +4

TI-2025-13528 CVE-2025-14831 · GHSA-pm8w-jq9r-x5rp

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

LOW 31

A flaw was found in GnuTLS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00656 Published 2026-02-09 Partial fix · 3.8.10-3.el10_1, 3.8.9-9.el10_0.17 +40 CWE-407

TI-2026-20817 CVE-2026-25749

Heap Overflow in Vim

LOW 29

Vim is an open source, command line text editor.

CVSS 3.1MEDIUM 6.6 Local Low privileges User interaction EPSS 0.00262 Published 2026-02-06 Partial fix · 9.1.2132 CWE-122

TI-2026-03014 CVE-2026-3497 · GHSA-wcpp-3x59-h8vp

Use of uninitialized resource in Ubuntu openssh

LOW 24

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.02375 Published 2026-03-12 Partial fix · 1:10.0p1-5ubuntu5.1, 1:9.6p1-3ubuntu13.15 +1 CWE-908

TI-2026-30618 CVE-2026-42310 · GHSA-r73j-pqj5-w3x7

Pillow: PDF Parsing Trailer Infinite Loop (DoS)

LOW 22

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00171 Published 2026-05-09 Partial fix · 12.2.0 CWE-835

TI-2026-30617 CVE-2026-42309 · GHSA-5xmw-vc9v-4wf2

Pillow: Heap buffer overflow with nested list coordinates

LOW 22

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00133 Published 2026-05-09 Partial fix · 12.2.0 CWE-122

TI-2026-30616 CVE-2026-42308 · GHSA-wjx4-4jcj-g98j

Pillow: Integer overflow when processing fonts

LOW 22

Pillow is a Python imaging library.

CVSS 4.0MEDIUM 5.1 Local No auth No interaction EPSS 0.00114 Published 2026-05-09 Partial fix · 12.2.0 CWE-190

TI-2026-19228 CVE-2026-23868 · GHSA-hq9h-682q-jg37

Double free in giflib

LOW 22

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00174 Published 2026-03-10 Partial fix CWE-415