Red Hat Security AdvisoryRHSA-2026:16174
Red Hat AI Inference Server 3.3.3 (Spyre)
Released 2026-05-12 · Red Hat rating Important · View on Red Hat →
Fixes 29 records
Priority HIGH 72
cbor2 provides encoding and decoding for the Concise Binary Object Representation (CBOR) serialization format.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.00397 · Published 2026-03-23 · Partial fix · 5.9.0 CWE-674
Priority HIGH 72
A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.02222 · Published 2024-01-25 · Partial fix · 4.6.0, 4.6.0-6.el10_1.2 +16 CWE-122
Priority HIGH 69
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 4.0HIGH 8.3· Network · No auth · No interaction · EPSS 0.0112 · Published 2026-02-10 · Partial fix · 1.6.55 CWE-122
Priority MEDIUM 51
A flaw was found in libarchive.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.01092 · Published 2026-03-30 · Partial fix · 3.1.2-14.el7_9.2, 3.3.3-7.el8_10 +51 CWE-190
Priority MEDIUM 45
Pillow is a Python imaging library.
CVSS 4.0HIGH 8.7· Network · No auth · No interaction · EPSS 0.00671 · Published 2026-04-15 · Partial fix · 12.2.0 CWE-400
Priority MEDIUM 45
Pillow is a Python imaging library.
CVSS 4.0HIGH 8.6· Local · No auth · No interaction · EPSS 0.00403 · Published 2026-02-11 · Partial fix · 12.1.1 CWE-787
Priority MEDIUM 43
A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages.
CVSS 4.0HIGH 8.2· Network · No auth · No interaction · EPSS 0.00712 · Published 2026-01-23 · Fixed in 6.33.5, 5.29.6 CWE-674
Priority MEDIUM 41
A flaw was found in the gdk-pixbuf library.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01148 · Published 2026-03-31 · Partial fix · 2.42.12-4.el10_1.5, 2.42.12-4.el10_2.5 +20 CWE-122
Priority MEDIUM 41
A flaw was found in libarchive.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01287 · Published 2026-03-19 · Partial fix · 3.7.7-8.el10_1, 3.7.7-5.el10_0 +54 CWE-125
Priority MEDIUM 41
Heap buffer overflow in libvpx.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00699 · Published 2026-02-16 · Partial fix · 115.32.1, 140.7.1 +3 CWE-122
Priority MEDIUM 40
nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00823 · Published 2026-03-18 · Fixed in 1.68.1 CWE-617
Priority MEDIUM 40
A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00721 · Published 2026-03-13 · Partial fix · 3.7.7-5.el10_1, 3.7.7-5.el10_0 +33 CWE-835
Priority LOW 39
Vim is an open source, command line text editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.01353 · Published 2026-02-27 · Fixed in 9.2.0073 CWE-86
Priority LOW 38
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.
CVSS 4.0HIGH 8.4· Local · No auth · User interaction · EPSS 0.00241 · Published 2026-03-03 · Partial fix · 3.2.6, 3.3.8 +1 CWE-787
Priority LOW 36
Vim is an open source, command line text editor.
CVSS 3.1HIGH 7.3· Local · Low privileges · User interaction · EPSS 0.00867 · Published 2026-03-24 · Fixed in 9.2.0202 CWE-78
Priority LOW 36
MUNGE is an authentication service for creating and validating user credentials.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.0034 · Published 2026-02-10 · Fixed in 0.5.18 CWE-787
Priority LOW 35
Vim is an open source, command line text editor.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00206 · Published 2026-02-27 · Fixed in 9.2.0077 CWE-122
Priority LOW 33
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00134 · Published 2026-01-12 · Partial fix · 1.6.54 CWE-125
Priority LOW 33
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.
CVSS 4.0HIGH 7.0· Local · No auth · User interaction · EPSS 0.0032 · Published 2026-03-20 · Fixed in 3.10.21, 3.11.16 +4 CWE-20
Priority LOW 32
When reading an HTTP response from a server, if no read amount is specified, the default behavior will be to use Content-Length.
CVSS 4.0MEDIUM 6.3· Network · No auth · No interaction · EPSS 0.01748 · Published 2025-12-01 · Partial fix · 3.10.20, 3.11.15 +4 CWE-400
Priority LOW 32
The issue was addressed with improved memory handling.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.01327 · Published 2023-09-26 · Partial fix · 17, 12.7 +4
Priority LOW 31
LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.
CVSS 3.1HIGH 7.1· Local · No auth · User interaction · EPSS 0.00222 · Published 2026-01-12 · Partial fix · 1.6.54 CWE-125
Priority LOW 31
A flaw was found in GnuTLS.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.00656 · Published 2026-02-09 · Partial fix · 3.8.10-3.el10_1, 3.8.9-9.el10_0.17 +40 CWE-407
Priority LOW 29
Vim is an open source, command line text editor.
CVSS 3.1MEDIUM 6.6· Local · Low privileges · User interaction · EPSS 0.00262 · Published 2026-02-06 · Partial fix · 9.1.2132 CWE-122
Priority LOW 29
The poplib module, when passed a user-controlled command, can have additional commands injected using newlines.
CVSS 4.0MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.00377 · Published 2026-01-20 · Partial fix · 3.15.0a6 CWE-77
Priority LOW 29
The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines.
CVSS 4.0MEDIUM 5.9· Network · High privileges · No interaction · EPSS 0.00431 · Published 2026-01-20 · Partial fix · 3.13.15, 3.14.7 +1 CWE-77
Priority LOW 28
The email module, specifically the "BytesGenerator" class, didn’t properly quote newlines for email headers when serializing an email message allowing for header injection when an email is serialized.
CVSS 4.0MEDIUM 6.0· Network · Low privileges · No interaction · EPSS 0.00573 · Published 2026-01-23 · Partial fix · 3.10.20, 3.11.15 +4 CWE-93
Priority LOW 24
Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.
CVSS 4.0LOW 2.7· Network · No auth · No interaction · EPSS 0.02375 · Published 2026-03-12 · Partial fix · 1:10.0p1-5ubuntu5.1, 1:9.6p1-3ubuntu13.15 +1 CWE-908
Priority LOW 22
Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling.
CVSS 3.1MEDIUM 5.1· Local · No auth · No interaction · EPSS 0.00174 · Published 2026-03-10 · Partial fix CWE-415
THREATIST.IORead the docs