Red Hat Security Advisory

RHSA-2026:25096

Red Hat AI Inference Server Model Optimization Tools 3.2.2 (cuda)

Released 2026-06-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9

Fixes 30 records

TI-2026-28979 CVE-2026-40164

jq: Algorithmic complexity DoS via hardcoded MurmurHash3 seed

HIGH 72

jq is a command-line JSON processor.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00366 Published 2026-04-13 Fixed in 0c7d133c3c7e37c00b6d46b658a02244fdd3c784 CWE-328

TI-2023-28739 CVE-2023-52356 · GHSA-cx8g-4cf5-cjv3

Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service

HIGH 72

A segment fault (SEGV) flaw was found in libtiff that could be triggered by passing a crafted tiff file to the TIFFReadRGBATileExt() API.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02222 Published 2024-01-25 Partial fix · 4.6.0, 4.6.0-6.el10_1.2 +16 CWE-122

TI-2026-28834 CVE-2026-39979

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

HIGH 70

jq is a command-line JSON processor.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.0056 Published 2026-04-13 Partial fix · 2f09060afab23fe9390cce7cb860b10416e1bf5f CWE-125

TI-2026-04471 CVE-2026-5121 · GHSA-2vwv-vqpv-v8vc

Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing

MEDIUM 51

A flaw was found in libarchive.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01092 Published 2026-03-30 Partial fix · 3.1.2-14.el7_9.2, 3.3.3-7.el8_10 +51 CWE-190

TI-2025-12872 CVE-2025-14087 · GHSA-frh9-7wfp-w73p

Glib: glib: buffer underflow in gvariant parser leads to heap corruption

MEDIUM 44

A flaw was found in GLib (Gnome Lib).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00826 Published 2025-12-10 Partial fix · 2.86.3, 2.80.4-10.el10_1.13 +37 CWE-190

TI-2026-05344 CVE-2026-6100 · GHSA-pg25-7cx5-cvcm

Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure

MEDIUM 42

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00579 Published 2026-04-13 Partial fix · 3.10.21, 3.11.16 +4 CWE-416

TI-2026-04544 CVE-2026-5201 · GHSA-9pr2-m366-8728

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

MEDIUM 41

A flaw was found in the gdk-pixbuf library.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01148 Published 2026-03-31 Partial fix · 2.42.12-4.el10_1.5, 2.42.12-4.el10_2.5 +20 CWE-122

TI-2026-03838 CVE-2026-4424 · GHSA-c75f-55f6-f63q

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

MEDIUM 41

A flaw was found in libarchive.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01287 Published 2026-03-19 Partial fix · 3.7.7-8.el10_1, 3.7.7-5.el10_0 +54 CWE-125

TI-2026-21585 CVE-2026-27135

nghttp2 Denial of service: Assertion failure due to the missing state validation

MEDIUM 40

nghttp2 is an implementation of the Hypertext Transfer Protocol version 2 in C.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00823 Published 2026-03-18 Fixed in 1.68.1 CWE-617

TI-2026-03561 CVE-2026-4111 · GHSA-xrqh-48jh-pjv2

Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive

MEDIUM 40

A flaw was identified in the RAR5 archive decompression logic of the libarchive library, specifically within the archive_read_data() processing path.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00721 Published 2026-03-13 Partial fix · 3.7.7-5.el10_1, 3.7.7-5.el10_0 +33 CWE-835

TI-2026-22691 CVE-2026-28417

Vim has OS Command Injection in netrw

LOW 39

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.01353 Published 2026-02-27 Fixed in 9.2.0073 CWE-86

TI-2026-27521 CVE-2026-35385 · GHSA-jgqr-738j-43cg

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an…

LOW 38

In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (pres…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00573 Published 2026-04-02 Partial fix · 10.3 CWE-281

TI-2026-27522 CVE-2026-35386 · GHSA-v93f-5rx7-jm73

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a…

LOW 37

In OpenSSH before 10.3, command execution can occur via shell metacharacters in a username within a command line.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00324 Published 2026-04-02 Partial fix · 10.3 CWE-696

TI-2026-25813 CVE-2026-33416

LIBPNG has use-after-free via pointer aliasing in `png_set_tRNS` and `png_set_PLTE`

LOW 37

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.5 Network No auth User interaction EPSS 0.01071 Published 2026-03-26 Partial fix · 1.6.56 CWE-416

TI-2026-04164 CVE-2026-4775 · GHSA-cm99-m826-vgg7

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

LOW 37

A flaw was found in the libtiff library.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.0057 Published 2026-03-24 Partial fix · 4.6.0-6.el10_1.3, 4.6.0-8.el10_2.1 +26 CWE-190

TI-2026-25809 CVE-2026-33412

Vim affected by Command injection via newline in glob()

LOW 36

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.3 Local Low privileges User interaction EPSS 0.00867 Published 2026-03-24 Fixed in 9.2.0202 CWE-78

TI-2026-27550 CVE-2026-35414 · GHSA-f6c7-fj8h-5898

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon…

LOW 35

OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certain use of comma characters.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00218 Published 2026-04-02 Partial fix · 10.3 CWE-670

TI-2026-26017 CVE-2026-33636

LIBPNG has ARM NEON Palette Expansion Out-of-Bounds Read on AArch64

LOW 35

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG (Portable Network Graphics) raster image files.

CVSS 3.1HIGH 7.6 Network No auth User interaction EPSS 0.00751 Published 2026-03-26 Partial fix · 1.6.56 CWE-125

TI-2026-22695 CVE-2026-28421

Vim has a heap-buffer-overflow and a segmentation fault

LOW 35

Vim is an open source, command line text editor.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.00206 Published 2026-02-27 Fixed in 9.2.0077 CWE-122

TI-2026-04175 CVE-2026-4786 · GHSA-cccx-m78h-m3xw

Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()

LOW 33

Mitgation of CVE-2026-4519 was incomplete.

CVSS 4.0HIGH 7.0 Local No auth User interaction EPSS 0.0029 Published 2026-04-13 Partial fix · 3.10.21, 3.11.16 +4 CWE-77

TI-2026-03926 CVE-2026-4519 · GHSA-rm92-fj5q-mpj5

webbrowser.open() allows leading dashes in URLs

LOW 33

The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers.

CVSS 4.0HIGH 7.0 Local No auth User interaction EPSS 0.0032 Published 2026-03-20 Fixed in 3.10.21, 3.11.16 +4 CWE-20

TI-2026-04252 CVE-2026-4878

Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()

LOW 32

A flaw was found in libcap.

CVSS 3.1HIGH 7.0 Local Low privileges No interaction EPSS 0.00209 Published 2026-04-09 Partial fix · 2.69-7.el10_1.1, 2.69-7.el10_2.1 +51 CWE-367

TI-2023-21222 CVE-2023-40403 · GHSA-j822-w26r-9cxf

Apple iOS and iPadOS: Processing web content may disclose sensitive information

LOW 32

The issue was addressed with improved memory handling.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.01327 Published 2023-09-26 Partial fix · 17, 12.7 +4

TI-2025-13528 CVE-2025-14831 · GHSA-pm8w-jq9r-x5rp

Gnutls: gnutls: denial of service via excessive resource consumption during certificate verification

LOW 31

A flaw was found in GnuTLS.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00656 Published 2026-02-09 Partial fix · 3.8.10-3.el10_1, 3.8.9-9.el10_0.17 +40 CWE-407

TI-2025-13255 CVE-2025-14512 · GHSA-2p5v-p767-wqv5

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

LOW 30

A flaw was found in glib.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00579 Published 2025-12-11 Partial fix · 2.86.3, 2.80.4-10.el10_1.13 +35 CWE-190

TI-2026-20817 CVE-2026-25749

Heap Overflow in Vim

LOW 29

Vim is an open source, command line text editor.

CVSS 3.1MEDIUM 6.6 Local Low privileges User interaction EPSS 0.00262 Published 2026-02-06 Partial fix · 9.1.2132 CWE-122

TI-2026-27523 CVE-2026-35387 · GHSA-hpxh-vgmp-3qp6

OpenSSH before 10.3 can use unintended ECDSA algorithms.

LOW 28

OpenSSH before 10.3 can use unintended ECDSA algorithms.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00241 Published 2026-04-02 Partial fix · 10.3 CWE-670

TI-2026-03014 CVE-2026-3497 · GHSA-wcpp-3x59-h8vp

Use of uninitialized resource in Ubuntu openssh

LOW 24

Vulnerability in the OpenSSH GSSAPI delta included in various Linux distributions.

CVSS 4.0LOW 2.7 Network No auth No interaction EPSS 0.02375 Published 2026-03-12 Partial fix · 1:10.0p1-5ubuntu5.1, 1:9.6p1-3ubuntu13.15 +1 CWE-908

TI-2026-19228 CVE-2026-23868 · GHSA-hq9h-682q-jg37

Double free in giflib

LOW 22

Giflib contains a double-free vulnerability that is the result of a shallow copy in GifMakeSavedImage and incorrect error handling.

CVSS 3.1MEDIUM 5.1 Local No auth No interaction EPSS 0.00174 Published 2026-03-10 Partial fix CWE-415

TI-2026-27524 CVE-2026-35388 · GHSA-9fjj-jvxf-738c

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

LOW 12

OpenSSH before 10.3 omits connection multiplexing confirmation for proxy-mode multiplexing sessions.

CVSS 3.1LOW 2.5 Local No auth User interaction EPSS 0.00132 Published 2026-04-02 Partial fix · 10.3 CWE-420