jq is a command-line JSON processor.
RHSA-2026:30087
Red Hat AI Inference Server 3.3.5 (Spyre)
Released 2026-06-25 · Red Hat rating Critical · View on Red Hat →
Fixed in
- Red Hat AI Inference Server 3.3 registry.redhat.io/rhaiis/vllm-spyre-rhel9
Fixes 20 records
jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers
jq is a command-line JSON processor.
vLLM leaks a heap address when PIL throws an error
vLLM is an inference and serving engine for large language models (LLMs).
vLLM vulnerable to Server-Side Request Forgery (SSRF) in `MediaConnector`
vLLM is an inference and serving engine for large language models (LLMs).
vLLM vulnerable to remote code execution via transformers_utils/get_config
vLLM is an inference and serving engine for large language models (LLMs).
vLLM affected by RCE via auto_map dynamic module loading during model initialization
vLLM is an inference and serving engine for large language models (LLMs).
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used.
VLLM deserialization vulnerability leading to DoS and potential RCE
vLLM is an inference and serving engine for large language models (LLMs).
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
urllib3 is an HTTP client library for Python.
OpenEXR has a signed 32-bit Overflow in PIZ Decoder Leads to OOB Read/Write
OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry.
Starlette: SSRF and NTLM credential theft via UNC paths in StaticFiles on Windows
Starlette is a lightweight ASGI framework/toolkit.
An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec.
An issue was discovered in libsndfile 1.2.2 IMA ADPCM codec.
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an…
In OpenSSH before 10.3, a file downloaded by scp may be installed setuid or setgid, an outcome contrary to some users' expectations, if the download is performed as root with -O (legacy scp protocol) and without -p (pres…
Vim is an open source, command line text editor.
Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing
A flaw was found in the libtiff library.
urllib3: Sensitive headers forwarded across origins in proxied low-level redirects
urllib3 is an HTTP client library for Python.
Integer overflow in Red Hat Enterprise Linux 10
A flaw was found in Poppler's Splash backend.
vLLM is vulnerable to DoS in Idefics3 vision models via image payload with ambiguous dimensions
vLLM is an inference and serving engine for large language models (LLMs).
Incomplete mitigation of CVE-2026-4519, %action expansion for command injection to webbrowser.open()
Mitgation of CVE-2026-4519 was incomplete.
Libcap: libcap: privilege escalation via toctou race condition in cap_set_file()
A flaw was found in libcap.