RHSA-2026:42644

Netty is an asynchronous, event-driven network application framework.

vLLM is an inference and serving engine for large language models (LLMs).

Netty is an asynchronous, event-driven network application framework.

UltraJSON is a fast JSON encoder and decoder written in pure C with bindings for Python 3.7+.

A path traversal vulnerability was identified in Ray Dashboard (default port 8265) in Ray versions prior to 2.8.1.

A vulnerability in the LightGlue model loading path of huggingface/transformers version 5.2.0 allows an attacker-controlled model repository to execute arbitrary code during model initialization.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

NLTK (Natural Language Toolkit) is a suite of open source Python modules, data sets, and tutorials supporting research and development in Natural Language Processing.

Netty is an asynchronous, event-driven network application framework.

PyJWT is a JSON Web Token implementation in Python.

pyasn1 is a generic ASN.1 library for Python.

Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/file_utils.py`.

PyJWT is a JSON Web Token implementation in Python.

python-dotenv reads key-value pairs from a .env file and can set them as environment variables.

vLLM is an inference and serving engine for large language models (LLMs).

Improper Validation of Unsafe Equivalence in punycode by the idna crate from Servo rust-url allows an attacker to create a punycode hostname that one part of a system might treat as distinct while another part of that sy…

gRPC-Go is the Go language implementation of gRPC.

Netty is an asynchronous, event-driven network application framework.

The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label.

xgrammar is an open-source library for efficient, flexible, and portable structured generation.

Pillow is a Python imaging library.

vLLM is an inference and serving engine for large language models (LLMs).

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner.

vLLM is an inference and serving engine for large language models (LLMs).

vLLM is an inference and serving engine for large language models (LLMs).

Python-Multipart is a streaming multipart parser for Python.

urllib3 is an HTTP client library for Python.

Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

When processing HTTP/2 SETTINGS frames, transport will enter an infinite loop of writing CONTINUATION frames if it receives a SETTINGS_MAX_FRAME_SIZE with a value of 0.

When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources.

multipart is a fast multipart/form-data parser for python.

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift.

Apache Log4j Core's XmlLayout https://logging.apache.org/log4j/2.x/manual/layouts.html#XmlLayout , in versions up to and including 2.25.3, fails to sanitize characters forbidden by the XML 1.0 specification https://www.w…

Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of policy mappings, possibly causing denial of service.

cryptography is a package designed to expose cryptographic primitives and recipes to Python developers.

Apache Log4j Core's Rfc5424Layout https://logging.apache.org/log4j/2.x/manual/layouts.html#RFC5424Layout , in versions 2.21.0 through 2.25.3, is vulnerable to log injection via CRLF sequences due to undocumented renames…

urllib3 is an HTTP client library for Python.

Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability.

Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability.

Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability.

Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.

Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

vLLM is an inference and serving engine for large language models (LLMs).

Memory Allocation with Excessive Size Value vulnerability in Apache Thrift.

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.

(*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

Parsing arbitrary HTML which is then rendered using Render can result in an unexpected HTML tree.

pypdf is a free and open-source pure-python PDF library.

pip would treat console_scripts and gui_scripts as paths instead of file names without sanitizing the resolved absolute path to the installation directory, leading to entry points being installed outside the installation…